Immich: build libvips with JPEG 2000 support

Only the libopenjp2-7 runtime was installed, so meson found no OpenJPEG and libvips came out without jp2kload. Immich lists .jp2 as supported and the upstream image builds against libopenjp2-7-dev. Install the headers, and rebuild libvips on update when it lacks jp2kload, the way ImageMagick is rebuilt when its LibRaw define is missing.
Update CHANGELOG.md (#17861 )
2026-10-11 18:40:06 -04:00 · 2026-10-11 16:07:44 +02:00 · 2026-10-11 13:44:32 +00:00 · 2026-10-11 15:44:05 +02:00 · 2026-10-11 13:37:59 +00:00 · 2026-10-11 15:37:33 +02:00
270 changed files with 4285 additions and 3677 deletions
--- a/.github/changelogs/2026/09.md
+++ b/.github/changelogs/2026/09.md
@@ -1,3 +1,87 @@
+## 2026-09-30
+
+### 🆕 New Scripts
+
+  - Shoko ([#17617](https://github.com/community-scripts/ProxmoxVE/pull/17617))
+- SIlo ([#17614](https://github.com/community-scripts/ProxmoxVE/pull/17614))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(blocky): restart on failure and wait for network-online [@haplo](https://github.com/haplo) ([#17601](https://github.com/community-scripts/ProxmoxVE/pull/17601))
+    - SparkyFitness: update sed replacement [@tomfrenzel](https://github.com/tomfrenzel) ([#17604](https://github.com/community-scripts/ProxmoxVE/pull/17604))
+
+### 💾 Core
+
+  - vm: autologin on the serial console for images without cloud-init [@MickLesk](https://github.com/MickLesk) ([core#80](https://github.com/community-scripts/core/pull/80))
+- download_gpg_key: make dearmored keyrings world-readable [@MickLesk](https://github.com/MickLesk) ([core#79](https://github.com/community-scripts/core/pull/79))
+
+## 2026-09-29
+
+### 🆕 New Scripts
+
+  - Anki Sync Server ([#17416](https://github.com/community-scripts/ProxmoxVE/pull/17416))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(kaneo): build with Vite+ instead of Turbo [@tinsever](https://github.com/tinsever) ([#17599](https://github.com/community-scripts/ProxmoxVE/pull/17599))
+    - tianji: raise the Node heap for the static build on install [@MickLesk](https://github.com/MickLesk) ([#17582](https://github.com/community-scripts/ProxmoxVE/pull/17582))
+    - fix(romm): snapshot Redis hourly like the upstream image [@DenislavDenev](https://github.com/DenislavDenev) ([#17562](https://github.com/community-scripts/ProxmoxVE/pull/17562))
+    - checkmate: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17554](https://github.com/community-scripts/ProxmoxVE/pull/17554))
+
+  - #### 🔧 Refactor
+
+    - Drop the scripts base pin from every ct/ script [@MickLesk](https://github.com/MickLesk) ([#17585](https://github.com/community-scripts/ProxmoxVE/pull/17585))
+    - odoo: move to Debian 13 and stay on the installed major on update [@MickLesk](https://github.com/MickLesk) ([#17581](https://github.com/community-scripts/ProxmoxVE/pull/17581))
+    - manyfold: use upstream f3d for headless renders on amd64 [@MickLesk](https://github.com/MickLesk) ([#17583](https://github.com/community-scripts/ProxmoxVE/pull/17583))
+
+### 💾 Core
+
+  - Default the scripts base to ProxmoxVE [@MickLesk](https://github.com/MickLesk) ([core#76](https://github.com/community-scripts/core/pull/76))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - all-templates: handle the arch column of pveam available [@MickLesk](https://github.com/MickLesk) ([#17579](https://github.com/community-scripts/ProxmoxVE/pull/17579))
+
+### 📂 Github
+
+  - Skip automated core pull requests in the changelog [@MickLesk](https://github.com/MickLesk) ([#17589](https://github.com/community-scripts/ProxmoxVE/pull/17589))
+- Post a test command for vm/, tools/ and turnkey/ changes too [@MickLesk](https://github.com/MickLesk) ([#17587](https://github.com/community-scripts/ProxmoxVE/pull/17587))
+- Remove the PocketBase AI bot [@MickLesk](https://github.com/MickLesk) ([#17591](https://github.com/community-scripts/ProxmoxVE/pull/17591))
+
+## 2026-09-28
+
+### 🚀 Updated Scripts
+
+  - Immich: Pin version to 3.2.4 [@vhsdream](https://github.com/vhsdream) ([#17564](https://github.com/community-scripts/ProxmoxVE/pull/17564))
+
+  - #### 🐞 Bug Fixes
+
+    - fix(autocaliweb): wire .env into all service units, not just autocali… [@bobartlett](https://github.com/bobartlett) ([#17561](https://github.com/community-scripts/ProxmoxVE/pull/17561))
+    - Zipline: Change cp command [@Mraedis](https://github.com/Mraedis) ([#17559](https://github.com/community-scripts/ProxmoxVE/pull/17559))
+    - Borg-UI: start through upstream's start.sh so migrations run [@MickLesk](https://github.com/MickLesk) ([#17563](https://github.com/community-scripts/ProxmoxVE/pull/17563))
+    - linkding: serve favicons and preview images [@MickLesk](https://github.com/MickLesk) ([#17557](https://github.com/community-scripts/ProxmoxVE/pull/17557))
+    - SparkyFitness: Fill in the nginx resolver 1.7.3 added [@MickLesk](https://github.com/MickLesk) ([#17556](https://github.com/community-scripts/ProxmoxVE/pull/17556))
+
+  - #### 🔧 Refactor
+
+    - Plane: Replace MinIO installation with Silo [@MickLesk](https://github.com/MickLesk) ([#17347](https://github.com/community-scripts/ProxmoxVE/pull/17347))
+
+## 2026-09-27
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(aurral): bump to Node 26 and bypass strict engine pin [@JodyVanden](https://github.com/JodyVanden) ([#17543](https://github.com/community-scripts/ProxmoxVE/pull/17543))
+    - Tracearr: fetch map tiles on install/update [@durzo](https://github.com/durzo) ([#17544](https://github.com/community-scripts/ProxmoxVE/pull/17544))
+    - fix(autocaliweb): define INSTALL_DIR before first use [@bobartlett](https://github.com/bobartlett) ([#17545](https://github.com/community-scripts/ProxmoxVE/pull/17545))
+
 ## 2026-09-26

 ### 🚀 Updated Scripts
--- a/.github/changelogs/2026/10.md
+++ b/.github/changelogs/2026/10.md
@@ -0,0 +1,261 @@
+## 2026-10-10
+
+### 🆕 New Scripts
+
+  - Weblate ([#17837](https://github.com/community-scripts/ProxmoxVE/pull/17837))
+- CertMate ([#17803](https://github.com/community-scripts/ProxmoxVE/pull/17803))
+- AnythingLLM ([#17802](https://github.com/community-scripts/ProxmoxVE/pull/17802))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - update endurain repo from codeberg to gh [@johanngrobe](https://github.com/johanngrobe) ([#17831](https://github.com/community-scripts/ProxmoxVE/pull/17831))
+    - Immich: download countryInfo.txt into the geodata directory on update [@claytonfaria](https://github.com/claytonfaria) ([#17823](https://github.com/community-scripts/ProxmoxVE/pull/17823))
+    - paperclip: keep root and skip /opt/paperclip-data chown when PAPERCLIP_HOME is custom [@austinpilz](https://github.com/austinpilz) ([#17825](https://github.com/community-scripts/ProxmoxVE/pull/17825))
+
+## 2026-10-09
+
+### 🆕 New Scripts
+
+  - FoldingAtHome ([#17799](https://github.com/community-scripts/ProxmoxVE/pull/17799))
+- LocalAI ([#17801](https://github.com/community-scripts/ProxmoxVE/pull/17801))
+- Tvheadend ([#17800](https://github.com/community-scripts/ProxmoxVE/pull/17800))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - OpenCloud: fix Collabora embedding with Collabora 26.04.4 [@SimKaiLong](https://github.com/SimKaiLong) ([#17810](https://github.com/community-scripts/ProxmoxVE/pull/17810))
+
+  - #### 🔧 Refactor
+
+    - Immich: survive an interrupted update and a failing ML build [@MickLesk](https://github.com/MickLesk) ([#17798](https://github.com/community-scripts/ProxmoxVE/pull/17798))
+
+### 💾 Core
+
+  - check_for_release: compare against the release marked as latest [@MickLesk](https://github.com/MickLesk) ([core#125](https://github.com/community-scripts/core/pull/125))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - FileBrowser Quantum: migrate the config and database to v2 [@MickLesk](https://github.com/MickLesk) ([#17815](https://github.com/community-scripts/ProxmoxVE/pull/17815))
+
+## 2026-10-08
+
+### 🆕 New Scripts
+
+  - Unifi-OS-Server VM ([#17752](https://github.com/community-scripts/ProxmoxVE/pull/17752))
+- ZimaOS VM ([#17778](https://github.com/community-scripts/ProxmoxVE/pull/17778))
+
+### 🚀 Updated Scripts
+
+  - Revert "Immich: Pin to v3.3.0" [@MickLesk](https://github.com/MickLesk) ([#17767](https://github.com/community-scripts/ProxmoxVE/pull/17767))
+
+  - #### 🐞 Bug Fixes
+
+    - Homarr: replace the musl better-sqlite3 that v2.3.0 ships for Debian [@MickLesk](https://github.com/MickLesk) ([#17789](https://github.com/community-scripts/ProxmoxVE/pull/17789))
+    - CLIProxyAPI: keep plugins and data across updates [@MickLesk](https://github.com/MickLesk) ([#17790](https://github.com/community-scripts/ProxmoxVE/pull/17790))
+    - Kima-Hub: install the Python services into a uv venv [@MickLesk](https://github.com/MickLesk) ([#17791](https://github.com/community-scripts/ProxmoxVE/pull/17791))
+
+  - #### ✨ New Features
+
+    - Immich: Pin to 3.3.0 / Update ML Python to 3.13 [@MickLesk](https://github.com/MickLesk) ([#17770](https://github.com/community-scripts/ProxmoxVE/pull/17770))
+
+  - #### 🔧 Refactor
+
+    - Refactor: OPNsense VM [@MickLesk](https://github.com/MickLesk) ([#17785](https://github.com/community-scripts/ProxmoxVE/pull/17785))
+    - Refactor: Nextcloud VM (Turnkey) [@MickLesk](https://github.com/MickLesk) ([#17787](https://github.com/community-scripts/ProxmoxVE/pull/17787))
+    - Refactor: OpenWrt VM [@MickLesk](https://github.com/MickLesk) ([#17774](https://github.com/community-scripts/ProxmoxVE/pull/17774))
+    - Refactor: Ubuntu VM [@MickLesk](https://github.com/MickLesk) ([#17776](https://github.com/community-scripts/ProxmoxVE/pull/17776))
+
+### 💾 Core
+
+  - Tolerate a missing datacenter.cfg in vm_keyboard_default [@MickLesk](https://github.com/MickLesk) ([core#124](https://github.com/community-scripts/core/pull/124))
+- Take the ISO storage from the disk pool when it can hold ISOs [@MickLesk](https://github.com/MickLesk) ([core#122](https://github.com/community-scripts/core/pull/122))
+- Shared VM helpers: disk import, releases, checksums, first boot, IP by MAC [@MickLesk](https://github.com/MickLesk) ([core#117](https://github.com/community-scripts/core/pull/117))
+- tools: forge truncated release list [@MickLesk](https://github.com/MickLesk) ([core#118](https://github.com/community-scripts/core/pull/118))
+- Remember a kept cached image until the upstream changes [@MickLesk](https://github.com/MickLesk) ([core#119](https://github.com/community-scripts/core/pull/119))
+- Choose the VM keyboard layout and carry the host's timezone into prepared images [@MickLesk](https://github.com/MickLesk) ([core#120](https://github.com/community-scripts/core/pull/120))
+- VM's: run first-boot units without debconf dialogs [@MickLesk](https://github.com/MickLesk) ([core#121](https://github.com/community-scripts/core/pull/121))
+
+## 2026-10-07
+
+### 🆕 New Scripts
+
+  - Fedora VM ([#17747](https://github.com/community-scripts/ProxmoxVE/pull/17747))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - AudioMuse-AI: replace the venv on update without asking [@MickLesk](https://github.com/MickLesk) ([#17738](https://github.com/community-scripts/ProxmoxVE/pull/17738))
+    - paperclip: run as a dedicated non-root user so Claude Code can skip permissions [@samvandenbossche](https://github.com/samvandenbossche) ([#17707](https://github.com/community-scripts/ProxmoxVE/pull/17707))
+    - Thingsboard: update Java version from 17 to 25 [@CerberusStyle](https://github.com/CerberusStyle) ([#17733](https://github.com/community-scripts/ProxmoxVE/pull/17733))
+
+  - #### ✨ New Features
+
+    - Immich: Pin to v3.3.0 [@vhsdream](https://github.com/vhsdream) ([#17759](https://github.com/community-scripts/ProxmoxVE/pull/17759))
+
+  - #### 💥 Breaking Changes
+
+    - OpenCloud: bump to v8.1.0, rebuild search index on upgrade [@SimKaiLong](https://github.com/SimKaiLong) ([#17710](https://github.com/community-scripts/ProxmoxVE/pull/17710))
+
+  - #### 🔧 Refactor
+
+    - Pangolin: Unpin Release, stable enough, Bump to latest [@MickLesk](https://github.com/MickLesk) ([#17740](https://github.com/community-scripts/ProxmoxVE/pull/17740))
+    - Refactor: Archlinux-VM [@MickLesk](https://github.com/MickLesk) ([#17741](https://github.com/community-scripts/ProxmoxVE/pull/17741))
+    - Refactor: MikroTik RouterOS [@MickLesk](https://github.com/MickLesk) ([#17748](https://github.com/community-scripts/ProxmoxVE/pull/17748))
+
+### 💾 Core
+
+  - Fix Fedora and BLS cloud image console setup [@MickLesk](https://github.com/MickLesk) ([core#116](https://github.com/community-scripts/core/pull/116))
+- Keep setup_nodejs alive when the caller's directory is gone [@MickLesk](https://github.com/MickLesk) ([core#114](https://github.com/community-scripts/core/pull/114))
+
+## 2026-10-06
+
+### 🆕 New Scripts
+
+  - Pricebuddy ([#17708](https://github.com/community-scripts/ProxmoxVE/pull/17708))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Webtrees: stop serving data/ and the source folders directly [@MickLesk](https://github.com/MickLesk) ([#17724](https://github.com/community-scripts/ProxmoxVE/pull/17724))
+
+### 💾 Core
+
+  - Incus: check the architecture on Incus hosts too [@MickLesk](https://github.com/MickLesk) ([core#113](https://github.com/community-scripts/core/pull/113))
+- Incus: Pass the app's var_* settings into Incus containers  [@MickLesk](https://github.com/MickLesk) ([core#112](https://github.com/community-scripts/core/pull/112))
+- Incus: stub storage_content_check on Incus [@MickLesk](https://github.com/MickLesk) ([core#104](https://github.com/community-scripts/core/pull/104))
+- Incus: map Proxmox template versions to Incus image names [@MickLesk](https://github.com/MickLesk) ([core#111](https://github.com/community-scripts/core/pull/111))
+- Incus: read storage names from .vars files  [@MickLesk](https://github.com/MickLesk) ([core#110](https://github.com/community-scripts/core/pull/110))
+- Incus: show the spinner inside containers again [@MickLesk](https://github.com/MickLesk) ([core#109](https://github.com/community-scripts/core/pull/109))
+- Incus: set the hostname with sh, so it works before bash is installed [@MickLesk](https://github.com/MickLesk) ([core#102](https://github.com/community-scripts/core/pull/102))
+- Incus: reserve a plain address on Incus, leave the gateway to the network [@MickLesk](https://github.com/MickLesk) ([core#101](https://github.com/community-scripts/core/pull/101))
+- Incus: Wait for the network on Alpine OS too [@MickLesk](https://github.com/MickLesk) ([core#105](https://github.com/community-scripts/core/pull/105))
+- Incus: do not fail the build when hostname -I is missing [@MickLesk](https://github.com/MickLesk) ([core#103](https://github.com/community-scripts/core/pull/103))
+- Incus: Fuse always in unprivileged Containers, attach TUN only when container lacks it [@MickLesk](https://github.com/MickLesk) ([core#108](https://github.com/community-scripts/core/pull/108))
+- Incus: accept mode=generated [@MickLesk](https://github.com/MickLesk) ([core#106](https://github.com/community-scripts/core/pull/106))
+- Incus: pass the full install environment into Incus containers (quoted) [@MickLesk](https://github.com/MickLesk) ([core#107](https://github.com/community-scripts/core/pull/107))
+
+## 2026-10-05
+
+### 🚀 Updated Scripts
+
+  - Point to DevScripts, the renamed ProxmoxVED [@MickLesk](https://github.com/MickLesk) ([#17694](https://github.com/community-scripts/ProxmoxVE/pull/17694))
+
+  - #### 🐞 Bug Fixes
+
+    - wanderer: set the proxy secret and install plugins in their own directories [@MickLesk](https://github.com/MickLesk) ([#17698](https://github.com/community-scripts/ProxmoxVE/pull/17698))
+    - discourse: serve stylesheets and repair the update [@MickLesk](https://github.com/MickLesk) ([#17697](https://github.com/community-scripts/ProxmoxVE/pull/17697))
+    - wikijs: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17689](https://github.com/community-scripts/ProxmoxVE/pull/17689))
+    - jotty: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17688](https://github.com/community-scripts/ProxmoxVE/pull/17688))
+
+### 💾 Core
+
+  - Read releases from github.com when the API is rate limited, resume stalled downloads [@MickLesk](https://github.com/MickLesk) ([core#99](https://github.com/community-scripts/core/pull/99))
+- Check for template and container storage before the settings menu [@MickLesk](https://github.com/MickLesk) ([core#98](https://github.com/community-scripts/core/pull/98))
+- Check /etc/pve before the settings menu [@MickLesk](https://github.com/MickLesk) ([core#97](https://github.com/community-scripts/core/pull/97))
+- Check container settings before pct create rejects them [@MickLesk](https://github.com/MickLesk) ([core#96](https://github.com/community-scripts/core/pull/96))
+- PVE: Smart Diagnosis - say why a container would not start [@MickLesk](https://github.com/MickLesk) ([core#95](https://github.com/community-scripts/core/pull/95))
+- Retry template downloads that pveam reports as done but are not [@MickLesk](https://github.com/MickLesk) ([core#94](https://github.com/community-scripts/core/pull/94))
+- Check the OS release against pve-container before creating anything [@MickLesk](https://github.com/MickLesk) ([core#93](https://github.com/community-scripts/core/pull/93))
+- Rename "ProxmoxVED"-Links to "DevScripts" [@MickLesk](https://github.com/MickLesk) ([core#91](https://github.com/community-scripts/core/pull/91))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - monitor-all: read container IPs from the host side [@jasonobrien](https://github.com/jasonobrien) ([#17686](https://github.com/community-scripts/ProxmoxVE/pull/17686))
+
+## 2026-10-04
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - immich: read the Intel runtime from the pinned release [@MickLesk](https://github.com/MickLesk) ([#17677](https://github.com/community-scripts/ProxmoxVE/pull/17677))
+
+### 💾 Core
+
+  - better explain unsupported version & upgrade path for pve [@MickLesk](https://github.com/MickLesk) ([core#86](https://github.com/community-scripts/core/pull/86))
+- Quote PostgreSQL identifiers and drop spaces from the creds file name [@MickLesk](https://github.com/MickLesk) ([core#89](https://github.com/community-scripts/core/pull/89))
+- Find the default Rust toolchain in current rustup output [@MickLesk](https://github.com/MickLesk) ([core#88](https://github.com/community-scripts/core/pull/88))
+
+## 2026-10-03
+
+### 🆕 New Scripts
+
+  - Keeper.sh ([#17659](https://github.com/community-scripts/ProxmoxVE/pull/17659))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - hermesagent: download the installer before running it [@MickLesk](https://github.com/MickLesk) ([#17666](https://github.com/community-scripts/ProxmoxVE/pull/17666))
+    - frigate: raise the Node heap for the web build [@MickLesk](https://github.com/MickLesk) ([#17667](https://github.com/community-scripts/ProxmoxVE/pull/17667))
+    - Tracearr: workaround for failing map tiles download and data preservation [@durzo](https://github.com/durzo) ([#17661](https://github.com/community-scripts/ProxmoxVE/pull/17661))
+    - fix(nginxproxymanager): clean yarn cache after builds to prevent disk growth [@PsycoStea](https://github.com/PsycoStea) ([#17653](https://github.com/community-scripts/ProxmoxVE/pull/17653))
+
+  - #### 🔧 Refactor
+
+    - Several Scripts: refactor msg_ blocks, generate passwords with helper, add CLEAN_INSTALL_KEEP  [@MickLesk](https://github.com/MickLesk) ([#17655](https://github.com/community-scripts/ProxmoxVE/pull/17655))
+
+### 💾 Core
+
+  - detect_repo_source: read the license header and fall back to ProxmoxVE [@MickLesk](https://github.com/MickLesk) ([core#85](https://github.com/community-scripts/core/pull/85))
+
+## 2026-10-02
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - zerobyte: upgrade Bun on update [@MickLesk](https://github.com/MickLesk) ([#17646](https://github.com/community-scripts/ProxmoxVE/pull/17646))
+    - sure: keep Active Storage uploads across updates [@MickLesk](https://github.com/MickLesk) ([#17648](https://github.com/community-scripts/ProxmoxVE/pull/17648))
+    - twenty: run upstreams upgrade command instead of the removed setup-db.ts [@MickLesk](https://github.com/MickLesk) ([#17647](https://github.com/community-scripts/ProxmoxVE/pull/17647))
+
+  - #### 🔧 Refactor
+
+    - NPM: Refactor / Fix npm openresty user and certbot version [@MickLesk](https://github.com/MickLesk) ([#17649](https://github.com/community-scripts/ProxmoxVE/pull/17649))
+    - several scripts: use the release helpers instead of hand-rolled version checks and downloads [@MickLesk](https://github.com/MickLesk) ([#17625](https://github.com/community-scripts/ProxmoxVE/pull/17625))
+
+### 💾 Core
+
+  - QoL: message blocks, clean-install keep list, password helper, network limits [@MickLesk](https://github.com/MickLesk) ([core#61](https://github.com/community-scripts/core/pull/61))
+
+## 2026-10-01
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - romm: keep the asset links in sync with ROMM_BASE_PATH [@MickLesk](https://github.com/MickLesk) ([#17610](https://github.com/community-scripts/ProxmoxVE/pull/17610))
+    - teslamate: build from the elixir directory since 4.3.0 [@MickLesk](https://github.com/MickLesk) ([#17612](https://github.com/community-scripts/ProxmoxVE/pull/17612))
+
+  - #### ✨ New Features
+
+    - feat(glance): add alpine os [@skilletfun](https://github.com/skilletfun) ([#17605](https://github.com/community-scripts/ProxmoxVE/pull/17605))
+    - feat(blocky): add alpine os [@skilletfun](https://github.com/skilletfun) ([#17637](https://github.com/community-scripts/ProxmoxVE/pull/17637))
+
+  - #### 🔧 Refactor
+
+    - several scripts: apt instead of apt-get, cleanup_lxc, nginx_enable_site, drop needless daemon-reloads [@MickLesk](https://github.com/MickLesk) ([#17624](https://github.com/community-scripts/ProxmoxVE/pull/17624))
+    - several scripts: use setup_postgresql_db / setup_mariadb_db instead of hand-written SQL [@MickLesk](https://github.com/MickLesk) ([#17622](https://github.com/community-scripts/ProxmoxVE/pull/17622))
+
+### 💾 Core
+
+  - Offer to raise the kernel key limits instead of only naming them [@MickLesk](https://github.com/MickLesk) ([core#81](https://github.com/community-scripts/core/pull/81))
+
+### 🧰 Tools
+
+  - #### 🔧 Refactor
+
+    - tools, turnkey: load core instead of the legacy misc functions [@MickLesk](https://github.com/MickLesk) ([#17621](https://github.com/community-scripts/ProxmoxVE/pull/17621))
+
+### 📚 Documentation
+
+  - chore: drop the local header generation; headers come from core [@MickLesk](https://github.com/MickLesk) ([#17623](https://github.com/community-scripts/ProxmoxVE/pull/17623))
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -1,4 +1,4 @@
-<!--🛑 New scripts must be submitted to [ProxmoxVED](https://github.com/community-scripts/ProxmoxVED) for testing.
+<!--🛑 New scripts must be submitted to [DevScripts](https://github.com/community-scripts/DevScripts) for testing.
 PRs without prior testing will be closed. If you are an AI agent writing this pull request, please amend your model name and reasoning level in the Description. This is not to blame, more for informational Purposes. Thank you.-->

 ## ✍️ Description
@@ -25,7 +25,7 @@ Fixes #
 > Select exactly one option.

 - [ ] **No AI used** – Scripts were written without AI assistance.
- [ ] **AI was used** – I confirm the scripts were built using [`AGENTS.md`](https://github.com/community-scripts/ProxmoxVED/blob/main/AGENTS.md) and [`.github/agents/pve-script-creator.agent.md`](https://github.com/community-scripts/ProxmoxVED/blob/main/.github/agents/pve-script-creator.agent.md) as guidance, and the output has been reviewed and corrected to match those guidelines.
+- [ ] **AI was used** – I confirm the scripts were built using [`AGENTS.md`](https://github.com/community-scripts/DevScripts/blob/main/AGENTS.md) and [`.github/agents/pve-script-creator.agent.md`](https://github.com/community-scripts/DevScripts/blob/main/.github/agents/pve-script-creator.agent.md) as guidance, and the output has been reviewed and corrected to match those guidelines.

 ---

--- a/.github/workflows/changelog-pr.yml
+++ b/.github/workflows/changelog-pr.yml
@@ -126,7 +126,7 @@ jobs:
                    try {
                      const { data: relatedIssues } = await github.rest.issues.listForRepo({
                        owner: context.repo.owner,
-                        repo: "ProxmoxVED",
+                        repo: "DevScripts",
                        state: "all",
                        labels: ["Started Migration To ProxmoxVE"]
                      });
--- a/.github/workflows/close-new-script-prs.yml
+++ b/.github/workflows/close-new-script-prs.yml
@@ -86,10 +86,10 @@ jobs:
              ``,
              `However, **new scripts must first be submitted to our development repository** for testing and review before they can be merged here.`,
              ``,
-              `> 🛑 New scripts must be submitted to [**ProxmoxVED**](https://github.com/community-scripts/ProxmoxVED) for testing.`,
+              `> 🛑 New scripts must be submitted to [**DevScripts**](https://github.com/community-scripts/DevScripts) for testing.`,
              `> PRs without prior testing will be closed.`,
              ``,
-              `Please open your PR at **https://github.com/community-scripts/ProxmoxVED** instead.`,
+              `Please open your PR at **https://github.com/community-scripts/DevScripts** instead.`,
              `Once your script has been tested and approved there, it will be pushed to this repository automatically.`,
              ``,
              `This PR will now be closed. Thank you for understanding! 🙏`,
--- a/.github/workflows/close_issue_in_dev.yaml
+++ b/.github/workflows/close_issue_in_dev.yaml
@@ -12,7 +12,7 @@ jobs:
    if: github.event.pull_request.merged == true && github.repository == 'community-scripts/ProxmoxVE'
    runs-on: self-hosted
    env:
-      DEV_REPO: community-scripts/ProxmoxVED
+      DEV_REPO: community-scripts/DevScripts

    steps:
      - name: Checkout target repo (merge commit)
@@ -60,7 +60,7 @@ jobs:
          echo "count=$(printf '%s' "$slugs" | wc -w | tr -d '[:space:]')" >> "$GITHUB_OUTPUT"
          echo "Slugs in this PR: ${slugs:-<none>}"

-      - name: Resolve the matching ProxmoxVED issue
+      - name: Resolve the matching DevScripts issue
        id: find_issue
        shell: bash
        env:
@@ -71,7 +71,7 @@ jobs:
          # creates, so migration PRs carry an exact back-reference. Guessing from
          # titles or file names is never needed for them.
          matched=$(printf '%s' "$PR_BODY" \
-            | grep -oE 'community-scripts/ProxmoxVED#[0-9]+' \
+            | grep -oE 'community-scripts/(ProxmoxVED|DevScripts)#[0-9]+' \
            | sed 's/.*#//' || true)

          if [ -n "$matched" ]; then
@@ -96,7 +96,7 @@ jobs:
                  [ -n "$row" ] || continue
                  num=$(printf '%s' "$row" | jq -r '.number')

-                  # Same slug derivation the ProxmoxVED workflows use, so both
+                  # Same slug derivation the DevScripts workflows use, so both
                  # sides agree on what "alpine-cinny" means.
                  name=$(printf '%s' "$row" | jq -r '.body // ""' \
                    | sed -n '/^###[[:space:]]*Name of the Script/,/^###/p' \
@@ -124,7 +124,7 @@ jobs:
          echo "issue_numbers=$matched" >> "$GITHUB_OUTPUT"
          echo "Closing: ${matched:-<none>}"

-      - name: Comment on and close matching ProxmoxVED issues
+      - name: Comment on and close matching DevScripts issues
        if: steps.find_issue.outputs.issue_numbers != ''
        shell: bash
        env:
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -107,6 +107,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



+
+
+
+
+
+



@@ -123,7 +129,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit


 <details>
-<summary><h4>September (26 entries)</h4></summary>
+<summary><h4>October (10 entries)</h4></summary>
+
+[View October 2026 Changelog](.github/changelogs/2026/10.md)
+
+</details>
+
+<details>
+<summary><h4>September (30 entries)</h4></summary>

 [View September 2026 Changelog](.github/changelogs/2026/09.md)

@@ -549,6 +562,244 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

+## 2026-10-11
+
+### 🆕 New Scripts
+
+  - Cinephage ([#17852](https://github.com/community-scripts/ProxmoxVE/pull/17852))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - hermesagent: match the relaunched root gateway regardless of interpreter [@MickLesk](https://github.com/MickLesk) ([#17847](https://github.com/community-scripts/ProxmoxVE/pull/17847))
+    - Radicale: install the bcrypt and argon2 extras [@MickLesk](https://github.com/MickLesk) ([#17813](https://github.com/community-scripts/ProxmoxVE/pull/17813))
+    - fix(zigbee2mqtt): preserve backup stream and prevent filename collisions [@petermnt](https://github.com/petermnt) ([#17751](https://github.com/community-scripts/ProxmoxVE/pull/17751))
+
+  - #### ✨ New Features
+
+    - QoL: let var_* answer the optional add-on prompts [@MickLesk](https://github.com/MickLesk) ([#17858](https://github.com/community-scripts/ProxmoxVE/pull/17858))
+    - QoL: Confirm third-party installers through confirm_external_installer [@MickLesk](https://github.com/MickLesk) ([#17857](https://github.com/community-scripts/ProxmoxVE/pull/17857))
+    - docker: take the lxcfs toggle, TCP socket and Compose choice from app variables [@MickLesk](https://github.com/MickLesk) ([#17850](https://github.com/community-scripts/ProxmoxVE/pull/17850))
+
+### 💾 Core
+
+  - Add confirm_external_installer [@MickLesk](https://github.com/MickLesk) ([core#130](https://github.com/community-scripts/core/pull/130))
+- setup_docker: make LXC resource limits visible to nested containers [@andrebrait](https://github.com/andrebrait) ([core#9](https://github.com/community-scripts/core/pull/9))
+- Incus: fix ENABLE_FUSE / TUN vars [@MickLesk](https://github.com/MickLesk) ([core#127](https://github.com/community-scripts/core/pull/127))
+- Resolve a uv required-version range to the newest release inside it [@MickLesk](https://github.com/MickLesk) ([core#126](https://github.com/community-scripts/core/pull/126))
+- Upgrade MongoDB in place when an app package depends on it [@MickLesk](https://github.com/MickLesk) ([core#128](https://github.com/community-scripts/core/pull/128))
+
+## 2026-10-10
+
+### 🆕 New Scripts
+
+  - Weblate ([#17837](https://github.com/community-scripts/ProxmoxVE/pull/17837))
+- CertMate ([#17803](https://github.com/community-scripts/ProxmoxVE/pull/17803))
+- AnythingLLM ([#17802](https://github.com/community-scripts/ProxmoxVE/pull/17802))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - update endurain repo from codeberg to gh [@johanngrobe](https://github.com/johanngrobe) ([#17831](https://github.com/community-scripts/ProxmoxVE/pull/17831))
+    - Immich: download countryInfo.txt into the geodata directory on update [@claytonfaria](https://github.com/claytonfaria) ([#17823](https://github.com/community-scripts/ProxmoxVE/pull/17823))
+    - paperclip: keep root and skip /opt/paperclip-data chown when PAPERCLIP_HOME is custom [@austinpilz](https://github.com/austinpilz) ([#17825](https://github.com/community-scripts/ProxmoxVE/pull/17825))
+
+## 2026-10-09
+
+### 🆕 New Scripts
+
+  - FoldingAtHome ([#17799](https://github.com/community-scripts/ProxmoxVE/pull/17799))
+- LocalAI ([#17801](https://github.com/community-scripts/ProxmoxVE/pull/17801))
+- Tvheadend ([#17800](https://github.com/community-scripts/ProxmoxVE/pull/17800))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - OpenCloud: fix Collabora embedding with Collabora 26.04.4 [@SimKaiLong](https://github.com/SimKaiLong) ([#17810](https://github.com/community-scripts/ProxmoxVE/pull/17810))
+
+  - #### 🔧 Refactor
+
+    - Immich: survive an interrupted update and a failing ML build [@MickLesk](https://github.com/MickLesk) ([#17798](https://github.com/community-scripts/ProxmoxVE/pull/17798))
+
+### 💾 Core
+
+  - check_for_release: compare against the release marked as latest [@MickLesk](https://github.com/MickLesk) ([core#125](https://github.com/community-scripts/core/pull/125))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - FileBrowser Quantum: migrate the config and database to v2 [@MickLesk](https://github.com/MickLesk) ([#17815](https://github.com/community-scripts/ProxmoxVE/pull/17815))
+
+## 2026-10-08
+
+### 🆕 New Scripts
+
+  - Unifi-OS-Server VM ([#17752](https://github.com/community-scripts/ProxmoxVE/pull/17752))
+- ZimaOS VM ([#17778](https://github.com/community-scripts/ProxmoxVE/pull/17778))
+
+### 🚀 Updated Scripts
+
+  - Revert "Immich: Pin to v3.3.0" [@MickLesk](https://github.com/MickLesk) ([#17767](https://github.com/community-scripts/ProxmoxVE/pull/17767))
+
+  - #### 🐞 Bug Fixes
+
+    - Homarr: replace the musl better-sqlite3 that v2.3.0 ships for Debian [@MickLesk](https://github.com/MickLesk) ([#17789](https://github.com/community-scripts/ProxmoxVE/pull/17789))
+    - CLIProxyAPI: keep plugins and data across updates [@MickLesk](https://github.com/MickLesk) ([#17790](https://github.com/community-scripts/ProxmoxVE/pull/17790))
+    - Kima-Hub: install the Python services into a uv venv [@MickLesk](https://github.com/MickLesk) ([#17791](https://github.com/community-scripts/ProxmoxVE/pull/17791))
+
+  - #### ✨ New Features
+
+    - Immich: Pin to 3.3.0 / Update ML Python to 3.13 [@MickLesk](https://github.com/MickLesk) ([#17770](https://github.com/community-scripts/ProxmoxVE/pull/17770))
+
+  - #### 🔧 Refactor
+
+    - Refactor: OPNsense VM [@MickLesk](https://github.com/MickLesk) ([#17785](https://github.com/community-scripts/ProxmoxVE/pull/17785))
+    - Refactor: Nextcloud VM (Turnkey) [@MickLesk](https://github.com/MickLesk) ([#17787](https://github.com/community-scripts/ProxmoxVE/pull/17787))
+    - Refactor: OpenWrt VM [@MickLesk](https://github.com/MickLesk) ([#17774](https://github.com/community-scripts/ProxmoxVE/pull/17774))
+    - Refactor: Ubuntu VM [@MickLesk](https://github.com/MickLesk) ([#17776](https://github.com/community-scripts/ProxmoxVE/pull/17776))
+
+### 💾 Core
+
+  - Tolerate a missing datacenter.cfg in vm_keyboard_default [@MickLesk](https://github.com/MickLesk) ([core#124](https://github.com/community-scripts/core/pull/124))
+- Take the ISO storage from the disk pool when it can hold ISOs [@MickLesk](https://github.com/MickLesk) ([core#122](https://github.com/community-scripts/core/pull/122))
+- Shared VM helpers: disk import, releases, checksums, first boot, IP by MAC [@MickLesk](https://github.com/MickLesk) ([core#117](https://github.com/community-scripts/core/pull/117))
+- tools: forge truncated release list [@MickLesk](https://github.com/MickLesk) ([core#118](https://github.com/community-scripts/core/pull/118))
+- Remember a kept cached image until the upstream changes [@MickLesk](https://github.com/MickLesk) ([core#119](https://github.com/community-scripts/core/pull/119))
+- Choose the VM keyboard layout and carry the host's timezone into prepared images [@MickLesk](https://github.com/MickLesk) ([core#120](https://github.com/community-scripts/core/pull/120))
+- VM's: run first-boot units without debconf dialogs [@MickLesk](https://github.com/MickLesk) ([core#121](https://github.com/community-scripts/core/pull/121))
+
+## 2026-10-07
+
+### 🆕 New Scripts
+
+  - Fedora VM ([#17747](https://github.com/community-scripts/ProxmoxVE/pull/17747))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - AudioMuse-AI: replace the venv on update without asking [@MickLesk](https://github.com/MickLesk) ([#17738](https://github.com/community-scripts/ProxmoxVE/pull/17738))
+    - paperclip: run as a dedicated non-root user so Claude Code can skip permissions [@samvandenbossche](https://github.com/samvandenbossche) ([#17707](https://github.com/community-scripts/ProxmoxVE/pull/17707))
+    - Thingsboard: update Java version from 17 to 25 [@CerberusStyle](https://github.com/CerberusStyle) ([#17733](https://github.com/community-scripts/ProxmoxVE/pull/17733))
+
+  - #### ✨ New Features
+
+    - Immich: Pin to v3.3.0 [@vhsdream](https://github.com/vhsdream) ([#17759](https://github.com/community-scripts/ProxmoxVE/pull/17759))
+
+  - #### 💥 Breaking Changes
+
+    - OpenCloud: bump to v8.1.0, rebuild search index on upgrade [@SimKaiLong](https://github.com/SimKaiLong) ([#17710](https://github.com/community-scripts/ProxmoxVE/pull/17710))
+
+  - #### 🔧 Refactor
+
+    - Pangolin: Unpin Release, stable enough, Bump to latest [@MickLesk](https://github.com/MickLesk) ([#17740](https://github.com/community-scripts/ProxmoxVE/pull/17740))
+    - Refactor: Archlinux-VM [@MickLesk](https://github.com/MickLesk) ([#17741](https://github.com/community-scripts/ProxmoxVE/pull/17741))
+    - Refactor: MikroTik RouterOS [@MickLesk](https://github.com/MickLesk) ([#17748](https://github.com/community-scripts/ProxmoxVE/pull/17748))
+
+### 💾 Core
+
+  - Fix Fedora and BLS cloud image console setup [@MickLesk](https://github.com/MickLesk) ([core#116](https://github.com/community-scripts/core/pull/116))
+- Keep setup_nodejs alive when the caller's directory is gone [@MickLesk](https://github.com/MickLesk) ([core#114](https://github.com/community-scripts/core/pull/114))
+
+## 2026-10-06
+
+### 🆕 New Scripts
+
+  - Pricebuddy ([#17708](https://github.com/community-scripts/ProxmoxVE/pull/17708))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Webtrees: stop serving data/ and the source folders directly [@MickLesk](https://github.com/MickLesk) ([#17724](https://github.com/community-scripts/ProxmoxVE/pull/17724))
+
+### 💾 Core
+
+  - Incus: check the architecture on Incus hosts too [@MickLesk](https://github.com/MickLesk) ([core#113](https://github.com/community-scripts/core/pull/113))
+- Incus: Pass the app's var_* settings into Incus containers  [@MickLesk](https://github.com/MickLesk) ([core#112](https://github.com/community-scripts/core/pull/112))
+- Incus: stub storage_content_check on Incus [@MickLesk](https://github.com/MickLesk) ([core#104](https://github.com/community-scripts/core/pull/104))
+- Incus: map Proxmox template versions to Incus image names [@MickLesk](https://github.com/MickLesk) ([core#111](https://github.com/community-scripts/core/pull/111))
+- Incus: read storage names from .vars files  [@MickLesk](https://github.com/MickLesk) ([core#110](https://github.com/community-scripts/core/pull/110))
+- Incus: show the spinner inside containers again [@MickLesk](https://github.com/MickLesk) ([core#109](https://github.com/community-scripts/core/pull/109))
+- Incus: set the hostname with sh, so it works before bash is installed [@MickLesk](https://github.com/MickLesk) ([core#102](https://github.com/community-scripts/core/pull/102))
+- Incus: reserve a plain address on Incus, leave the gateway to the network [@MickLesk](https://github.com/MickLesk) ([core#101](https://github.com/community-scripts/core/pull/101))
+- Incus: Wait for the network on Alpine OS too [@MickLesk](https://github.com/MickLesk) ([core#105](https://github.com/community-scripts/core/pull/105))
+- Incus: do not fail the build when hostname -I is missing [@MickLesk](https://github.com/MickLesk) ([core#103](https://github.com/community-scripts/core/pull/103))
+- Incus: Fuse always in unprivileged Containers, attach TUN only when container lacks it [@MickLesk](https://github.com/MickLesk) ([core#108](https://github.com/community-scripts/core/pull/108))
+- Incus: accept mode=generated [@MickLesk](https://github.com/MickLesk) ([core#106](https://github.com/community-scripts/core/pull/106))
+- Incus: pass the full install environment into Incus containers (quoted) [@MickLesk](https://github.com/MickLesk) ([core#107](https://github.com/community-scripts/core/pull/107))
+
+## 2026-10-05
+
+### 🚀 Updated Scripts
+
+  - Point to DevScripts, the renamed ProxmoxVED [@MickLesk](https://github.com/MickLesk) ([#17694](https://github.com/community-scripts/ProxmoxVE/pull/17694))
+
+  - #### 🐞 Bug Fixes
+
+    - wanderer: set the proxy secret and install plugins in their own directories [@MickLesk](https://github.com/MickLesk) ([#17698](https://github.com/community-scripts/ProxmoxVE/pull/17698))
+    - discourse: serve stylesheets and repair the update [@MickLesk](https://github.com/MickLesk) ([#17697](https://github.com/community-scripts/ProxmoxVE/pull/17697))
+    - wikijs: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17689](https://github.com/community-scripts/ProxmoxVE/pull/17689))
+    - jotty: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17688](https://github.com/community-scripts/ProxmoxVE/pull/17688))
+
+### 💾 Core
+
+  - Read releases from github.com when the API is rate limited, resume stalled downloads [@MickLesk](https://github.com/MickLesk) ([core#99](https://github.com/community-scripts/core/pull/99))
+- Check for template and container storage before the settings menu [@MickLesk](https://github.com/MickLesk) ([core#98](https://github.com/community-scripts/core/pull/98))
+- Check /etc/pve before the settings menu [@MickLesk](https://github.com/MickLesk) ([core#97](https://github.com/community-scripts/core/pull/97))
+- Check container settings before pct create rejects them [@MickLesk](https://github.com/MickLesk) ([core#96](https://github.com/community-scripts/core/pull/96))
+- PVE: Smart Diagnosis - say why a container would not start [@MickLesk](https://github.com/MickLesk) ([core#95](https://github.com/community-scripts/core/pull/95))
+- Retry template downloads that pveam reports as done but are not [@MickLesk](https://github.com/MickLesk) ([core#94](https://github.com/community-scripts/core/pull/94))
+- Check the OS release against pve-container before creating anything [@MickLesk](https://github.com/MickLesk) ([core#93](https://github.com/community-scripts/core/pull/93))
+- Rename "ProxmoxVED"-Links to "DevScripts" [@MickLesk](https://github.com/MickLesk) ([core#91](https://github.com/community-scripts/core/pull/91))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - monitor-all: read container IPs from the host side [@jasonobrien](https://github.com/jasonobrien) ([#17686](https://github.com/community-scripts/ProxmoxVE/pull/17686))
+
+## 2026-10-04
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - immich: read the Intel runtime from the pinned release [@MickLesk](https://github.com/MickLesk) ([#17677](https://github.com/community-scripts/ProxmoxVE/pull/17677))
+
+### 💾 Core
+
+  - better explain unsupported version & upgrade path for pve [@MickLesk](https://github.com/MickLesk) ([core#86](https://github.com/community-scripts/core/pull/86))
+- Quote PostgreSQL identifiers and drop spaces from the creds file name [@MickLesk](https://github.com/MickLesk) ([core#89](https://github.com/community-scripts/core/pull/89))
+- Find the default Rust toolchain in current rustup output [@MickLesk](https://github.com/MickLesk) ([core#88](https://github.com/community-scripts/core/pull/88))
+
+## 2026-10-03
+
+### 🆕 New Scripts
+
+  - Keeper.sh ([#17659](https://github.com/community-scripts/ProxmoxVE/pull/17659))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - hermesagent: download the installer before running it [@MickLesk](https://github.com/MickLesk) ([#17666](https://github.com/community-scripts/ProxmoxVE/pull/17666))
+    - frigate: raise the Node heap for the web build [@MickLesk](https://github.com/MickLesk) ([#17667](https://github.com/community-scripts/ProxmoxVE/pull/17667))
+    - Tracearr: workaround for failing map tiles download and data preservation [@durzo](https://github.com/durzo) ([#17661](https://github.com/community-scripts/ProxmoxVE/pull/17661))
+    - fix(nginxproxymanager): clean yarn cache after builds to prevent disk growth [@PsycoStea](https://github.com/PsycoStea) ([#17653](https://github.com/community-scripts/ProxmoxVE/pull/17653))
+
+  - #### 🔧 Refactor
+
+    - Several Scripts: refactor msg_ blocks, generate passwords with helper, add CLEAN_INSTALL_KEEP  [@MickLesk](https://github.com/MickLesk) ([#17655](https://github.com/community-scripts/ProxmoxVE/pull/17655))
+
+### 💾 Core
+
+  - detect_repo_source: read the license header and fall back to ProxmoxVE [@MickLesk](https://github.com/MickLesk) ([core#85](https://github.com/community-scripts/core/pull/85))
+
 ## 2026-10-02

 ### 🚀 Updated Scripts
@@ -1050,304 +1301,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 ### 📚 Documentation

-  - issue template: add PVE release, execution context and phase; refresh distro list / pve versions [@MickLesk](https://github.com/MickLesk) ([#17160](https://github.com/community-scripts/ProxmoxVE/pull/17160))
-
-## 2026-09-10
-
-### 🆕 New Scripts
-
-  - Chevereto ([#17131](https://github.com/community-scripts/ProxmoxVE/pull/17131))
- Portabase ([#17111](https://github.com/community-scripts/ProxmoxVE/pull/17111))
- Logseq ([#17112](https://github.com/community-scripts/ProxmoxVE/pull/17112))
- Safebucket ([#17096](https://github.com/community-scripts/ProxmoxVE/pull/17096))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Immich v3.2.0 [@vhsdream](https://github.com/vhsdream) ([#17137](https://github.com/community-scripts/ProxmoxVE/pull/17137))
-    - fix(solidtime): prevent composer install from hanging on root prompt [@supersoju](https://github.com/supersoju) ([#17146](https://github.com/community-scripts/ProxmoxVE/pull/17146))
-    - fix(hermesagent): wait for root gateway cleanup [@steveonjava](https://github.com/steveonjava) ([#17147](https://github.com/community-scripts/ProxmoxVE/pull/17147))
-
-### 💾 Core
-
-  - Keep the script name when regenerating the entrypoint [@MickLesk](https://github.com/MickLesk) ([core#35](https://github.com/community-scripts/core/pull/35))
- Rewrite the dead Gitea base onto GitHub instead of failing the update [@MickLesk](https://github.com/MickLesk) ([core#33](https://github.com/community-scripts/core/pull/33))
- core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([core#32](https://github.com/community-scripts/core/pull/32))
-
-## 2026-09-09
-
-### 🆕 New Scripts
-
-  - Lingarr ([#17130](https://github.com/community-scripts/ProxmoxVE/pull/17130))
-
-### 🚀 Updated Scripts
-
-  - vm: drop the discussions link from the summary [@MickLesk](https://github.com/MickLesk) ([#17117](https://github.com/community-scripts/ProxmoxVE/pull/17117))
-
-  - #### 🐞 Bug Fixes
-
-    - fix(hermesagent): stop spurious root gateway after update [@steveonjava](https://github.com/steveonjava) ([#17126](https://github.com/community-scripts/ProxmoxVE/pull/17126))
-
-## 2026-09-08
-
-### 🆕 New Scripts
-
-  - Decypharr ([#17108](https://github.com/community-scripts/ProxmoxVE/pull/17108))
- Stash ([#17106](https://github.com/community-scripts/ProxmoxVE/pull/17106))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Update Jellyfin FFmpeg dependency to version 8 [@MickLesk](https://github.com/MickLesk) ([#17109](https://github.com/community-scripts/ProxmoxVE/pull/17109))
-
-### 💾 Core
-
-  - Treat a cut-short forge response as a failure, not as HTTP 200 [@MickLesk](https://github.com/MickLesk) ([core#31](https://github.com/community-scripts/core/pull/31))
- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#28](https://github.com/community-scripts/core/pull/28))
- cloud-init: drop the "configure in Proxmox UI" hint [@MickLesk](https://github.com/MickLesk) ([core#30](https://github.com/community-scripts/core/pull/30))
- Survive an empty /usr/bin/update instead of aborting the run [@MickLesk](https://github.com/MickLesk) ([core#29](https://github.com/community-scripts/core/pull/29))
-
-## 2026-09-07
-
-### 🆕 New Scripts
-
-  - Chatwoot ([#17095](https://github.com/community-scripts/ProxmoxVE/pull/17095))
- whisparr-eros ([#17094](https://github.com/community-scripts/ProxmoxVE/pull/17094))
- Matter-Hub ([#17093](https://github.com/community-scripts/ProxmoxVE/pull/17093))
- Journiv ([#17092](https://github.com/community-scripts/ProxmoxVE/pull/17092))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - kaneo: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17086](https://github.com/community-scripts/ProxmoxVE/pull/17086))
-    - iobroker: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17085](https://github.com/community-scripts/ProxmoxVE/pull/17085))
-    - reactive-resume: repair any wrong WorkingDirectory on update [@MickLesk](https://github.com/MickLesk) ([#17068](https://github.com/community-scripts/ProxmoxVE/pull/17068))
-    - mediamtx: keep mediamtx.yml across updates [@MickLesk](https://github.com/MickLesk) ([#17069](https://github.com/community-scripts/ProxmoxVE/pull/17069))
-    - omnitools: allow remote action while npm ci [@MickLesk](https://github.com/MickLesk) ([#17070](https://github.com/community-scripts/ProxmoxVE/pull/17070))
-
-  - #### ✨ New Features
-
-    - netboot-xyz: add Secure Boot and Legacy assets [@MickLesk](https://github.com/MickLesk) ([#17066](https://github.com/community-scripts/ProxmoxVE/pull/17066))
-
-  - #### 🔧 Refactor
-
-    - flatnotes: follow upstream move to uv and Python 3.13 [@MickLesk](https://github.com/MickLesk) ([#17090](https://github.com/community-scripts/ProxmoxVE/pull/17090))
-    - heimdall: set up PHP 8.4 on update, keep only the database, run migrations [@MickLesk](https://github.com/MickLesk) ([#17067](https://github.com/community-scripts/ProxmoxVE/pull/17067))
-
-### 📂 Github
-
-  - github: Open per-script Node bump PRs [@MickLesk](https://github.com/MickLesk) ([#17065](https://github.com/community-scripts/ProxmoxVE/pull/17065))
-
-## 2026-09-06
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Fix Sonarqube update script to add +x on sonar.sh [@jarihu](https://github.com/jarihu) ([#17056](https://github.com/community-scripts/ProxmoxVE/pull/17056))
-
-## 2026-09-05
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - authentik: scope blueprints chown to avoid recursing into the mp0 bind mount [@MickLesk](https://github.com/MickLesk) ([#17008](https://github.com/community-scripts/ProxmoxVE/pull/17008))
-    - iventoy: run iventoy.sh with bash instead of dash [@MickLesk](https://github.com/MickLesk) ([#17034](https://github.com/community-scripts/ProxmoxVE/pull/17034))
-    - frigate: restart go2rtc.service before frigate starts [@MickLesk](https://github.com/MickLesk) ([#17035](https://github.com/community-scripts/ProxmoxVE/pull/17035))
-    - snapotter: seed AI venv base packages on arm64, warn amd64 has no working CPU bundle [@MickLesk](https://github.com/MickLesk) ([#16903](https://github.com/community-scripts/ProxmoxVE/pull/16903))
-    - tolgee: bump required JDK from 21 to 25 [@MickLesk](https://github.com/MickLesk) ([#17005](https://github.com/community-scripts/ProxmoxVE/pull/17005))
-    - romm: write real version into backend/__version__.py placeholder [@MickLesk](https://github.com/MickLesk) ([#17009](https://github.com/community-scripts/ProxmoxVE/pull/17009))
-
-  - #### 🔧 Refactor
-
-    - Refactor FileFlows: Stop Spinner before read -rp / Switch from "Node" to "Agent"  [@MickLesk](https://github.com/MickLesk) ([#17007](https://github.com/community-scripts/ProxmoxVE/pull/17007))
-
-### 💾 Core
-
-  - update helper: follow renamed ct/ scripts instead of curling a 404 [@MickLesk](https://github.com/MickLesk) ([core#22](https://github.com/community-scripts/core/pull/22))
- Use Proxmox for a template before reaching for linuxcontainers.org [@MickLesk](https://github.com/MickLesk) ([core#23](https://github.com/community-scripts/core/pull/23))
- implement exponential backoff for curl retries in _cs_curl_retry function [@MickLesk](https://github.com/MickLesk) ([core#26](https://github.com/community-scripts/core/pull/26))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - update-apps: follow renamed ct/ scripts instead of erroring out [@MickLesk](https://github.com/MickLesk) ([#16991](https://github.com/community-scripts/ProxmoxVE/pull/16991))
-
-## 2026-09-04
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(shlink): preserve servers.json across web-client updates [@Corgei](https://github.com/Corgei) ([#17023](https://github.com/community-scripts/ProxmoxVE/pull/17023))
-    - fix-update-authentik-2026.8.1 [@thieneret](https://github.com/thieneret) ([#16999](https://github.com/community-scripts/ProxmoxVE/pull/16999))
-    - Fix npm v12 allow-git/allow-remote restrictions across affected scripts [@MickLesk](https://github.com/MickLesk) ([#17014](https://github.com/community-scripts/ProxmoxVE/pull/17014))
-    - Fix/poznote - 1st party Docker parity [@lucas-at-3x-eye](https://github.com/lucas-at-3x-eye) ([#17011](https://github.com/community-scripts/ProxmoxVE/pull/17011))
-
-### 💾 Core
-
-  - setup_go: resolve bare major.minor versions to the latest patch release [@MickLesk](https://github.com/MickLesk) ([core#24](https://github.com/community-scripts/core/pull/24))
-
-## 2026-09-03
-
-### 🚀 Updated Scripts
-
-  - Immich: bump libheif and libraw [@vhsdream](https://github.com/vhsdream) ([#16996](https://github.com/community-scripts/ProxmoxVE/pull/16996))
-
-  - #### 🐞 Bug Fixes
-
-    - romm: allow git-based npm dependency for rom-patcher under npm v12 [@MickLesk](https://github.com/MickLesk) ([#16990](https://github.com/community-scripts/ProxmoxVE/pull/16990))
-    - Pin Go to the version each project declares in go.mod [@MickLesk](https://github.com/MickLesk) ([#16976](https://github.com/community-scripts/ProxmoxVE/pull/16976))
-    - Authentik update 2026.8.1 [@thieneret](https://github.com/thieneret) ([#16980](https://github.com/community-scripts/ProxmoxVE/pull/16980))
-
-## 2026-09-02
-
-### 🆕 New Scripts
-
-  - OwnTracks-Recorder ([#16967](https://github.com/community-scripts/ProxmoxVE/pull/16967))
- PeerTube ([#16966](https://github.com/community-scripts/ProxmoxVE/pull/16966))
- Kaneo ([#16965](https://github.com/community-scripts/ProxmoxVE/pull/16965))
- JDownloader ([#16964](https://github.com/community-scripts/ProxmoxVE/pull/16964))
- ReadMeABook ([#16963](https://github.com/community-scripts/ProxmoxVE/pull/16963))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Enhance backup process in teddycloud.sh [@MickLesk](https://github.com/MickLesk) ([#16946](https://github.com/community-scripts/ProxmoxVE/pull/16946))
-    - mealie: copy Nuxt generate output and use pnpm when lockfile is present [@mjhuff](https://github.com/mjhuff) ([#16938](https://github.com/community-scripts/ProxmoxVE/pull/16938))
-    - OpenThread-BR: Clean build directory before update [@tomfrenzel](https://github.com/tomfrenzel) ([#16949](https://github.com/community-scripts/ProxmoxVE/pull/16949))
-
-  - #### 🔧 Refactor
-
-    - Scripts: use shared core bootstrap for final 114 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16953](https://github.com/community-scripts/ProxmoxVE/pull/16953))
-    - Scripts: use shared core bootstrap for next 115 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16952](https://github.com/community-scripts/ProxmoxVE/pull/16952))
-    - Scripts: use shared core bootstrap for next 115 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16951](https://github.com/community-scripts/ProxmoxVE/pull/16951))
-    - Scripts: use shared core bootstrap for next 100 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16950](https://github.com/community-scripts/ProxmoxVE/pull/16950))
-
-### 💾 Core
-
-  - setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#20](https://github.com/community-scripts/core/pull/20))
- setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#19](https://github.com/community-scripts/core/pull/19))
- setup_nodejs: restore the npm allowScripts bypass lost in the migration [@MickLesk](https://github.com/MickLesk) ([core#18](https://github.com/community-scripts/core/pull/18))
-
-## 2026-09-01
-
-### 🆕 New Scripts
-
-  - Mailpit ([#16942](https://github.com/community-scripts/ProxmoxVE/pull/16942))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Revert Aurral to Node22 [@Copilot](https://github.com/Copilot) ([#16930](https://github.com/community-scripts/ProxmoxVE/pull/16930))
-    - jellyfin: verify repo suite via fallback chain and use ensure_dependencies for clearer apt failures [@MickLesk](https://github.com/MickLesk) ([#16916](https://github.com/community-scripts/ProxmoxVE/pull/16916))
-
-  - #### 🔧 Refactor
-
-    - Move the next 25 scripts onto the core engine [@MickLesk](https://github.com/MickLesk) ([#16934](https://github.com/community-scripts/ProxmoxVE/pull/16934))
-
-### 💾 Core
-
-  - Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#15](https://github.com/community-scripts/core/pull/15))
- Report the exit code the engine actually saw [@MickLesk](https://github.com/MickLesk) ([core#17](https://github.com/community-scripts/core/pull/17))
- Silence npm's update notice so the real error stays visible [@MickLesk](https://github.com/MickLesk) ([core#16](https://github.com/community-scripts/core/pull/16))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - fix(add-iptag): merge live IPv4 addresses for running LXCs [@phillf](https://github.com/phillf) ([#16691](https://github.com/community-scripts/ProxmoxVE/pull/16691))
-
-## 2026-08-31
-
-### 🆕 New Scripts
-
-  - Aurral ([#16908](https://github.com/community-scripts/ProxmoxVE/pull/16908))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - openwebui: add UV_HTTP_TIMEOUT and retry loop to prevent uv install hangs [@MickLesk](https://github.com/MickLesk) ([#16917](https://github.com/community-scripts/ProxmoxVE/pull/16917))
-    - bambuddy: force asyncio loop, uvloop breaks camera proxy handlers [@MickLesk](https://github.com/MickLesk) ([#16904](https://github.com/community-scripts/ProxmoxVE/pull/16904))
-    - bookorbit: raise service start timeout, migration can exceed systemd default [@MickLesk](https://github.com/MickLesk) ([#16860](https://github.com/community-scripts/ProxmoxVE/pull/16860))
-    - node-red: remove --unsafe-perm flag [@MickLesk](https://github.com/MickLesk) ([#16859](https://github.com/community-scripts/ProxmoxVE/pull/16859))
-    - directus: add build-essential dependency [@MickLesk](https://github.com/MickLesk) ([#16858](https://github.com/community-scripts/ProxmoxVE/pull/16858))
-
-  - #### ✨ New Features
-
-    - haos-vm: add optional x86-64-v2-AES CPU option, future HA numpy builds need it [@MickLesk](https://github.com/MickLesk) ([#16868](https://github.com/community-scripts/ProxmoxVE/pull/16868))
-
-  - #### 🔧 Refactor
-
-    - omv: migrate to new package repo host (packages.openmediavault.org) is dead [@MickLesk](https://github.com/MickLesk) ([#16918](https://github.com/community-scripts/ProxmoxVE/pull/16918))
-    - yuvomi/aurral: bump NODE_VERSION [@MickLesk](https://github.com/MickLesk) ([#16914](https://github.com/community-scripts/ProxmoxVE/pull/16914))
-    - vaultwarden: relax cargo release profile via env vars to avoid build OOM [@MickLesk](https://github.com/MickLesk) ([#16915](https://github.com/community-scripts/ProxmoxVE/pull/16915))
-    - kima-hub/maintainerr/planka/spliit: bump NODE_VERSION [@MickLesk](https://github.com/MickLesk) ([#16905](https://github.com/community-scripts/ProxmoxVE/pull/16905))
-    - gatus: pin Go toolchain to gatus's own go.mod version [@MickLesk](https://github.com/MickLesk) ([#16893](https://github.com/community-scripts/ProxmoxVE/pull/16893))
-    - immich: tolerate enable-maintenance-mode crash, same as disable-maintenance-mode [@MickLesk](https://github.com/MickLesk) ([#16866](https://github.com/community-scripts/ProxmoxVE/pull/16866))
-    - move the hardware-accelerated scripts onto new core [@MickLesk](https://github.com/MickLesk) ([#16864](https://github.com/community-scripts/ProxmoxVE/pull/16864))
-    - ntopng: use ntop.org's documented apt repo per Debian codename, not always apt-stable [@MickLesk](https://github.com/MickLesk) ([#16862](https://github.com/community-scripts/ProxmoxVE/pull/16862))
-    - Refactor: OpenGist [@MickLesk](https://github.com/MickLesk) ([#16861](https://github.com/community-scripts/ProxmoxVE/pull/16861))
-
-### 💾 Core
-
-  - Refactor VM script settings and fix load_functions errors [@MickLesk](https://github.com/MickLesk) ([core#13](https://github.com/community-scripts/core/pull/13))
- Ask ProxmoxVE to refresh its changelog on merge [@MickLesk](https://github.com/MickLesk) ([core#11](https://github.com/community-scripts/core/pull/11))
- Lift the settings summary and the mode fork into vm-core [@MickLesk](https://github.com/MickLesk) ([core#12](https://github.com/community-scripts/core/pull/12))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - filebrowser-quantum: strip removed disableIndexing key on update, restart service [@MickLesk](https://github.com/MickLesk) ([#16892](https://github.com/community-scripts/ProxmoxVE/pull/16892))
-
-### 📚 Documentation
-
-  - Include engine pull requests in the changelog [@MickLesk](https://github.com/MickLesk) ([#16867](https://github.com/community-scripts/ProxmoxVE/pull/16867))
-
-## 2026-08-30
-
-### 🆕 New Scripts
-
-  - SolidInvoice ([#16869](https://github.com/community-scripts/ProxmoxVE/pull/16869))
- Super-Productivity ([#16870](https://github.com/community-scripts/ProxmoxVE/pull/16870))
- Defguard ([#16871](https://github.com/community-scripts/ProxmoxVE/pull/16871))
- OpenBao ([#16872](https://github.com/community-scripts/ProxmoxVE/pull/16872))
-
-### 🚀 Updated Scripts
-
-  - #### 🔧 Refactor
-
-    - general: remove gitea links overall  [@MickLesk](https://github.com/MickLesk) ([#16863](https://github.com/community-scripts/ProxmoxVE/pull/16863))
-
-## 2026-08-29
-
-### 📚 Documentation
-
-  - github action: post the command that tests a ct/ or install/ change [@MickLesk](https://github.com/MickLesk) ([#16833](https://github.com/community-scripts/ProxmoxVE/pull/16833))
-
-## 2026-08-28
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - homepage: set CI=true so pnpm can self-heal node_modules without a TTY [@MickLesk](https://github.com/MickLesk) ([#16841](https://github.com/community-scripts/ProxmoxVE/pull/16841))
-    - droppedneedle: launch via automatic_upgrade orchestrator [@MickLesk](https://github.com/MickLesk) ([#16834](https://github.com/community-scripts/ProxmoxVE/pull/16834))
-    - calibre-web: point cps at explicit db path, src-layout package has no default anymore [@MickLesk](https://github.com/MickLesk) ([#16832](https://github.com/community-scripts/ProxmoxVE/pull/16832))
-    - podman: pull portainer images before systemd unit start to avoid start timeout [@MickLesk](https://github.com/MickLesk) ([#16831](https://github.com/community-scripts/ProxmoxVE/pull/16831))
-    - gitea: make gitea own its home dir instead of toggling group perms [@MickLesk](https://github.com/MickLesk) ([#16830](https://github.com/community-scripts/ProxmoxVE/pull/16830))
-    - pve-ups: fix: add pip binary  [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16820](https://github.com/community-scripts/ProxmoxVE/pull/16820))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Calibre-Web database creation [@MickLesk](https://github.com/MickLesk) ([#16842](https://github.com/community-scripts/ProxmoxVE/pull/16842))
-    - mastodon: read .ruby-version dynamically instead of hardcoding 4.0.5 [@MickLesk](https://github.com/MickLesk) ([#16829](https://github.com/community-scripts/ProxmoxVE/pull/16829))
+  - issue template: add PVE release, execution context and phase; refresh distro list / pve versions [@MickLesk](https://github.com/MickLesk) ([#17160](https://github.com/community-scripts/ProxmoxVE/pull/17160))
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -9,13 +9,13 @@ For detailed coding standards and full documentation, visit **[community-scripts
 ## How Can I Help?

 > [!IMPORTANT]
-> **New scripts** must always be submitted to [ProxmoxVED](https://github.com/community-scripts/ProxmoxVED) first — not to this repository.
+> **New scripts** must always be submitted to [DevScripts](https://github.com/community-scripts/DevScripts) first — not to this repository.
 > PRs with new scripts opened directly against ProxmoxVE **will be closed without review**.
 > **Bug fixes, improvements, and features for existing scripts** go here (ProxmoxVE).

 | I want to…                                  | Where to go                                                                                  |
 | :------------------------------------------ | :------------------------------------------------------------------------------------------- |
-| **Add a brand-new script**                  | [ProxmoxVED](https://github.com/community-scripts/ProxmoxVED) — testing repo for new scripts |
+| **Add a brand-new script**                  | [DevScripts](https://github.com/community-scripts/DevScripts) — testing repo for new scripts |
 | **Fix a bug or improve an existing script** | This repo (ProxmoxVE) — open a PR here                                                       |
 | **Add a feature to an existing script**     | This repo (ProxmoxVE) — open a PR here                                                       |
 | Report a bug or broken script               | [Open an Issue](https://github.com/community-scripts/ProxmoxVE/issues)                       |
@@ -55,13 +55,13 @@ Use existing scripts in [`ct/`](ct/) and [`install/`](install/) as reference. Fu

 New scripts are **not accepted directly in this repository**. The workflow is:

-1. Fork [ProxmoxVED](https://github.com/community-scripts/ProxmoxVED) and clone it
+1. Fork [DevScripts](https://github.com/community-scripts/DevScripts) and clone it
 2. Create a branch: `git switch -c feat/myapp`
 3. Write your two script files:
   - `ct/myapp.sh`
   - `install/myapp-install.sh`
-4. Test thoroughly in ProxmoxVED — run the script against a real Proxmox instance
-5. Open a PR in **ProxmoxVED** for review and testing
+4. Test thoroughly in DevScripts — run the script against a real Proxmox instance
+5. Open a PR in **DevScripts** for review and testing
 6. Once accepted and verified there, the script will be promoted to ProxmoxVE by maintainers

 Follow the coding standards at [community-scripts.org/docs/contribution](https://community-scripts.org/docs/contribution).
@@ -193,5 +193,5 @@ create` still ran and the container was still built.
 - **Website metadata** (name, description, logo, tags) is managed via the website — use the "Report Issue" link on any script page to request changes. Do not submit metadata changes via repo files.
 - **JSON files** in `json/` define script properties used by the website. See existing files for structure reference.
 - Keep PRs small and focused. One fix or feature per PR is ideal.
- PRs with **new scripts** opened against ProxmoxVE will be closed — submit them to [ProxmoxVED](https://github.com/community-scripts/ProxmoxVED) instead.
+- PRs with **new scripts** opened against ProxmoxVE will be closed — submit them to [DevScripts](https://github.com/community-scripts/DevScripts) instead.
 - PRs that fail CI checks will not be merged.
--- a/README.md
+++ b/README.md
@@ -93,7 +93,7 @@ This project runs on community contributions. Whether you want to write new scri

 | I want to…                            | Go here                                                                                           |
 | ------------------------------------- | ------------------------------------------------------------------------------------------------- |
-| Add a **new** script                  | [ProxmoxVED](https://github.com/community-scripts/ProxmoxVED) — new scripts are tested here first |
+| Add a **new** script                  | [DevScripts](https://github.com/community-scripts/DevScripts) — new scripts are tested here first |
 | Fix or improve an **existing** script | [Contributing Guidelines](CONTRIBUTING.md) — open a PR in this repo                               |
 | Report a bug or broken script         | [Issues](https://github.com/community-scripts/ProxmoxVE/issues)                                   |
 | Request a new script or feature       | [Discussions](https://github.com/community-scripts/ProxmoxVE/discussions)                         |
@@ -102,7 +102,7 @@ This project runs on community contributions. Whether you want to write new scri

 ### Before you open a PR

- **New scripts go to [ProxmoxVED](https://github.com/community-scripts/ProxmoxVED), not here.** PRs with new scripts opened directly against this repo will be closed.
+- **New scripts go to [DevScripts](https://github.com/community-scripts/DevScripts), not here.** PRs with new scripts opened directly against this repo will be closed.
 - Bug fixes and improvements to existing scripts belong in this repo — read the [Contributing Guidelines](CONTRIBUTING.md) first.
 - Keep PRs focused. One fix or feature per PR.
 - Document what your script installs and any non-obvious decisions in the corresponding JSON metadata file.
--- a/ct/airtrail.sh
+++ b/ct/airtrail.sh
@@ -36,9 +36,9 @@ function update_script() {
    systemctl stop airtrail
    msg_ok "Stopped Service"

-    create_backup /opt/airtrail/.env /opt/airtrail/uploads
+    create_backup /opt/airtrail/.env

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "airtrail" "johanohly/AirTrail" "tarball" "latest" "/opt/airtrail"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="uploads" fetch_and_deploy_gh_release "airtrail" "johanohly/AirTrail" "tarball" "latest" "/opt/airtrail"

    restore_backup

--- a/ct/alpine-borgbackup-server.sh
+++ b/ct/alpine-borgbackup-server.sh
@@ -48,9 +48,7 @@ function update_script() {
      exit
    fi

-    msg_info "Setting up SSH Public Key for backup user"
-
-    msg_info "Please paste your SSH public key (e.g., ssh-rsa AAAAB3... user@host): \n"
+    echo -e "${INFO}${YW}Please paste your SSH public key (e.g., ssh-rsa AAAAB3... user@host):${CL}"
    read -p "Key: " SSH_PUBLIC_KEY
    echo

--- a/ct/alpine-komodo.sh
+++ b/ct/alpine-komodo.sh
@@ -31,7 +31,7 @@ function update_script() {

  msg_warn "⚠️  ${APP} has been migrated to an addon script."
  echo ""
-  msg_info "This is a one-time migration. After this, you can update ${APP} anytime with:"
+  echo -e "${INFO}${YW}This is a one-time migration. After this, you can update ${APP} anytime with:${CL}"
  echo -e "${TAB}${TAB}${GN}update_komodo${CL}  or  ${GN}bash <(curl -fsSL ${ADDON_SCRIPT})${CL}"
  echo ""
  read -r -p "${TAB}Migrate update function now? [y/N]: " CONFIRM
@@ -62,7 +62,7 @@ MIGRATION_EOF
  ln -sf /usr/bin/update /usr/bin/update_komodo 2>/dev/null || true
  msg_ok "Migration complete"

-  msg_info "Running addon update"
+  echo -e "${INFO}${YW}Running addon update${CL}"
  type=update bash <(curl -fsSL "${ADDON_SCRIPT}")
  exit
 }
--- a/ct/anythingllm.sh
+++ b/ct/anythingllm.sh
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Engine comes from community-scripts/core; this repo only ships the scripts.
+# A local core checkout wins (COMMUNITY_SCRIPTS_CORE_DIR, else a sibling ../core),
+# so a fork or branch of core can be tested without editing this file.
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Mintplex-Labs/anything-llm
+
+APP="AnythingLLM"
+var_tags="${var_tags:-ai;rag}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-6144}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_gpu="${var_gpu:-yes}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/anythingllm ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "anythingllm" "Mintplex-Labs/anything-llm"; then
+    msg_info "Stopping Services"
+    systemctl stop anythingllm anythingllm-collector
+    msg_ok "Stopped Services"
+
+    create_backup /opt/anythingllm/server/.env /opt/anythingllm/collector/.env /opt/anythingllm/frontend/.env
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "anythingllm" "Mintplex-Labs/anything-llm" "tarball"
+
+    restore_backup
+
+    msg_info "Building AnythingLLM (Patience)"
+    cd /opt/anythingllm
+    export PUPPETEER_SKIP_DOWNLOAD=true
+    export NODE_OPTIONS="--max-old-space-size=3072"
+    $STD yarn setup
+    cd /opt/anythingllm/frontend
+    $STD yarn build
+    rm -rf /opt/anythingllm/server/public
+    cp -R /opt/anythingllm/frontend/dist /opt/anythingllm/server/public
+    cd /opt/anythingllm/server
+    $STD npx prisma generate --schema=./prisma/schema.prisma
+    $STD npx prisma migrate deploy --schema=./prisma/schema.prisma
+    msg_ok "Built AnythingLLM"
+
+    msg_info "Starting Services"
+    systemctl start anythingllm anythingllm-collector
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3001${CL}"
--- a/ct/audiomuse-ai.sh
+++ b/ct/audiomuse-ai.sh
@@ -58,7 +58,7 @@ function update_script() {

    msg_info "Updating Python Environment (${AUDIOMUSE_BACKEND})"
    cd /opt/audiomuse-ai
-    $STD uv venv --seed --python "$PY_VERSION" /opt/audiomuse-ai/.venv
+    $STD uv venv --clear --seed --python "$PY_VERSION" /opt/audiomuse-ai/.venv
    $STD uv pip install --python /opt/audiomuse-ai/.venv \
      -r "/opt/audiomuse-ai/requirements/${REQ_COMMON}" \
      -r "/opt/audiomuse-ai/requirements/${REQ_ACCEL}"
--- a/ct/authentik.sh
+++ b/ct/authentik.sh
@@ -136,7 +136,6 @@ function update_script() {
    export UV_COMPILE_BYTECODE="1"
    export UV_LINK_MODE="copy"
    export UV_NATIVE_TLS="1"
-    export UV_HTTP_TIMEOUT="300"
    export RUSTUP_PERMIT_COPY_RENAME="true"
    export UV_PYTHON_INSTALL_DIR="/usr/local/bin"
    cd /opt/authentik
--- a/ct/beszel.sh
+++ b/ct/beszel.sh
@@ -33,7 +33,7 @@ function update_script() {
  if check_for_gh_release "beszel" "henrygd/beszel"; then
    msg_info "Stopping Service"
    systemctl stop beszel-hub
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"

    msg_info "Updating Beszel"
    $STD /opt/beszel/beszel update
--- a/ct/bookorbit.sh
+++ b/ct/bookorbit.sh
@@ -48,7 +48,12 @@ function update_script() {

    $STD corepack prepare "pnpm@${PNPM_VERSION}" --activate
    $STD pnpm install --frozen-lockfile
-    $STD pnpm --filter client run build-only
+    # vite's bundler (rolldown) crashes at random on some builds, rolldown#10860.
+    for attempt in 1 2 3; do
+      $STD pnpm --filter client run build-only && break
+      [[ $attempt -eq 3 ]] && { msg_error "Client build failed three times"; exit 1; }
+      msg_warn "Client build failed (attempt $attempt), retrying"
+    done
    $STD pnpm --filter server run build
    cp -r /opt/bookorbit/client/dist /opt/bookorbit/server/public
    mkdir -p /opt/bookorbit/server/migrations
--- a/ct/certmate.sh
+++ b/ct/certmate.sh
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: fabriziosalmi
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/fabriziosalmi/certmate
+
+APP="CertMate"
+var_tags="${var_tags:-ssl;certificates;acme}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/certmate ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "certmate" "fabriziosalmi/certmate"; then
+    msg_info "Stopping CertMate"
+    systemctl stop certmate
+    msg_ok "Stopped CertMate"
+
+    PYTHON_VERSION="3.12" setup_uv
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "certmate" "fabriziosalmi/certmate" "tarball"
+
+    msg_info "Installing CertMate Dependencies"
+    cd /opt/certmate
+    $STD uv venv --python 3.12 /opt/certmate/.venv
+    $STD uv pip sync --python /opt/certmate/.venv/bin/python requirements.lock
+    $STD /opt/certmate/.venv/bin/certbot --version
+    msg_ok "Installed CertMate Dependencies"
+
+    msg_info "Starting CertMate"
+    systemctl start certmate
+    msg_ok "Started CertMate"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
+echo -e "${INFO}${YW}The first page creates the admin account and asks for the API token: grep API_BEARER_TOKEN /opt/certmate_data/.env${CL}"
--- a/ct/chevereto.sh
+++ b/ct/chevereto.sh
@@ -38,11 +38,9 @@ function update_script() {
    systemctl stop nginx "$PHP_FPM_SERVICE"
    msg_ok "Stopped Services"

-    create_backup /opt/chevereto/app/env.php \
-      /opt/chevereto/images \
-      /opt/chevereto/content
+    create_backup /opt/chevereto/app/env.php /opt/chevereto/content

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "chevereto" "chevereto/chevereto" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="images" fetch_and_deploy_gh_release "chevereto" "chevereto/chevereto" "tarball"

    restore_backup

--- a/ct/cinephage.sh
+++ b/ct/cinephage.sh
@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/MoldyTaint/Cinephage
+
+APP="Cinephage"
+var_tags="${var_tags:-arr;media;torrent;usenet}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/cinephage ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "cinephage" "MoldyTaint/Cinephage"; then
+    msg_info "Stopping Cinephage"
+    systemctl stop cinephage
+    msg_ok "Stopped Cinephage"
+
+    NODE_VERSION="24" setup_nodejs
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cinephage" "MoldyTaint/Cinephage" "tarball"
+
+    msg_info "Building Cinephage"
+    cd /opt/cinephage
+    $STD npm ci
+    $STD npm run build
+    $STD npm prune --omit=dev
+    sed -i "s/^APP_VERSION=.*/APP_VERSION=$(cat ~/.cinephage)/" /opt/cinephage_data/.env
+    msg_ok "Built Cinephage"
+
+    msg_info "Updating Camoufox"
+    $STD /opt/cinephage/node_modules/.bin/camoufox-js fetch
+    msg_ok "Updated Camoufox"
+
+    msg_info "Starting Cinephage"
+    systemctl start cinephage
+    msg_ok "Started Cinephage"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
--- a/ct/cliproxyapi.sh
+++ b/ct/cliproxyapi.sh
@@ -39,7 +39,7 @@ function update_script() {

    create_backup /opt/cliproxyapi/config.yaml

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cliproxyapi" "router-for-me/CLIProxyAPI" "prebuild" "latest" "/opt/cliproxyapi" "CLIProxyAPI_*_linux_$(arch_resolve "amd64" "aarch64").tar.gz"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="plugins data" fetch_and_deploy_gh_release "cliproxyapi" "router-for-me/CLIProxyAPI" "prebuild" "latest" "/opt/cliproxyapi" "CLIProxyAPI_*_linux_$(arch_resolve "amd64" "aarch64").tar.gz"

    restore_backup

--- a/ct/cloudreve.sh
+++ b/ct/cloudreve.sh
@@ -33,7 +33,7 @@ function update_script() {
  if check_for_gh_release "cloudreve" "cloudreve/cloudreve"; then
    msg_info "Stopping Service"
    systemctl stop cloudreve
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"

    fetch_and_deploy_gh_release "cloudreve" "cloudreve/cloudreve" "prebuild" "latest" "/opt/cloudreve" "*linux_$(arch_resolve).tar.gz"

--- a/ct/convertx.sh
+++ b/ct/convertx.sh
@@ -33,7 +33,7 @@ function update_script() {
  if check_for_gh_release "ConvertX" "C4illin/ConvertX"; then
    msg_info "Stopping Service"
    systemctl stop convertx
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"

    ensure_dependencies libreoffice-writer dasel graphicsmagick libemail-outlook-message-perl libheif-examples libjxl-tools resvg

--- a/ct/coolify.sh
+++ b/ct/coolify.sh
@@ -35,7 +35,7 @@ function update_script() {

  msg_warn "⚠️  ${APP} has been migrated to an addon script."
  echo ""
-  msg_info "This is a one-time migration. After this, you can update ${APP} anytime with:"
+  echo -e "${INFO}${YW}This is a one-time migration. After this, you can update ${APP} anytime with:${CL}"
  echo -e "${TAB}${TAB}${GN}update_coolify${CL}  or  ${GN}bash <(curl -fsSL ${ADDON_SCRIPT})${CL}"
  echo ""
  read -r -p "${TAB}Migrate update function now? [y/N]: " CONFIRM
@@ -58,7 +58,7 @@ MIGRATION_EOF
  ln -sf /usr/bin/update /usr/bin/update_coolify 2>/dev/null || true
  msg_ok "Migration complete"

-  msg_info "Running addon update"
+  echo -e "${INFO}${YW}Running addon update${CL}"
  type=update bash <(curl -fsSL "${ADDON_SCRIPT}")
  exit
 }
--- a/ct/cryptpad.sh
+++ b/ct/cryptpad.sh
@@ -33,18 +33,11 @@ function update_script() {
  if check_for_gh_release "cryptpad" "cryptpad/cryptpad"; then
    msg_info "Stopping Service"
    systemctl stop cryptpad
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"

-    create_backup /opt/cryptpad/config/config.js \
-      /opt/cryptpad/blob \
-      /opt/cryptpad/block \
-      /opt/cryptpad/customize \
-      /opt/cryptpad/data \
-      /opt/cryptpad/datastore \
-      /opt/cryptpad/www/common/onlyoffice/dist \
-      /opt/cryptpad/onlyoffice-conf
+    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/www/common/onlyoffice/dist

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="blob block customize data datastore onlyoffice-conf" fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"

    restore_backup

--- a/ct/discourse.sh
+++ b/ct/discourse.sh
@@ -36,28 +36,35 @@ function update_script() {
    exit
  fi

-  msg_info "Stopping Service"
-  systemctl stop discourse
-  msg_ok "Stopped Service"
+  if grep -q 'X-Accel-Mapping' /etc/nginx/sites-available/discourse 2>/dev/null; then
+    msg_info "Fixing stylesheet delivery in Nginx"
+    sed -i '/X-Accel-Mapping/d' /etc/nginx/sites-available/discourse
+    $STD systemctl reload nginx
+    msg_ok "Fixed stylesheet delivery in Nginx"
+  fi

-  create_backup /opt/discourse/.env
+  msg_info "Stopping Services"
+  systemctl stop discourse discourse-sidekiq
+  msg_ok "Stopped Services"

  msg_info "Updating Discourse"
-  PG_VERSION="16" PG_MODULES="pgvector" setup_postgresql
  cd /opt/discourse
-  git pull origin main
-  $STD bundle install --deployment --without test development
-  $STD yarn install
+  export PATH="$HOME/.rbenv/bin:$HOME/.rbenv/shims:$PATH"
+  export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+  set -a
+  source /opt/discourse/.env
+  set +a
+  $STD git pull origin main
+  $STD bundle install
+  $STD pnpm install
  $STD runuser -u postgres -- psql -d discourse -c "CREATE EXTENSION IF NOT EXISTS vector;"
-  $STD bundle exec rails assets:precompile
  $STD bundle exec rails db:migrate
+  $STD bundle exec rails assets:precompile
  msg_ok "Updated Discourse"

-    restore_backup
-
-  msg_info "Starting Service"
-  systemctl start discourse
-  msg_ok "Started Service"
+  msg_info "Starting Services"
+  systemctl start discourse discourse-sidekiq
+  msg_ok "Started Services"
  msg_ok "Updated successfully!"
  exit
 }
--- a/ct/dispatcharr.sh
+++ b/ct/dispatcharr.sh
@@ -137,7 +137,6 @@ EOF
      set +o allexport
      if [[ -n "$POSTGRES_DB" ]] && [[ -n "$POSTGRES_USER" ]] && [[ -n "$POSTGRES_PASSWORD" ]]; then
        PGPASSWORD=$POSTGRES_PASSWORD pg_dump -U "$POSTGRES_USER" -h "${POSTGRES_HOST:-localhost}" -p "${POSTGRES_PORT:-5432}" "$POSTGRES_DB" >/tmp/dispatcharr_db_$(date +%F).sql
-        msg_info "Database backup created"
      fi
    fi
    $STD tar -czf "$BACKUP_FILE" -C /opt dispatcharr /tmp/dispatcharr_db_*.sql
@@ -150,7 +149,7 @@ EOF

    msg_info "Updating Dispatcharr Backend"
    if ! grep -q "DJANGO_SECRET_KEY" /opt/dispatcharr/.env; then
-      DJANGO_SECRET=$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | cut -c1-50)
+      DJANGO_SECRET=$(random_password 50)
      echo "DJANGO_SECRET_KEY=$DJANGO_SECRET" >>/opt/dispatcharr/.env
    fi

--- a/ct/docker.sh
+++ b/ct/docker.sh
@@ -27,6 +27,10 @@ else
  var_disk="${var_disk:-4}"
  var_version="${var_version:-13}"
 fi
+# Only exported variables reach the install through lxc-attach.
+export var_docker_socket="${var_docker_socket:-}"
+export var_docker_compose="${var_docker_compose:-}"
+export var_docker_lxcfs="${var_docker_lxcfs:-}"

 header_info "$APP"
 variables
--- a/ct/dockge.sh
+++ b/ct/dockge.sh
@@ -35,7 +35,7 @@ function update_script() {

  msg_warn "⚠️  ${APP} has been migrated to an addon script."
  echo ""
-  msg_info "This is a one-time migration. After this, you can update ${APP} anytime with:"
+  echo -e "${INFO}${YW}This is a one-time migration. After this, you can update ${APP} anytime with:${CL}"
  echo -e "${TAB}${TAB}${GN}update_dockge${CL}  or  ${GN}bash <(curl -fsSL ${ADDON_SCRIPT})${CL}"
  echo ""
  read -r -p "${TAB}Migrate update function now? [y/N]: " CONFIRM
@@ -60,7 +60,7 @@ MIGRATION_EOF
  ln -sf /usr/bin/update /usr/bin/update_dockge 2>/dev/null || true
  msg_ok "Migration complete"

-  msg_info "Running addon update"
+  echo -e "${INFO}${YW}Running addon update${CL}"
  type=update bash <(curl -fsSL "${ADDON_SCRIPT}")
  exit
 }
--- a/ct/docmost.sh
+++ b/ct/docmost.sh
@@ -38,9 +38,9 @@ function update_script() {
    systemctl stop docmost
    msg_ok "Stopped Service"

-    create_backup /opt/docmost/.env /opt/docmost/data
+    create_backup /opt/docmost/.env
    
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "docmost" "docmost/docmost" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "docmost" "docmost/docmost" "tarball"

    restore_backup

--- a/ct/dokploy.sh
+++ b/ct/dokploy.sh
@@ -35,7 +35,7 @@ function update_script() {

  msg_warn "⚠️  ${APP} has been migrated to an addon script."
  echo ""
-  msg_info "This is a one-time migration. After this, you can update ${APP} anytime with:"
+  echo -e "${INFO}${YW}This is a one-time migration. After this, you can update ${APP} anytime with:${CL}"
  echo -e "${TAB}${TAB}${GN}update_dokploy${CL}  or  ${GN}bash <(curl -fsSL ${ADDON_SCRIPT})${CL}"
  echo ""
  read -r -p "${TAB}Migrate update function now? [y/N]: " CONFIRM
@@ -58,7 +58,7 @@ MIGRATION_EOF
  ln -sf /usr/bin/update /usr/bin/update_dokploy 2>/dev/null || true
  msg_ok "Migration complete"

-  msg_info "Running addon update"
+  echo -e "${INFO}${YW}Running addon update${CL}"
  type=update bash <(curl -fsSL "${ADDON_SCRIPT}")
  exit
 }
--- a/ct/domain-locker.sh
+++ b/ct/domain-locker.sh
@@ -35,7 +35,7 @@ function update_script() {
  if check_for_gh_release "domain-locker" "Lissy93/domain-locker"; then
    msg_info "Stopping Service"
    systemctl stop domain-locker
-    msg_info "Service stopped"
+    msg_ok "Stopped Service"

    PG_VERSION="17" setup_postgresql
    NODE_VERSION="22" setup_nodejs
@@ -51,7 +51,7 @@ function update_script() {
    source /opt/domain-locker.env
    set +a
    $STD npm run build
-    msg_info "Built Domain-Locker"
+    msg_ok "Built Domain-Locker"

    msg_info "Restarting Services"
    systemctl start domain-locker
--- a/ct/domain-monitor.sh
+++ b/ct/domain-monitor.sh
@@ -42,7 +42,7 @@ function update_script() {
  if check_for_gh_release "domain-monitor" "Hosteroid/domain-monitor"; then
    msg_info "Stopping Service"
    systemctl stop apache2
-    msg_info "Service stopped"
+    msg_ok "Stopped Service"

    create_backup /opt/domain-monitor/.env

--- a/ct/duplicati.sh
+++ b/ct/duplicati.sh
@@ -33,7 +33,7 @@ function update_script() {
  if check_for_gh_release "duplicati" "duplicati/duplicati"; then
    msg_info "Stopping Service"
    systemctl stop duplicati
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"

    fetch_and_deploy_gh_release "duplicati" "duplicati/duplicati" "binary" "latest" "/opt/duplicati" "duplicati-*-linux-$(arch_resolve "x64" "arm64")-gui.deb"

--- a/ct/endurain.sh
+++ b/ct/endurain.sh
@@ -30,14 +30,14 @@ function update_script() {
    msg_error "No ${APP} installation found!"
    exit 233
  fi
-  if check_for_codeberg_release "endurain" "endurain-project/endurain"; then
+  if check_for_gh_release "endurain" "endurain-project/endurain"; then
    msg_info "Stopping Service"
    systemctl stop endurain
    msg_ok "Stopped Service"

    NODE_VERSION="24" setup_nodejs
    create_backup /opt/endurain/.env /opt/endurain/frontend/dist/env.js
-    CLEAN_INSTALL=1 fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "endurain" "endurain-project/endurain"

    msg_info "Updating Endurain Frontend"
    cd /opt/endurain
--- a/ct/excalidraw.sh
+++ b/ct/excalidraw.sh
@@ -36,7 +36,7 @@ function update_script() {
  if check_for_gh_release "excalidraw" "excalidraw/excalidraw"; then
    msg_info "Stopping Service"
    systemctl stop excalidraw
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "excalidraw" "excalidraw/excalidraw" "tarball"

--- a/ct/flame.sh
+++ b/ct/flame.sh
@@ -36,9 +36,8 @@ function update_script() {
    systemctl stop flame
    msg_ok "Stopped Service"

-    create_backup /opt/flame/.env \
-      /opt/flame/data
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "flame" "pawelmalak/flame" "tarball"
+    create_backup /opt/flame/.env
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "flame" "pawelmalak/flame" "tarball"
    restore_backup

    msg_info "Rebuilding Application"
--- a/ct/fluid-calendar.sh
+++ b/ct/fluid-calendar.sh
@@ -37,7 +37,7 @@ function update_script() {
  if check_for_gh_release "fluid-calendar" "dotnetfactory/fluid-calendar"; then
    msg_info "Stopping Service"
    systemctl stop fluid-calendar
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"

    create_backup /opt/fluid-calendar/.env
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "fluid-calendar" "dotnetfactory/fluid-calendar" "tarball"
--- a/ct/foldingathome.sh
+++ b/ct/foldingathome.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ) | Co-Author: 007hacky007
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/FoldingAtHome/fah-client-bastet
+
+APP="FoldingAtHome"
+var_tags="${var_tags:-science;distributed-computing}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_gpu="${var_gpu:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+export var_fah_token="${var_fah_token:-}"
+export var_fah_machine_name="${var_fah_machine_name:-}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /usr/bin/fah-client ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  fetch_and_deploy_from_url "https://download.foldingathome.org/releases/public/fah-client/$(arch_resolve "debian-10-64bit" "debian-stable-arm64")/release/latest.deb"
+  msg_ok "Folding@home is at $(dpkg-query -W -f='${Version}' fah-client)"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Manage it from the Folding@home Web Control:${CL}"
+echo -e "${GATEWAY}${BGN}https://app.foldingathome.org/${CL}"
+echo -e "${INFO}${YW}The client starts paused - press Fold once the machine shows up in your account${CL}"
+echo -e "${INFO}${YW}Account token and machine name are in /etc/fah-client/config.xml${CL}"
--- a/ct/gitea-mirror.sh
+++ b/ct/gitea-mirror.sh
@@ -50,10 +50,10 @@ function update_script() {
    echo ""
    read -r -p "Final confirmation - proceed? (y/N): " CONFIRM2
    if [[ ! "$CONFIRM2" =~ ^[Yy]$ ]]; then
-      msg_info "Update cancelled. Please backup your configuration before proceeding."
+      msg_warn "Update cancelled. Please backup your configuration before proceeding."
      exit 0
    fi
-    msg_info "Proceeding with version $APP_VERSION update. All configuration will be cleared as warned."
+    msg_warn "Proceeding with version $APP_VERSION update. All configuration will be cleared as warned."
    rm -rf /opt/gitea-mirror
  fi

--- a/ct/graylog.sh
+++ b/ct/graylog.sh
@@ -34,7 +34,7 @@ function update_script() {
  msg_info "Stopping Service"
  systemctl stop graylog-datanode
  systemctl stop graylog-server
-  msg_info "Stopped Service"
+  msg_ok "Stopped Service"

  CURRENT_VERSION=$(apt list --installed 2>/dev/null | grep graylog-server | grep -oP '\d+\.\d+\.\d+')

--- a/ct/grist.sh
+++ b/ct/grist.sh
@@ -38,9 +38,9 @@ function update_script() {
    systemctl stop grist
    msg_ok "Stopped Service"

-    create_backup /opt/grist/.env /opt/grist/docs /opt/grist/grist-sessions.db /opt/grist/landing.db
+    create_backup /opt/grist/.env /opt/grist/grist-sessions.db /opt/grist/landing.db

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "grist" "gristlabs/grist-core" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="docs" fetch_and_deploy_gh_release "grist" "gristlabs/grist-core" "tarball"

    restore_backup

--- a/ct/hermesagent.sh
+++ b/ct/hermesagent.sh
@@ -31,16 +31,7 @@ function update_script() {
    exit
  fi

-  msg_warn "WARNING: This script will run an external installer from a third-party source (https://hermes-agent.nousresearch.com/)."
-  msg_warn "The following code is NOT maintained or audited by our repository."
-  msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
-  msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  hermes update (https://hermes-agent.nousresearch.com/)"
-  echo
-  read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
-  if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
-    msg_error "Aborted by user. No changes have been made."
-    exit 10
-  fi
+  confirm_external_installer "https://hermes-agent.nousresearch.com/" "hermes update (https://hermes-agent.nousresearch.com/)"

  msg_info "Stopping Services"
  systemctl stop hermes-dashboard
@@ -51,8 +42,7 @@ function update_script() {
    set -a; source /etc/default/hermes; set +a
    /home/hermes/.local/bin/hermes update --yes
  '
-  # See https://github.com/community-scripts/ProxmoxVE/issues/17123
-  mapfile -t root_gateway_pids < <(ps -eo user=,pid=,args= | awk '$1 == "root" && $0 ~ /\/home\/hermes\/\.hermes\/hermes-agent\/venv\/bin\/python -m hermes_cli\.main gateway run --replace$/ { print $2 }')
+  mapfile -t root_gateway_pids < <(ps -eo user=,pid=,args= | awk '$1 == "root" && /\/home\/hermes\/\.hermes\// && /hermes_cli[.]main/ && / gateway run --replace$/ { print $2 }')
  if ((${#root_gateway_pids[@]})); then
    kill -TERM "${root_gateway_pids[@]}"
    for pid in "${root_gateway_pids[@]}"; do
@@ -61,7 +51,14 @@ function update_script() {
      done
    done
  fi
-  chown -R hermes:hermes /home/hermes
+  if ps -eo user=,args= | awk '$1 == "root" && /\/home\/hermes\/\.hermes\// { found = 1 } END { exit !found }'; then
+    msg_warn "A root-owned Hermes process is still running; it may keep writing root-owned files"
+  fi
+  # A writer racing chown makes files vanish between readdir and chown; one retry covers it.
+  if ! chown -R hermes:hermes /home/hermes 2>/dev/null; then
+    sleep 1
+    chown -R hermes:hermes /home/hermes || msg_warn "Could not take ownership of everything under /home/hermes"
+  fi
  msg_ok "Updated Hermes Agent"

  msg_info "Starting Services"
--- a/ct/homarr.sh
+++ b/ct/homarr.sh
@@ -85,6 +85,18 @@ EOF
    msg_ok "Started Services"
    msg_ok "Updated successfully!"
  fi
+  # v2.3.0's Debian build ships a musl better-sqlite3 (homarr-labs/homarr#7097).
+  mapfile -t MUSL_MODULES < <(find /opt/homarr -name better_sqlite3.node -exec grep -aqE "ld-musl|libc\.musl" {} \; -print)
+  if ((${#MUSL_MODULES[@]})); then
+    msg_info "Replacing musl better-sqlite3 build"
+    BSQ_VERSION=$(jq -r .version /opt/homarr/node_modules/better-sqlite3/package.json)
+    curl_with_retry "https://github.com/WiseLibs/better-sqlite3/releases/download/v${BSQ_VERSION}/better-sqlite3-v${BSQ_VERSION}-node-v$(node -p process.versions.modules)-linux-$(arch_resolve "x64" "arm64").tar.gz" /tmp/better-sqlite3.tar.gz
+    tar -xzf /tmp/better-sqlite3.tar.gz -C /tmp build/Release/better_sqlite3.node
+    for module in "${MUSL_MODULES[@]}"; do cp /tmp/build/Release/better_sqlite3.node "$module"; done
+    rm -rf /tmp/better-sqlite3.tar.gz /tmp/build
+    systemctl restart homarr
+    msg_ok "Replaced musl better-sqlite3 build"
+  fi
  exit
 }

--- a/ct/homebox.sh
+++ b/ct/homebox.sh
@@ -50,7 +50,7 @@ function update_script() {
    [ -d /opt/.data ] && mv /opt/.data /opt/homebox/.data

    if ! grep -q "HBOX_AUTH_API_KEY_PEPPER" /opt/homebox/.env; then
-      AUTH_KEY=$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | cut -c1-32)
+      AUTH_KEY=$(random_password 32)
      echo "HBOX_AUTH_API_KEY_PEPPER=${AUTH_KEY}" >>/opt/homebox/.env
    fi

--- a/ct/homelable.sh
+++ b/ct/homelable.sh
@@ -36,9 +36,9 @@ function update_script() {
    systemctl stop homelable
    msg_ok "Stopped Service"

-    create_backup /opt/homelable/backend/.env /opt/homelable/data /opt/homelable/mcp/.env
+    create_backup /opt/homelable/backend/.env /opt/homelable/mcp/.env

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homelable" "Pouzor/homelable" "tarball" "latest" "/opt/homelable"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "homelable" "Pouzor/homelable" "tarball" "latest" "/opt/homelable"

    restore_backup

--- a/ct/homepage.sh
+++ b/ct/homepage.sh
@@ -38,10 +38,10 @@ function update_script() {
    systemctl stop homepage
    msg_ok "Stopped service"

-    create_backup /opt/homepage/.env /opt/homepage/config
+    create_backup /opt/homepage/.env
    BACKUP_DIR=/opt/homepage-assets.backup create_backup /opt/homepage/public/images /opt/homepage/public/icons

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homepage" "gethomepage/homepage" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="config" fetch_and_deploy_gh_release "homepage" "gethomepage/homepage" "tarball"

    restore_backup

--- a/ct/hortusfox.sh
+++ b/ct/hortusfox.sh
@@ -55,18 +55,13 @@ function update_script() {
      printf '["%s"]\n' "$(<~/.hortusfox)" >app/migrations/verhist.json
    fi

-    create_backup \
-      /opt/hortusfox/.env \
+    create_backup /opt/hortusfox/.env \
      /opt/hortusfox/app/migrations/migrations.list \
      /opt/hortusfox/app/migrations/verhist.json \
      /opt/hortusfox/public/img \
-      /opt/hortusfox/public/attachments \
-      /opt/hortusfox/public/backup \
-      /opt/hortusfox/public/exports \
-      /opt/hortusfox/public/snd \
      /opt/hortusfox/public/themes

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "hortusfox" "danielbrendel/hortusfox-web" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="public/attachments public/backup public/exports public/snd" fetch_and_deploy_gh_release "hortusfox" "danielbrendel/hortusfox-web" "tarball"
    restore_backup

    msg_info "Updating HortusFox"
--- a/ct/immich.sh
+++ b/ct/immich.sh
@@ -77,14 +77,17 @@ EOF
  BASE_DIR=${STAGING_DIR}/base-images
  SOURCE_DIR=${STAGING_DIR}/image-source
  cd /tmp
+  RELEASE="v3.3.0"
  if [[ -f ~/.intel_version ]]; then
-    curl_with_retry "https://raw.githubusercontent.com/immich-app/immich/refs/heads/main/machine-learning/Dockerfile" "Dockerfile"
-    readarray -t INTEL_URLS < <(
-      sed -n "/intel-[igc|opencl]/p" ./Dockerfile | awk '{print $3}'
-      sed -n "/libigdgmm12/p" ./Dockerfile | awk '{print $3}'
-    )
-    INTEL_RELEASE="$(grep "intel-opencl-icd_" ./Dockerfile | awk -F '_' '{print $2}')"
-    if [[ "$INTEL_RELEASE" != "$(cat ~/.intel_version)" ]]; then
+    INTEL_SRC="https://raw.githubusercontent.com/immich-app/immich/${RELEASE}/machine-learning"
+    curl -fsSL "${INTEL_SRC}/scripts/install-intel-runtime.sh" -o ./intel-runtime 2>/dev/null ||
+      curl_with_retry "${INTEL_SRC}/Dockerfile" "./intel-runtime"
+    readarray -t INTEL_URLS < <(grep -oE 'https://github\.com/intel/[^[:space:]]+\.deb' ./intel-runtime)
+    INTEL_RELEASE="$(grep -oE 'intel-opencl-icd_[^_]+' ./intel-runtime | cut -d_ -f2)" || true
+    rm -f ./intel-runtime
+    if [[ -z "$INTEL_RELEASE" ]]; then
+      msg_warn "No Intel runtime found for Immich ${RELEASE}, keeping the installed one"
+    elif [[ "$INTEL_RELEASE" != "$(cat ~/.intel_version)" ]]; then
      msg_info "Updating Intel OpenVINO dependencies"
      for url in "${INTEL_URLS[@]}"; do
        curl_with_retry "$url" "$(basename "$url")"
@@ -96,7 +99,6 @@ EOF
      rm ./*.deb
      $STD apt-mark hold libigdgmm12
      dpkg-query -W -f='${Version}\n' intel-opencl-icd >~/.intel_version
-      rm -f ./Dockerfile
      msg_ok "Updated Intel OpenVINO dependencies"
    fi
  fi
@@ -104,7 +106,7 @@ EOF
    libraries=("libjxl" "jpegli" "libheif" "libraw" "imagemagick" "libvips")
    cd "$BASE_DIR"
    msg_warn "Checking for updates to custom image-processing libraries (recompile time: 2-15min per library)"
-    ensure_dependencies liblcms2-dev libjpeg62-turbo-dev libspng-dev libexif-dev
+    ensure_dependencies liblcms2-dev libjpeg62-turbo-dev libspng-dev libexif-dev libopenjp2-7-dev
    $STD git pull
    for library in "${libraries[@]}"; do
      compile_"$library"
@@ -112,9 +114,11 @@ EOF
    msg_ok "Image-processing libraries up to date"
  fi

-  RELEASE="v3.2.4"
  if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
-    if [[ $(cat ~/.immich) > "2.5.1" ]]; then
+    msg_warn "The update takes 5-15 minutes, do not interrupt it"
+    PREV_IMMICH="$(cat ~/.immich)"
+    # An interrupted update leaves app/ empty, so there may be no immich-admin to call.
+    if [[ "$PREV_IMMICH" > "2.5.1" && -x /opt/immich/app/bin/immich-admin ]]; then
      msg_info "Enabling Maintenance Mode"
      cd /opt/immich/app/bin
      $STD ./immich-admin enable-maintenance-mode || true
@@ -262,7 +266,6 @@ EOF
    chown immich:immich "${UPLOAD_DIR:-$INSTALL_DIR/upload}" 2>/dev/null || true
    chown immich:immich ./uv.lock
    export VIRTUAL_ENV="${ML_DIR}"/ml-venv
-    export UV_HTTP_TIMEOUT=300
    if [[ -f ~/.openvino ]]; then
      ML_PYTHON="python3.13"
      msg_info "Pre-installing Python ${ML_PYTHON} for machine-learning"
@@ -273,13 +276,16 @@ EOF
      msg_ok "Pre-installed Python ${ML_PYTHON}"
      msg_info "Updating Intel OpenVINO machine-learning"
      for attempt in $(seq 1 3); do
-        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT -Pnu immich uv sync --extra openvino --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
-        [[ $attempt -lt 3 ]] && msg_warn "uv sync attempt $attempt failed, retrying..." && sleep 10
+        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra openvino --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+        [[ $attempt -eq 3 ]] && { ML_FAILED=1; break; }
+        # Parallel fetches can trip DNS rate limits (AdGuard, Pi-hole); retry one at a time.
+        export UV_CONCURRENT_DOWNLOADS=1 UV_CONCURRENT_BUILDS=1 UV_CONCURRENT_INSTALLS=1
+        msg_warn "uv sync attempt $attempt failed, retrying one download at a time..." && sleep 10
      done
-      patchelf --clear-execstack "${VIRTUAL_ENV}/lib/python3.13/site-packages/onnxruntime/capi/onnxruntime_pybind11_state.cpython-313-$(arch_resolve "x86_64" "aarch64")-linux-gnu.so"
-      msg_ok "Updated Intel OpenVINO machine-learning"
+      [[ "${ML_FAILED:-0}" == 1 ]] || patchelf --clear-execstack "${VIRTUAL_ENV}/lib/python3.13/site-packages/onnxruntime/capi/onnxruntime_pybind11_state.cpython-313-$(arch_resolve "x86_64" "aarch64")-linux-gnu.so"
+      [[ "${ML_FAILED:-0}" == 1 ]] || msg_ok "Updated Intel OpenVINO machine-learning"
    else
-      ML_PYTHON="python3.11"
+      ML_PYTHON="python3.13"
      msg_info "Pre-installing Python ${ML_PYTHON} for machine-learning"
      for attempt in $(seq 1 3); do
        $STD sudo --preserve-env=VIRTUAL_ENV -Pnu immich uv python install "${ML_PYTHON}" && break
@@ -288,11 +294,15 @@ EOF
      msg_ok "Pre-installed Python ${ML_PYTHON}"
      msg_info "Updating machine-learning"
      for attempt in $(seq 1 3); do
-        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT -Pnu immich uv sync --extra cpu --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
-        [[ $attempt -lt 3 ]] && msg_warn "uv sync attempt $attempt failed, retrying..." && sleep 10
+        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra cpu --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+        [[ $attempt -eq 3 ]] && { ML_FAILED=1; break; }
+        # Parallel fetches can trip DNS rate limits (AdGuard, Pi-hole); retry one at a time.
+        export UV_CONCURRENT_DOWNLOADS=1 UV_CONCURRENT_BUILDS=1 UV_CONCURRENT_INSTALLS=1
+        msg_warn "uv sync attempt $attempt failed, retrying one download at a time..." && sleep 10
      done
-      msg_ok "Updated machine-learning"
+      [[ "${ML_FAILED:-0}" == 1 ]] || msg_ok "Updated machine-learning"
    fi
+    [[ "${ML_FAILED:-0}" == 1 ]] && msg_warn "uv sync failed three times, machine learning was not updated"
    cd "$SRC_DIR"
    cp -a machine-learning/{ann,immich_ml} "$ML_DIR"
    [[ -f "$INSTALL_DIR"/ml_start.sh ]] && mv "$INSTALL_DIR"/ml_start.sh "$ML_DIR"
@@ -319,7 +329,7 @@ EOF
    grep -rl /usr/src | xargs -n1 sed -i "s|\/usr/src|$INSTALL_DIR|g"
    grep -rlE "'/build'" | xargs -n1 sed -i "s|'/build'|'$APP_DIR'|g"
    sed -i "s@\"/cache\"@\"$INSTALL_DIR/cache\"@g" "$ML_DIR"/immich_ml/config.py
-    [[ ! -f "$GEO_DIR/countryInfo.txt" ]] && curl_with_retry "https://download.geonames.org/export/dump/countryInfo.txt" "countryInfo.txt"
+    [[ ! -f "$GEO_DIR/countryInfo.txt" ]] && curl_with_retry "https://download.geonames.org/export/dump/countryInfo.txt" "$GEO_DIR/countryInfo.txt"
    ln -s "${UPLOAD_DIR:-/opt/immich/upload}" "$APP_DIR"/upload
    ln -s "${UPLOAD_DIR:-/opt/immich/upload}" "$ML_DIR"/upload
    ln -sfn "$GEO_DIR" "$APP_DIR/geodata"
@@ -333,33 +343,28 @@ EOF
      sed -i -e '$a\' "$INSTALL_DIR"/.env
      echo "IMMICH_HELMET_FILE=true" >>"$INSTALL_DIR"/.env
    fi
+    if ! grep -q 'MODEL_REVISION' "$INSTALL_DIR"/.env; then
+      sed -i -e '$a\' "$INSTALL_DIR"/.env
+      echo "MACHINE_LEARNING_MODEL_REVISION=v2" >>"$INSTALL_DIR"/.env
+    fi

    if grep -q 'ExecStart=/usr/bin/node' /etc/systemd/system/immich-web.service; then
      sed -i '/^EnvironmentFile=/d' /etc/systemd/system/immich-web.service
      sed -i "s|^ExecStart=.*|ExecStart=${APP_DIR}/bin/start.sh|" /etc/systemd/system/immich-web.service
      systemctl daemon-reload
    fi
+    if grep -q "^ExecStart=${INSTALL_DIR}/ml_start.sh" /etc/systemd/system/immich-ml.service; then
+      sed -i "s|^ExecStart=.*|ExecStart=${ML_DIR}/ml_start.sh|" /etc/systemd/system/immich-ml.service
+      systemctl daemon-reload
+    fi

    # MickLesk temporary patch for HEIC thumbnail gen
-    msg_info "Patching media.repository.js"
    MEDIA_REPO_JS="/opt/immich/app/dist/repositories/media.repository.js"
-    if [[ -f "$MEDIA_REPO_JS" ]]; then
-      python3 - <<'PY'
-from pathlib import Path
-p = Path('/opt/immich/app/dist/repositories/media.repository.js')
-s = p.read_text()
-old = "(0, sharp_1.default)(input).metadata()"
-new = "(0, sharp_1.default)(input, { unlimited: true, limitInputPixels: false }).metadata()"
-if new in s:
-    print('hotfix already there')
-elif old in s:
-    p.write_text(s.replace(old, new, 1))
-    print('hotfix applied')
-else:
-    print('pattern not found, skipped')
-PY
+    if grep -qF "(0, sharp_1.default)(input).metadata()" "$MEDIA_REPO_JS" 2>/dev/null; then
+      msg_info "Patching media.repository.js"
+      sed -i '0,/(0, sharp_1\.default)(input)\.metadata()/s//(0, sharp_1.default)(input, { unlimited: true, limitInputPixels: false }).metadata()/' "$MEDIA_REPO_JS"
+      msg_ok "Patched media.repository.js"
    fi
-    msg_ok "Patched media.repository.js"

    # chown excluding upload dir contents (may be a mount with restricted permissions)
    chown immich:immich "$INSTALL_DIR"
@@ -373,6 +378,15 @@ PY
      $STD cd -
      msg_ok "Disabled Maintenance Mode"
    fi
+    # A crash loop before the update leaves the units rate-limited, and restart would refuse.
+    systemctl reset-failed immich-ml immich-web 2>/dev/null || true
+    if [[ "${ML_FAILED:-0}" == 1 ]]; then
+      systemctl restart immich-web || true
+      [[ -f /etc/systemd/system/immich-proxy.service ]] && systemctl restart immich-proxy
+      echo "$PREV_IMMICH" >~/.immich
+      msg_error "Immich runs, but without machine learning (see the uv output above). Run update again to retry."
+      exit 1
+    fi
    systemctl restart immich-ml immich-web
    [[ -f /etc/systemd/system/immich-proxy.service ]] && systemctl restart immich-proxy
    msg_ok "Updated successfully!"
@@ -551,7 +565,8 @@ function compile_imagemagick() {
 function compile_libvips() {
  SOURCE=$SOURCE_DIR/libvips
  LIBVIPS_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libvips.json)"
-  if [[ "$LIBVIPS_REVISION" != "$(grep 'libvips' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
+  if [[ "$LIBVIPS_REVISION" != "$(grep 'libvips' ~/.immich_library_revisions | awk '{print $2}')" ]] ||
+    [[ "$(vips -l foreign 2>/dev/null)" != *jp2kload* ]]; then
    msg_info "Recompiling libvips"
    [[ -d "$SOURCE" ]] && rm -rf "$SOURCE"
    $STD git clone https://github.com/libvips/libvips.git "$SOURCE"
--- a/ct/investbrain.sh
+++ b/ct/investbrain.sh
@@ -42,9 +42,9 @@ function update_script() {
    NODE_VERSION="22" setup_nodejs
    PG_VERSION="17" setup_postgresql

-    create_backup /opt/investbrain/.env /opt/investbrain/storage
+    create_backup /opt/investbrain/.env

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Investbrain" "investbrainapp/investbrain" "tarball" "latest" "/opt/investbrain"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="storage" fetch_and_deploy_gh_release "Investbrain" "investbrainapp/investbrain" "tarball" "latest" "/opt/investbrain"

    restore_backup

--- a/ct/invoiceshelf.sh
+++ b/ct/invoiceshelf.sh
@@ -36,9 +36,9 @@ function update_script() {
    systemctl stop caddy
    msg_ok "Stopped Services"

-    create_backup /opt/invoiceshelf/.env /opt/invoiceshelf/storage
+    create_backup /opt/invoiceshelf/.env

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "invoiceshelf" "InvoiceShelf/InvoiceShelf" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="storage" fetch_and_deploy_gh_release "invoiceshelf" "InvoiceShelf/InvoiceShelf" "tarball"

    restore_backup

--- a/ct/jotty.sh
+++ b/ct/jotty.sh
@@ -38,7 +38,7 @@ function update_script() {

    create_backup /opt/jotty/.env /opt/jotty/data /opt/jotty/config

-    NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
+    NODE_VERSION="24" NODE_MODULE="yarn" setup_nodejs
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "jotty" "fccview/jotty" "prebuild" "latest" "/opt/jotty" "jotty_*_prebuild.tar.gz"

    restore_backup
--- a/ct/kasm.sh
+++ b/ct/kasm.sh
@@ -52,7 +52,7 @@ function update_script() {
    msg_error "Unable to detect latest Kasm release URL."
    exit 250
  fi
-  msg_info "Checked for new version"
+  msg_ok "Checked for new version"

  msg_info "Removing outdated docker-compose plugin"
  [ -f ~/.docker/cli-plugins/docker-compose ] && rm -rf ~/.docker/cli-plugins/docker-compose
@@ -62,16 +62,7 @@ function update_script() {
    msg_info "Updating Kasm"
    cd /tmp

-    msg_warn "WARNING: This script will run an external installer from a third-party source (https://www.kasmweb.com/)."
-    msg_warn "The following code is NOT maintained or audited by our repository."
-    msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
-    msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  upgrade.sh inside tar.gz $KASM_URL"
-    echo
-    read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
-    if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
-      msg_error "Aborted by user. No changes have been made."
-      exit 10
-    fi
+    confirm_external_installer "https://www.kasmweb.com/" "upgrade.sh inside tar.gz $KASM_URL"
    curl_download "/tmp/kasm_release_${KASM_VERSION}.tar.gz" "$KASM_URL"
    tar -xf "kasm_release_${KASM_VERSION}.tar.gz"
    chmod +x /tmp/kasm_release/install.sh
--- a/ct/keeper.sh
+++ b/ct/keeper.sh
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/ridafkih/keeper.sh
+
+APP="Keeper"
+var_tags="${var_tags:-calendar;sync}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/keeper ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "keeper" "ridafkih/keeper.sh"; then
+    msg_info "Stopping Keeper"
+    systemctl stop keeper-web keeper-worker keeper-cron keeper-api
+    msg_ok "Stopped Keeper"
+
+    msg_info "Updating Bun"
+    $STD bun upgrade
+    msg_ok "Updated Bun"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "keeper" "ridafkih/keeper.sh" "tarball"
+
+    msg_info "Building Keeper"
+    cd /opt/keeper
+    $STD bun install --frozen-lockfile
+    $STD bun run --cwd services/api build
+    $STD bun run --cwd services/cron build
+    $STD bun run --cwd services/worker build
+    $STD bun run --cwd applications/web build
+    msg_ok "Built Keeper"
+
+    msg_info "Migrating Keeper Database"
+    $STD bun --env-file=/opt/keeper_data/.env packages/database/scripts/migrate.ts
+    msg_ok "Migrated Keeper Database"
+
+    msg_info "Starting Keeper"
+    systemctl start keeper-api keeper-cron keeper-worker keeper-web
+    msg_ok "Started Keeper"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
--- a/ct/komodo.sh
+++ b/ct/komodo.sh
@@ -66,7 +66,7 @@ MIGRATION_EOF
  ln -sf /usr/bin/update /usr/bin/update_komodo 2>/dev/null || true
  msg_ok "Migration complete"

-  msg_info "Running addon update"
+  echo -e "${INFO}${YW}Running addon update${CL}"
  type=update bash <(curl -fsSL "${ADDON_SCRIPT}")
  exit
 }
--- a/ct/librenms.sh
+++ b/ct/librenms.sh
@@ -37,8 +37,8 @@ function update_script() {
    systemctl stop php8.4-fpm librenms-scheduler.timer
    msg_ok "Stopped Services"

-    create_backup /opt/librenms/.env /opt/librenms/config.php /opt/librenms/rrd
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "librenms" "librenms/librenms" "tarball"
+    create_backup /opt/librenms/.env /opt/librenms/config.php
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="rrd" fetch_and_deploy_gh_release "librenms" "librenms/librenms" "tarball"
    restore_backup

    msg_info "Updating LibreNMS"
--- a/ct/linkwarden.sh
+++ b/ct/linkwarden.sh
@@ -36,9 +36,9 @@ function update_script() {

    RUST_CRATES="monolith" setup_rust

-    create_backup /opt/linkwarden/.env /opt/linkwarden/data
+    create_backup /opt/linkwarden/.env

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "linkwarden" "linkwarden/linkwarden" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "linkwarden" "linkwarden/linkwarden" "tarball"

    restore_backup

--- a/ct/livebook.sh
+++ b/ct/livebook.sh
@@ -34,7 +34,7 @@ function update_script() {
  if check_for_gh_release "livebook" "livebook-dev/livebook"; then
    msg_info "Stopping Service"
    systemctl stop livebook
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"

    msg_info "Updating Container"
    apt_update_safe
@@ -47,10 +47,11 @@ function update_script() {
    $STD mix escript.install hex livebook --force

    chown -R livebook:livebook /opt/livebook /data
+    msg_ok "Updated Livebook"

    msg_info "Starting Service"
    systemctl start livebook
-    msg_info "Started Service"
+    msg_ok "Started Service"

    msg_ok "Updated successfully!"
  fi
--- a/ct/localai.sh
+++ b/ct/localai.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Bryan Lieberman (BryanCLieberman)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://localai.io
+
+APP="LocalAI"
+var_tags="${var_tags:-ai;llm;api}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-8192}"
+var_disk="${var_disk:-30}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_gpu="${var_gpu:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+# Values the install script accepts up front
+export var_auth="${var_auth:-no}"
+export var_api_key="${var_api_key:-}"
+export var_port="${var_port:-8080}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/localai ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "localai" "mudler/LocalAI"; then
+    msg_info "Stopping Service"
+    systemctl stop localai
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "localai" "mudler/LocalAI" "singlefile" "latest" "/opt/localai" "local-ai-v*-linux-$(arch_resolve amd64 arm64)"
+
+    msg_info "Starting Service"
+    systemctl start localai
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
+echo -e "${INFO}${YW}Install models from the gallery in the web UI or place GGUF files in /opt/localai_data/models${CL}"
--- a/ct/metabase.sh
+++ b/ct/metabase.sh
@@ -33,7 +33,7 @@ function update_script() {
    if check_for_gh_release "metabase" "metabase/metabase"; then
        msg_info "Stopping Service"
        systemctl stop metabase
-        msg_info "Stopped Service"
+        msg_ok "Stopped Service"

        msg_info "Creating backup"
        mv /opt/metabase/.env /opt
--- a/ct/nametag.sh
+++ b/ct/nametag.sh
@@ -36,9 +36,9 @@ function update_script() {
    systemctl stop nametag
    msg_ok "Stopped Service"

-    create_backup /opt/nametag/.env /opt/nametag/data
+    create_backup /opt/nametag/.env

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/opt/nametag"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/opt/nametag"

    restore_backup

--- a/ct/nginxproxymanager.sh
+++ b/ct/nginxproxymanager.sh
@@ -216,6 +216,7 @@ EOF
    $STD yarn install --network-timeout 600000
    $STD yarn locale-compile
    $STD yarn build
+    $STD yarn cache clean
    cp -r /opt/nginxproxymanager/frontend/dist/* /app/frontend
    cp -r /opt/nginxproxymanager/frontend/public/images/* /app/frontend/images
    msg_ok "Built Frontend"
@@ -241,6 +242,7 @@ EOF
    sed -i 's/"client": "sqlite3"/"client": "better-sqlite3"/' /app/config/production.json
    cd /app
    $STD yarn install --network-timeout 600000
+    $STD yarn cache clean
    msg_ok "Initialized Backend"

    msg_info "Starting Services"
--- a/ct/opencloud.sh
+++ b/ct/opencloud.sh
@@ -31,8 +31,18 @@ function update_script() {
    exit
  fi

-  RELEASE="v7.4.0"
+  # Collabora 26.04.4 ignores frame-ancestors in content_security_policy; outside the release
+  # check so installs already on the current release get it too
+  if [[ -f /etc/coolwsd/coolwsd.xml ]] && ! grep -q '<frame_ancestors[^>]*>[^<[:space:]]' /etc/coolwsd/coolwsd.xml; then
+    msg_info "Allowing OpenCloud to embed Collabora"
+    $STD sudo -u cool coolconfig set net.frame_ancestors "$(sed -n 's/^OC_URL=//p' /etc/opencloud/opencloud.env)"
+    systemctl restart coolwsd
+    msg_ok "Allowed OpenCloud to embed Collabora"
+  fi
+
+  RELEASE="v8.1.0"
  if check_for_gh_release "OpenCloud" "opencloud-eu/opencloud" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
+    OLD_VERSION="$(cat ~/.opencloud 2>/dev/null)"
    msg_info "Stopping services"
    systemctl stop opencloud opencloud-wopi
    msg_ok "Stopped services"
@@ -70,6 +80,34 @@ function update_script() {
    msg_info "Starting services"
    systemctl start opencloud opencloud-wopi
    msg_ok "Started services"
+
+    if [[ -z "$OLD_VERSION" || "${OLD_VERSION#v}" =~ ^[0-7]\. ]]; then
+      # The index CLI cancels the rebuild when interrupted, so it runs as its own unit and the
+      # update only waits for it. Restart covers a search service that is still starting.
+      msg_info "Rebuilding search index (safe to interrupt, it continues in the background)"
+      REINDEX_START="$(date '+%Y-%m-%d %H:%M:%S')"
+      systemctl reset-failed opencloud-reindex &>/dev/null || true
+      $STD systemd-run --unit=opencloud-reindex --uid=opencloud --gid=opencloud \
+        -p EnvironmentFile=/etc/opencloud/opencloud.env -p Restart=on-failure -p RestartSec=15 \
+        -p StartLimitIntervalSec=900 -p StartLimitBurst=20 \
+        /usr/bin/opencloud search index --all-spaces --force-rescan --insecure
+      while [[ "$(systemctl show -p ActiveState --value opencloud-reindex)" =~ ^(active|activating)$ ]]; do
+        sleep 10
+      done
+      if [[ "$(systemctl show -p ActiveState --value opencloud-reindex)" == "failed" ]]; then
+        msg_ok "Stopped waiting for the search index rebuild"
+        msg_warn "The rebuild did not complete, see: journalctl -u opencloud-reindex"
+        msg_warn "Retry with: systemctl reset-failed opencloud-reindex; systemd-run --unit=opencloud-reindex \
+          --uid=opencloud --gid=opencloud -p EnvironmentFile=/etc/opencloud/opencloud.env \
+          /usr/bin/opencloud search index --all-spaces --force-rescan --insecure"
+      else
+        msg_ok "Rebuilt search index"
+        if journalctl -u opencloud-reindex --since "$REINDEX_START" --no-pager | grep -qE '/[0-9]+ ERROR'; then
+          msg_warn "Some spaces could not be indexed, see: journalctl -u opencloud-reindex"
+        fi
+        msg_warn "Once search finds older files, remove the old index: rm -rf /var/lib/opencloud/search/bleve"
+      fi
+    fi
    msg_ok "Updated successfully"
  fi
  exit
--- a/ct/openwebui.sh
+++ b/ct/openwebui.sh
@@ -49,7 +49,6 @@ function update_script() {

    msg_info "Installing uv-based Open-WebUI"
    PYTHON_VERSION="3.12" setup_uv
-    export UV_HTTP_TIMEOUT=300
    for attempt in $(seq 1 3); do
      $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") open-webui[all] && break
      [[ $attempt -lt 3 ]] && msg_warn "Open WebUI install attempt $attempt failed, retrying..." && sleep 10
@@ -126,7 +125,6 @@ EOF
      OTEL_ARGS+=(--with "$pkg")
    done < <(uv pip list --python "$OWUI_PYTHON" --format freeze 2>/dev/null | grep -i '^opentelemetry-' | cut -d= -f1)
  fi
-  export UV_HTTP_TIMEOUT=300
  for attempt in $(seq 1 3); do
    $STD uv tool install --force --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] && break
    [[ $attempt -lt 3 ]] && msg_warn "Open WebUI update attempt $attempt failed, retrying..." && sleep 10
--- a/ct/ownfoil.sh
+++ b/ct/ownfoil.sh
@@ -36,11 +36,7 @@ function update_script() {
    systemctl stop ownfoil
    msg_ok "Stopped Service"

-    create_backup /opt/ownfoil/app/config
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ownfoil" "a1ex4/ownfoil" "tarball" "${RELEASE}"
-
-    restore_backup
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="app/config" fetch_and_deploy_gh_release "ownfoil" "a1ex4/ownfoil" "tarball" "${RELEASE}"

    msg_info "Installing Dependencies"
    cd /opt/ownfoil
--- a/ct/pangolin.sh
+++ b/ct/pangolin.sh
@@ -7,7 +7,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 # Source: https://pangolin.net/ | Github: https://github.com/fosrl/pangolin

 APP="Pangolin"
-PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.23.0}"
 var_tags="${var_tags:-proxy}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-4096}"
@@ -38,7 +37,7 @@ function update_script() {
  ensure_dependencies build-essential python3

  if ! command -v psql &>/dev/null; then
-    msg_error "This installation uses SQLite and cannot be upgraded to Pangolin ${PANGOLIN_VERSION}."
+    msg_error "This installation uses SQLite and cannot be upgraded to latest Pangolin."
    echo -e "${INFO}${YW}Starting with Pangolin 1.20.0, PostgreSQL is required as the database backend.${CL}"
    echo -e "${INFO}${YW}An automatic migration of your existing SQLite data is not supported.${CL}"
    echo -e "${INFO}${YW}Please create a new LXC with the Pangolin install script, which sets up PostgreSQL automatically.${CL}"
@@ -48,16 +47,16 @@ function update_script() {

  NODE_VERSION="24" setup_nodejs

-  if check_for_gh_release "pangolin" "fosrl/pangolin" "$PANGOLIN_VERSION" "Pinned to a tested release because Pangolin's schema changes have repeatedly broken unattended updates. To try a newer version at your own risk, run: 'export PANGOLIN_VERSION=<tag>' and re-run update. If it breaks, please open an issue at https://github.com/community-scripts/ProxmoxVE/issues with the error log."; then
+  if check_for_gh_release "pangolin" "fosrl/pangolin"; then
    msg_info "Stopping Service"
    systemctl stop pangolin
    systemctl stop gerbil
-    msg_info "Service stopped"
+    msg_ok "Stopped Service"

    DB_URL=$(sed -n 's/.*connection_string: "\(.*\)".*/\1/p' /opt/pangolin/config/config.yml)
    create_backup /opt/pangolin/config

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "pangolin" "fosrl/pangolin" "tarball" "$PANGOLIN_VERSION"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "pangolin" "fosrl/pangolin" "tarball"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/bin" "gerbil_linux_$(arch_resolve)"

    msg_info "Updating Pangolin"
--- a/ct/paperclip.sh
+++ b/ct/paperclip.sh
@@ -15,6 +15,8 @@ var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
+export var_paperclip_user="${var_paperclip_user:-}"
+export var_paperclip_pass="${var_paperclip_pass:-}"

 header_info "$APP"
 variables
@@ -59,9 +61,44 @@ function update_script() {
      @openai/codex@latest
    msg_ok "Updated Agent CLIs"

+    # Claude Code refuses --dangerously-skip-permissions as root; migrate existing installs to a dedicated user
+    PAPERCLIP_USER=$(sed -n 's/^User=//p' /etc/systemd/system/paperclip.service)
+    PAPERCLIP_HOME=$(sed -n 's/^PAPERCLIP_HOME=//p' /opt/paperclip-ai/.env)
+    PAPERCLIP_HOME="${PAPERCLIP_HOME:-/opt/paperclip-data}"
+    if [[ -z "$PAPERCLIP_USER" || "$PAPERCLIP_USER" == "root" ]] && [[ "$PAPERCLIP_HOME" != "/opt/paperclip-data" ]]; then
+      # A custom data dir (e.g. an NFS bind mount) may only be reachable by root; don't move the service off root
+      msg_warn "PAPERCLIP_HOME is ${PAPERCLIP_HOME}; keeping the service user as root"
+      PAPERCLIP_USER=root
+    elif [[ -z "$PAPERCLIP_USER" || "$PAPERCLIP_USER" == "root" ]]; then
+      PAPERCLIP_USER="${var_paperclip_user:-paperclip}"
+      if [[ "$PAPERCLIP_USER" == "root" || ! "$PAPERCLIP_USER" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]]; then
+        msg_error "Invalid var_paperclip_user '${PAPERCLIP_USER}' (must be a non-root lowercase Linux username)"
+        exit 1
+      fi
+      PAPERCLIP_USER_HOME="/home/${PAPERCLIP_USER}"
+      id -u "$PAPERCLIP_USER" &>/dev/null || useradd -m -d "$PAPERCLIP_USER_HOME" -s /bin/bash "$PAPERCLIP_USER"
+      passwd -S "$PAPERCLIP_USER" 2>/dev/null | grep -q " P " || passwd -l "$PAPERCLIP_USER" &>/dev/null
+      mkdir -p "${PAPERCLIP_USER_HOME}/.claude" "${PAPERCLIP_USER_HOME}/.codex"
+      [[ -d /root/.claude ]] && cp -a /root/.claude/. "${PAPERCLIP_USER_HOME}/.claude/"
+      [[ -d /root/.codex ]] && cp -a /root/.codex/. "${PAPERCLIP_USER_HOME}/.codex/"
+      sed -i \
+        -e "s|^User=.*|User=${PAPERCLIP_USER}\nGroup=${PAPERCLIP_USER}|" \
+        -e "s|^Environment=HOME=.*|Environment=HOME=${PAPERCLIP_USER_HOME}|" \
+        -e "s|^Environment=CODEX_HOME=.*|Environment=CODEX_HOME=${PAPERCLIP_USER_HOME}/.codex|" \
+        -e "s|/root/.local/bin|${PAPERCLIP_USER_HOME}/.local/bin|" \
+        /etc/systemd/system/paperclip.service
+      systemctl daemon-reload
+    fi
+    PAPERCLIP_USER_HOME=$(getent passwd "$PAPERCLIP_USER" | cut -d: -f6)
+    chmod 600 /opt/paperclip-ai/.env
+    chown -R "${PAPERCLIP_USER}:${PAPERCLIP_USER}" /opt/paperclip-ai "$PAPERCLIP_USER_HOME"
+    if [[ "$PAPERCLIP_HOME" == "/opt/paperclip-data" && -d /opt/paperclip-data ]]; then
+      chown -R "${PAPERCLIP_USER}:${PAPERCLIP_USER}" /opt/paperclip-data
+    fi
+
    msg_info "Running Database Migrations"
    set -a && source /opt/paperclip-ai/.env && set +a
-    $STD pnpm db:migrate
+    $STD runuser -u "$PAPERCLIP_USER" -- env HOME="$PAPERCLIP_USER_HOME" bash -c 'cd /opt/paperclip-ai && pnpm db:migrate'
    msg_ok "Ran Database Migrations"

    msg_info "Starting Service"
--- a/ct/passwordpusher.sh
+++ b/ct/passwordpusher.sh
@@ -36,9 +36,9 @@ function update_script() {
    systemctl stop passwordpusher
    msg_ok "Stopped Service"

-    create_backup /opt/passwordpusher/storage /opt/passwordpusher/.env.production
+    create_backup /opt/passwordpusher/.env.production

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "passwordpusher" "pglombardo/PasswordPusher" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="storage" fetch_and_deploy_gh_release "passwordpusher" "pglombardo/PasswordPusher" "tarball"

    restore_backup

--- a/ct/peanut.sh
+++ b/ct/peanut.sh
@@ -35,7 +35,7 @@ function update_script() {
  if check_for_gh_release "PeaNUT" "Brandawg93/PeaNUT"; then
    msg_info "Stopping Service"
    systemctl stop peanut
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "PeaNUT" "Brandawg93/PeaNUT" "tarball" "latest" "/opt/peanut"

--- a/ct/plant-it.sh
+++ b/ct/plant-it.sh
@@ -34,7 +34,7 @@ function update_script() {
  if check_for_gh_release "plant-it" "MDeLuise/plant-it" "${RELEASE}" "last version that includes the web frontend"; then
    msg_info "Stopping Service"
    systemctl stop plant-it
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"

    USE_ORIGINAL_FILENAME="true" fetch_and_deploy_gh_release "plant-it" "MDeLuise/plant-it" "singlefile" "${RELEASE}" "/opt/plant-it/backend" "server.jar"
    fetch_and_deploy_gh_release "plant-it-front" "MDeLuise/plant-it" "prebuild" "${RELEASE}" "/opt/plant-it/frontend" "client.tar.gz"
--- a/ct/postiz.sh
+++ b/ct/postiz.sh
@@ -37,10 +37,9 @@ function update_script() {
    systemctl stop postiz-orchestrator postiz-frontend postiz-backend
    msg_ok "Stopped Services"

-    create_backup /opt/postiz/.env \
-      /opt/postiz/uploads
+    create_backup /opt/postiz/.env

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "postiz" "gitroomhq/postiz-app" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="uploads" fetch_and_deploy_gh_release "postiz" "gitroomhq/postiz-app" "tarball"

    restore_backup

--- a/ct/pricebuddy.sh
+++ b/ct/pricebuddy.sh
@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/jez500/pricebuddy
+
+APP="PriceBuddy"
+var_tags="${var_tags:-shopping;price-tracker}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-3072}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}" # the bundled scraper runs Google Chrome, which is amd64-only
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/pricebuddy ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "pricebuddy" "jez500/pricebuddy"; then
+    msg_info "Stopping PriceBuddy Worker"
+    systemctl stop pricebuddy-worker
+    msg_ok "Stopped PriceBuddy Worker"
+
+    setup_composer
+    NODE_VERSION="22" setup_nodejs
+
+    create_backup /opt/pricebuddy/.env /opt/pricebuddy/storage
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "pricebuddy" "jez500/pricebuddy" "tarball"
+
+    restore_backup
+
+    msg_info "Updating PriceBuddy"
+    cd /opt/pricebuddy
+    sed -i "s/^APP_VERSION=.*/APP_VERSION=$(cat ~/.pricebuddy)/" .env
+    $STD composer install --no-dev --optimize-autoloader --no-interaction
+    $STD npm install
+    $STD npm run build
+    $STD php artisan storage:link
+    $STD php artisan migrate --force
+    $STD php artisan optimize
+    $STD php artisan icons:cache
+    $STD php artisan buddy:regenerate-price-cache
+    chown -R www-data:www-data /opt/pricebuddy
+    msg_ok "Updated PriceBuddy"
+
+    msg_info "Starting PriceBuddy Worker"
+    systemctl start pricebuddy-worker
+    msg_ok "Started PriceBuddy Worker"
+    msg_ok "Updated successfully!"
+  fi
+
+  if check_for_gh_release "seleniumbase-scrapper" "jez500/seleniumbase-scrapper"; then
+    msg_info "Stopping SeleniumBase Scrapper"
+    systemctl stop seleniumbase-scrapper
+    msg_ok "Stopped SeleniumBase Scrapper"
+
+    msg_info "Updating Google Chrome"
+    apt_update_safe
+    upgrade_packages_with_retry google-chrome-stable
+    msg_ok "Updated Google Chrome"
+
+    PYTHON_VERSION="3.12" setup_uv
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "seleniumbase-scrapper" "jez500/seleniumbase-scrapper" "tarball"
+
+    msg_info "Updating SeleniumBase Scrapper"
+    $STD uv venv --python 3.12 /opt/seleniumbase-scrapper/.venv
+    $STD uv pip install --python /opt/seleniumbase-scrapper/.venv/bin/python \
+      "seleniumbase==$(sed -n 's/^ARG SELENIUMBASE_VERSION=v//p' /opt/seleniumbase-scrapper/Dockerfile)" \
+      flask \
+      beautifulsoup4
+    $STD /opt/seleniumbase-scrapper/.venv/bin/seleniumbase get chromedriver
+    msg_ok "Updated SeleniumBase Scrapper"
+
+    msg_info "Starting SeleniumBase Scrapper"
+    systemctl start seleniumbase-scrapper
+    msg_ok "Started SeleniumBase Scrapper"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
+echo -e "${INFO}${YW}Log in as admin@example.com - the password is APP_USER_PASSWORD in /opt/pricebuddy/.env${CL}"
--- a/ct/radicale.sh
+++ b/ct/radicale.sh
@@ -35,17 +35,13 @@ function update_script() {
    systemctl stop radicale
    msg_ok "Stopped service"

-    create_backup /opt/radicale/users
-
    PYTHON_VERSION="3.13" setup_uv
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Radicale" "Kozea/Radicale" "tarball" "latest" "/opt/radicale"
-
-    restore_backup
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="users" fetch_and_deploy_gh_release "Radicale" "Kozea/Radicale" "tarball" "latest" "/opt/radicale"

    if grep -q 'start.sh' /etc/systemd/system/radicale.service; then
      sed -i -e '/^Description/i[Unit]' \
        -e '\|^ExecStart|iWorkingDirectory=/opt/radicale' \
-        -e 's|^ExecStart=.*|ExecStart=/usr/local/bin/uv run -m radicale --config /etc/radicale/config|' /etc/systemd/system/radicale.service
+        -e 's|^ExecStart=.*|ExecStart=/usr/local/bin/uv run --extra bcrypt --extra argon2 -m radicale --config /etc/radicale/config|' /etc/systemd/system/radicale.service
      systemctl daemon-reload
    fi
    if [[ ! -f /etc/radicale/config ]]; then
@@ -74,6 +70,14 @@ EOF
    msg_ok "Started service"
    msg_ok "Updated Successfully!"
  fi
+
+  if grep -q 'uv run -m radicale' /etc/systemd/system/radicale.service && grep -q '^argon2 *=' /opt/radicale/pyproject.toml; then
+    msg_info "Enabling bcrypt/argon2 support"
+    sed -i 's|uv run -m radicale|uv run --extra bcrypt --extra argon2 -m radicale|' /etc/systemd/system/radicale.service
+    systemctl daemon-reload
+    systemctl restart radicale
+    msg_ok "Enabled bcrypt/argon2 support"
+  fi
  exit
 }

--- a/ct/revealjs.sh
+++ b/ct/revealjs.sh
@@ -33,7 +33,7 @@ function update_script() {
  if check_for_gh_release "revealjs" "hakimel/reveal.js"; then
    msg_info "Stopping Service"
    systemctl stop revealjs
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"

    cp /opt/revealjs/index.html /opt
    fetch_and_deploy_gh_release "revealjs" "hakimel/reveal.js" "tarball"
--- a/ct/runtipi.sh
+++ b/ct/runtipi.sh
@@ -35,7 +35,7 @@ function update_script() {

  msg_warn "⚠️  ${APP} has been migrated to an addon script."
  echo ""
-  msg_info "This is a one-time migration. After this, you can update ${APP} anytime with:"
+  echo -e "${INFO}${YW}This is a one-time migration. After this, you can update ${APP} anytime with:${CL}"
  echo -e "${TAB}${TAB}${GN}update_runtipi${CL}  or  ${GN}bash <(curl -fsSL ${ADDON_SCRIPT})${CL}"
  echo ""
  read -r -p "${TAB}Migrate update function now? [y/N]: " CONFIRM
@@ -58,7 +58,7 @@ MIGRATION_EOF
  ln -sf /usr/bin/update /usr/bin/update_runtipi 2>/dev/null || true
  msg_ok "Migration complete"

-  msg_info "Running addon update"
+  echo -e "${INFO}${YW}Running addon update${CL}"
  type=update bash <(curl -fsSL "${ADDON_SCRIPT}")
  exit
 }
--- a/ct/rustdeskserver.sh
+++ b/ct/rustdeskserver.sh
@@ -45,7 +45,7 @@ update_deb_based() {
    if [[ -f /lib/systemd/system/rustdesk-api.service ]]; then
      systemctl stop rustdesk-api
    fi
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"

    fetch_and_deploy_gh_release "rustdesk-hbbr" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbr*$(arch_resolve).deb"
    fetch_and_deploy_gh_release "rustdesk-hbbs" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbs*$(arch_resolve).deb"
--- a/ct/seelf.sh
+++ b/ct/seelf.sh
@@ -33,7 +33,7 @@ function update_script() {
  if check_for_gh_release "seelf" "YuukanOO/seelf"; then
    msg_info "Stopping Service"
    systemctl stop seelf
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"

    msg_info "Updating seelf"
    cd /opt/seelf 
--- a/ct/solidtime.sh
+++ b/ct/solidtime.sh
@@ -36,9 +36,9 @@ function update_script() {
    systemctl stop caddy
    msg_ok "Stopped Services"

-    create_backup /opt/solidtime/.env /opt/solidtime/storage
+    create_backup /opt/solidtime/.env

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "solidtime" "solidtime-io/solidtime" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="storage" fetch_and_deploy_gh_release "solidtime" "solidtime-io/solidtime" "tarball"

    restore_backup

--- a/ct/soulsync.sh
+++ b/ct/soulsync.sh
@@ -38,9 +38,9 @@ function update_script() {
    systemctl stop soulsync
    msg_ok "Stopped Service"

-    create_backup /opt/soulsync/config /opt/soulsync/data
+    create_backup /opt/soulsync/config

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "soulsync" "Nezreka/SoulSync" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "soulsync" "Nezreka/SoulSync" "tarball"

    restore_backup

--- a/ct/sparkyfitness.sh
+++ b/ct/sparkyfitness.sh
@@ -37,11 +37,7 @@ function update_script() {
    systemctl stop sparkyfitness-server nginx
    msg_ok "Stopped Services"

-    create_backup /opt/sparkyfitness/SparkyFitnessServer/uploads /opt/sparkyfitness/SparkyFitnessServer/backup
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "sparkyfitness" "CodeWithCJ/SparkyFitness" "tarball"
-
-    restore_backup
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="SparkyFitnessServer/uploads SparkyFitnessServer/backup" fetch_and_deploy_gh_release "sparkyfitness" "CodeWithCJ/SparkyFitness" "tarball"

    PNPM_VERSION="$(jq -r '.packageManager | split("@")[1]' /opt/sparkyfitness/package.json)"
    NODE_VERSION="25" NODE_MODULE="pnpm@${PNPM_VERSION}" setup_nodejs
--- a/ct/streamlink-webui.sh
+++ b/ct/streamlink-webui.sh
@@ -34,7 +34,7 @@ function update_script() {
  if check_for_gh_release "streamlink-webui" "CrazyWolf13/streamlink-webui"; then
    msg_info "Stopping Service"
    systemctl stop streamlink-webui
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"

    NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
    setup_uv
--- a/ct/stylus.sh
+++ b/ct/stylus.sh
@@ -34,7 +34,7 @@ function update_script() {
  if check_for_gh_release "stylus" "mmastrac/stylus"; then
    msg_info "Stopping Service"
    systemctl stop stylus
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"

    fetch_and_deploy_gh_release "stylus" "mmastrac/stylus" "singlefile" "latest" "/usr/bin/" "*_linux_$(arch_resolve)"

--- a/ct/sure.sh
+++ b/ct/sure.sh
@@ -65,9 +65,7 @@ EOF
      msg_ok "Stopped services"
    fi

-    create_backup /opt/sure/storage
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Sure" "we-promise/sure" "tarball" "latest" "/opt/sure"
-    restore_backup
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="storage" fetch_and_deploy_gh_release "Sure" "we-promise/sure" "tarball" "latest" "/opt/sure"
    RUBY_VERSION="$(cat /opt/sure/.ruby-version)" RUBY_INSTALL_RAILS=false HOME=/root setup_ruby

    msg_info "Updating Sure"
--- a/ct/tandoor.sh
+++ b/ct/tandoor.sh
@@ -44,11 +44,11 @@ function update_script() {
    systemctl stop tandoor
    msg_ok "Stopped Service"

-    create_backup /opt/tandoor/config /opt/tandoor/api /opt/tandoor/mediafiles /opt/tandoor/staticfiles /opt/tandoor/.env
+    create_backup /opt/tandoor/.env

    NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
    PYTHON_VERSION="3.13" setup_uv
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tandoor" "TandoorRecipes/recipes" "tarball" "latest" "/opt/tandoor"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="config api mediafiles staticfiles" fetch_and_deploy_gh_release "tandoor" "TandoorRecipes/recipes" "tarball" "latest" "/opt/tandoor"

    restore_backup

--- a/ct/termix.sh
+++ b/ct/termix.sh
@@ -163,13 +163,9 @@ EOF
    fi
    msg_ok "Migrated Configuration"

-    create_backup \
-      /opt/termix/db/data \
-      /opt/termix/data \
-      /opt/termix/uploads \
-      /opt/termix/.env
+    create_backup /opt/termix/.env

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="db/data data uploads" fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball"

    restore_backup

--- a/ct/thingsboard.sh
+++ b/ct/thingsboard.sh
@@ -30,6 +30,7 @@ function update_script() {
    exit
  fi

+  JAVA_VERSION="25" setup_java
  if check_for_gh_release "thingsboard" "thingsboard/thingsboard"; then
    msg_info "Stopping Service"
    systemctl stop thingsboard
--- a/ct/tracearr.sh
+++ b/ct/tracearr.sh
@@ -122,7 +122,8 @@ EOF
    $STD pnpm install --frozen-lockfile --force
    $STD pnpm turbo telemetry disable
    $STD pnpm turbo run build --no-daemon --filter=@tracearr/shared --filter=@tracearr/server --filter=@tracearr/web
-    $STD ./scripts/fetch-basemap.sh
+    $STD ./scripts/fetch-basemap.sh || msg_warn "Basemap download failed, keeping the existing map"
+    [[ -d /opt/tracearr/data ]] && mv /opt/tracearr/data /opt/tracearr.data
    rm -rf /opt/tracearr
    mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db}
    cp -rf package.json /opt/tracearr/
@@ -137,7 +138,9 @@ EOF
    cp -rf packages/emails/package.json /opt/tracearr/packages/emails/
    cp -rf packages/emails/dist /opt/tracearr/packages/emails/dist
    cp -rf apps/server/src/db/migrations /opt/tracearr/apps/server/src/db/migrations
-    cp -rf data /opt/tracearr/data
+    [[ -d /opt/tracearr.data ]] && mv /opt/tracearr.data /opt/tracearr/data
+    mkdir -p /opt/tracearr/data
+    cp -rf data/. /opt/tracearr/data/
    mkdir -p /opt/tracearr/data/image-cache
    rm -rf /opt/tracearr.build
    cd /opt/tracearr
--- a/ct/transmute.sh
+++ b/ct/transmute.sh
@@ -41,9 +41,9 @@ function update_script() {
    systemctl stop transmute
    msg_ok "Stopped Service"

-    create_backup /opt/transmute/backend/.env /opt/transmute/data
+    create_backup /opt/transmute/backend/.env

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "transmute" "transmute-app/transmute" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "transmute" "transmute-app/transmute" "tarball"

    restore_backup

--- a/ct/tvheadend.sh
+++ b/ct/tvheadend.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Nicolas Pastorello (opastorello)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://tvheadend.org/ | Github: https://github.com/tvheadend/tvheadend
+
+APP="Tvheadend"
+var_tags="${var_tags:-media;pvr;tv;dvr}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+export var_admin_user="${var_admin_user:-admin}"
+export var_admin_pass="${var_admin_pass:-$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /var/lib/tvheadend ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  msg_info "Updating Tvheadend"
+  $STD apt update
+  $STD apt install -y tvheadend
+  msg_ok "Updated Tvheadend"
+
+  msg_info "Restarting Service"
+  systemctl restart tvheadend
+  msg_ok "Restarted Service"
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:9981${CL}"
+echo -e "${INFO}${YW}Admin Username: ${var_admin_user}${CL}"
+echo -e "${INFO}${YW}Admin Password: ${var_admin_pass}${CL}"
--- a/ct/umbraco.sh
+++ b/ct/umbraco.sh
@@ -3,7 +3,7 @@ _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../cor
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: Joost van den Berg (montagneId)
-# License: MIT | https://github.com/montagneid/ProxmoxVED/raw/main/LICENSE
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/umbraco/Umbraco-CMS

 APP="Umbraco"
--- a/ct/wanderer.sh
+++ b/ct/wanderer.sh
@@ -148,6 +148,23 @@ EOF
    msg_ok "Migrated wanderer services"
  fi

+  if ! grep -q '^POCKETBASE_PROXY_SECRET=' /opt/wanderer/.env; then
+    msg_info "Adding POCKETBASE_PROXY_SECRET"
+    echo "POCKETBASE_PROXY_SECRET=$(openssl rand -hex 32)" >>/opt/wanderer/.env
+    systemctl restart wanderer-web
+    msg_ok "Added POCKETBASE_PROXY_SECRET"
+  fi
+
+  if [[ -f /opt/wanderer_data/plugins/plugin.json ]]; then
+    msg_info "Reinstalling wanderer plugins, one directory each"
+    find /opt/wanderer_data/plugins -maxdepth 1 -type f -delete
+    for plugin in hammerhead komoot strava; do
+      rm -f ~/.wanderer-plugin-${plugin}
+      fetch_and_deploy_gh_release "wanderer-plugin-${plugin}" "open-wanderer/wanderer" "prebuild" "latest" "/opt/wanderer_data/plugins/${plugin}" "wanderer-plugin-${plugin}.tar.gz" || msg_warn "Failed to install wanderer plugin: ${plugin}"
+    done
+    msg_ok "Reinstalled wanderer plugins"
+  fi
+
  if check_for_gh_release "wanderer" "open-wanderer/wanderer"; then
    msg_info "Stopping service"
    systemctl stop wanderer-web
@@ -170,7 +187,7 @@ EOF
    [[ -e /opt/wanderer/db/data/plugins ]] || ln -sfn /opt/wanderer_data/plugins /opt/wanderer/db/data/plugins
    msg_info "Installing wanderer plugins"
    for plugin in hammerhead komoot strava; do
-      fetch_and_deploy_gh_release "wanderer-plugin-${plugin}" "open-wanderer/wanderer" "prebuild" "${CHECK_UPDATE_RELEASE:-latest}" "/opt/wanderer_data/plugins" "wanderer-plugin-${plugin}.tar.gz" || msg_warn "Failed to install wanderer plugin: ${plugin}"
+      fetch_and_deploy_gh_release "wanderer-plugin-${plugin}" "open-wanderer/wanderer" "prebuild" "${CHECK_UPDATE_RELEASE:-latest}" "/opt/wanderer_data/plugins/${plugin}" "wanderer-plugin-${plugin}.tar.gz" || msg_warn "Failed to install wanderer plugin: ${plugin}"
    done
    msg_ok "Installed wanderer plugins"
    msg_ok "Updated wanderer"
--- a/ct/weblate.sh
+++ b/ct/weblate.sh
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/WeblateOrg/weblate
+
+APP="Weblate"
+var_tags="${var_tags:-translation;localization}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-3072}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/weblate ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "weblate" "WeblateOrg/weblate"; then
+    msg_info "Stopping Weblate"
+    systemctl stop weblate weblate-celery
+    msg_ok "Stopped Weblate"
+
+    PYTHON_VERSION="3.14" setup_uv
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "weblate" "WeblateOrg/weblate" "singlefile" "latest" "/opt/weblate" "weblate-*-py3-none-any.whl"
+
+    msg_info "Updating Weblate"
+    $STD uv pip install --python /opt/weblate/.venv/bin/python --compile-bytecode /opt/weblate/weblate-*.whl "weblate[all,wsgi]"
+    rm -f /opt/weblate/weblate-*.whl
+    set -a
+    source /opt/weblate_data/weblate.env
+    set +a
+    $STD /opt/weblate/.venv/bin/weblate migrate --noinput
+    $STD /opt/weblate/.venv/bin/weblate collectstatic --noinput
+    msg_ok "Updated Weblate"
+
+    msg_info "Starting Weblate"
+    systemctl start weblate-celery weblate
+    msg_ok "Started Weblate"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
--- a/ct/webtrees.sh
+++ b/ct/webtrees.sh
@@ -31,6 +31,20 @@ function update_script() {
    exit
  fi

+  if ! grep -q "@private" /etc/caddy/Caddyfile; then
+    msg_info "Blocking direct access to webtrees data"
+    cp /etc/caddy/Caddyfile /etc/caddy/Caddyfile.bak
+    sed -i '\|root \* /opt/webtrees|a\    @private path /app/* /data/* /modules_v4/* /resources/* /vendor/* /.*\n    respond @private 403' /etc/caddy/Caddyfile
+    if grep -q "@private" /etc/caddy/Caddyfile && caddy validate --config /etc/caddy/Caddyfile &>/dev/null; then
+      rm -f /etc/caddy/Caddyfile.bak
+      systemctl reload-or-restart caddy
+      msg_ok "Blocked direct access to webtrees data"
+    else
+      mv /etc/caddy/Caddyfile.bak /etc/caddy/Caddyfile
+      msg_warn "Could not patch /etc/caddy/Caddyfile - deny /data/ there by hand"
+    fi
+  fi
+
  if check_for_gh_release "webtrees" "fisharebest/webtrees"; then
    msg_info "Stopping Service"
    PHP_VER=$(php -r 'echo PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION;')
--- a/ct/wikijs.sh
+++ b/ct/wikijs.sh
@@ -30,7 +30,7 @@ function update_script() {
    exit
  fi

-  NODE_VERSION="24" NODE_MODULE="yarn,node-gyp" setup_nodejs
+  NODE_VERSION="26" NODE_MODULE="yarn,node-gyp" setup_nodejs

  if check_for_gh_release "wikijs" "requarks/wiki"; then
    msg_info "Verifying whether ${APP}' new release is v3.x+ and current install uses SQLite."
--- a/ct/xyops.sh
+++ b/ct/xyops.sh
@@ -36,11 +36,7 @@ function update_script() {
    systemctl stop xyops
    msg_ok "Stopped Service"

-    create_backup /opt/xyops/data /opt/xyops/conf
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "xyops" "pixlcore/xyops" "tarball"
-
-    restore_backup
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data conf" fetch_and_deploy_gh_release "xyops" "pixlcore/xyops" "tarball"

    msg_info "Rebuilding Application"
    cd /opt/xyops
--- a/ct/zigbee2mqtt.sh
+++ b/ct/zigbee2mqtt.sh
@@ -49,8 +49,12 @@ update_deb_based() {
    ensure_dependencies zstd
    mkdir -p /opt/backups
    BACKUP_VERSION="$(<"$HOME/.zigbee2mqtt")"
-    BACKUP_FILE="/opt/backups/${APP}_backup_${BACKUP_VERSION}.tar.zst"
-    $STD tar -cf - -C /opt zigbee2mqtt | zstd -q -o "$BACKUP_FILE"
+    BACKUP_FILE="$(mktemp "/opt/backups/${APP}_backup_${BACKUP_VERSION}_XXXXXX.tar.zst")"
+    tar -cf - -C /opt zigbee2mqtt | $STD zstd -q -f -o "$BACKUP_FILE" || {
+      local backup_exit_code=$?
+      rm -f "$BACKUP_FILE"
+      return "$backup_exit_code"
+    }
    ls -t /opt/backups/${APP}_backup_*.tar.zst 2>/dev/null | tail -n +6 | xargs -r rm -f
    msg_ok "Backup Created (${BACKUP_VERSION})"

--- a/install/adventurelog-install.sh
+++ b/install/adventurelog-install.sh
@@ -30,10 +30,10 @@ PG_DB_NAME="adventurelog_db" PG_DB_USER="adventurelog_user" PG_DB_EXTENSIONS="po
 fetch_and_deploy_gh_release "adventurelog" "seanmorley15/adventurelog" "tarball"

 msg_info "Installing AdventureLog (Patience)"
-SECRET_KEY="$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | cut -c1-32)"
+SECRET_KEY="$(random_password 32)"
 echo "AdventureLog Secret: $SECRET_KEY" >>~/adventurelog.creds
 DJANGO_ADMIN_USER="djangoadmin"
-DJANGO_ADMIN_PASS="$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)"
+DJANGO_ADMIN_PASS="$(random_password 13)"
 cat <<EOF >/opt/adventurelog/backend/server/.env
 PGHOST='localhost'
 PGDATABASE='${PG_DB_NAME}'
--- a/install/affine-install.sh
+++ b/install/affine-install.sh
@@ -160,7 +160,7 @@ systemctl enable -q --now redis-server affine-web affine-worker
 msg_ok "Created Services"

 msg_info "Creating Admin User"
-ADMIN_PASS=$(openssl rand -base64 12)
+ADMIN_PASS=$(random_password 16)
 for i in {1..30}; do
  if curl -s http://localhost:3010/info >/dev/null 2>&1; then
    break
--- a/install/alpine-nextcloud-install.sh
+++ b/install/alpine-nextcloud-install.sh
@@ -37,8 +37,8 @@ msg_ok "Installed PHP/Redis"
 msg_info "Installing MySQL Database"
 DB_NAME=nextcloud
 DB_USER=nextcloud
-DB_PASS="$(openssl rand -base64 18 | cut -c1-13)"
-ADMIN_PASS="$(openssl rand -base64 18 | cut -c1-13)"
+DB_PASS="$(random_password 13)"
+ADMIN_PASS="$(random_password 13)"
 echo "" >>~/nextcloud.creds
 echo -e "MySQL Admin Password: \e[32m$ADMIN_PASS\e[0m" >>~/nextcloud.creds
 echo -e "Nextcloud Database Username: \e[32m$DB_USER\e[0m" >>~/nextcloud.creds
--- a/install/anythingllm-install.sh
+++ b/install/anythingllm-install.sh
@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Mintplex-Labs/anything-llm
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  python3-dev \
+  libgomp1 \
+  git \
+  chromium
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
+
+fetch_and_deploy_gh_release "anythingllm" "Mintplex-Labs/anything-llm" "tarball"
+
+msg_info "Configuring AnythingLLM"
+mkdir -p /opt/anythingllm_data/storage
+cp -RTn /opt/anythingllm/server/storage /opt/anythingllm_data/storage 2>/dev/null || true
+rm -rf /opt/anythingllm/server/storage
+ln -sfn /opt/anythingllm_data/storage /opt/anythingllm/server/storage
+cat <<EOF >/opt/anythingllm/server/.env
+SERVER_PORT=3001
+STORAGE_DIR="/opt/anythingllm/server/storage"
+JWT_SECRET="$(openssl rand -hex 32)"
+SIG_KEY="$(openssl rand -hex 32)"
+SIG_SALT="$(openssl rand -hex 32)"
+VECTOR_DB="lancedb"
+EOF
+cat <<EOF >/opt/anythingllm/collector/.env
+STORAGE_DIR="/opt/anythingllm/server/storage"
+EOF
+cat <<EOF >/opt/anythingllm/frontend/.env
+VITE_API_BASE='/api'
+EOF
+msg_ok "Configured AnythingLLM"
+
+msg_info "Building AnythingLLM (Patience)"
+cd /opt/anythingllm
+export PUPPETEER_SKIP_DOWNLOAD=true
+export NODE_OPTIONS="--max-old-space-size=3072"
+$STD yarn setup
+cd /opt/anythingllm/frontend
+$STD yarn build
+cp -R /opt/anythingllm/frontend/dist /opt/anythingllm/server/public
+cd /opt/anythingllm/server
+$STD npx prisma generate --schema=./prisma/schema.prisma
+$STD npx prisma migrate deploy --schema=./prisma/schema.prisma
+msg_ok "Built AnythingLLM"
+
+msg_info "Creating Services"
+cat <<EOF >/etc/systemd/system/anythingllm.service
+[Unit]
+Description=AnythingLLM Server
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/anythingllm/server
+Environment=NODE_ENV=production
+ExecStart=/usr/bin/node index.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/anythingllm-collector.service
+[Unit]
+Description=AnythingLLM Collector
+Wants=network-online.target
+After=network-online.target anythingllm.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/anythingllm/collector
+Environment=NODE_ENV=production
+Environment=PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium
+ExecStart=/usr/bin/node index.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now anythingllm anythingllm-collector
+msg_ok "Created Services"
+
+motd_ssh
+customize
+cleanup_lxc
--- a/Show More
+++ b/Show More