fix: prepare tubearchivist for v0.6.0

CHANGELOG.md

@@ -562,34 +562,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
-## 2026-10-12
-
-### 🆕 New Scripts
-
-  - WatchState ([#17881](https://github.com/community-scripts/ProxmoxVE/pull/17881))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - chore(ct): sync wazuh defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17889](https://github.com/community-scripts/ProxmoxVE/pull/17889))
-    - Wanderer: bring back the wanderer-pb wrapper [@MickLesk](https://github.com/MickLesk) ([#17874](https://github.com/community-scripts/ProxmoxVE/pull/17874))
-    - Tracearr: install only the server's production dependencies [@MickLesk](https://github.com/MickLesk) ([#17873](https://github.com/community-scripts/ProxmoxVE/pull/17873))
-    - Paperless-ngx: QoL restart crashed services | patch regex [@MickLesk](https://github.com/MickLesk) ([#17812](https://github.com/community-scripts/ProxmoxVE/pull/17812))
-    - Splunk Enterprise: start the service as the splunk user [@rcastley](https://github.com/rcastley) ([#17816](https://github.com/community-scripts/ProxmoxVE/pull/17816))
-
-### 💾 Core
-
-  - Draw a Community Scripts banner while a script has no header of its own [@MickLesk](https://github.com/MickLesk) ([core#133](https://github.com/community-scripts/core/pull/133))
-- Order pre-release labels when comparing versions [@MickLesk](https://github.com/MickLesk) ([core#132](https://github.com/community-scripts/core/pull/132))
-- gh: curl_download: wait between attempts [@MickLesk](https://github.com/MickLesk) ([core#131](https://github.com/community-scripts/core/pull/131))
-
-### 🧰 Tools
-
-  - #### ✨ New Features
-
-    - Immich Public Proxy: optional visitor upload service (v4 Release) [@MickLesk](https://github.com/MickLesk) ([#17875](https://github.com/community-scripts/ProxmoxVE/pull/17875))
-
 ## 2026-10-11
 
 ### 🆕 New Scripts
@@ -600,26 +572,17 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
-    - Immich: build libvips with JPEG 2000 support [@MickLesk](https://github.com/MickLesk) ([#17864](https://github.com/community-scripts/ProxmoxVE/pull/17864))
     - hermesagent: match the relaunched root gateway regardless of interpreter [@MickLesk](https://github.com/MickLesk) ([#17847](https://github.com/community-scripts/ProxmoxVE/pull/17847))
     - Radicale: install the bcrypt and argon2 extras [@MickLesk](https://github.com/MickLesk) ([#17813](https://github.com/community-scripts/ProxmoxVE/pull/17813))
     - fix(zigbee2mqtt): preserve backup stream and prevent filename collisions [@petermnt](https://github.com/petermnt) ([#17751](https://github.com/community-scripts/ProxmoxVE/pull/17751))
 
   - #### ✨ New Features
 
-    - QoL: let var_* answer the optional add-on prompts [@MickLesk](https://github.com/MickLesk) ([#17858](https://github.com/community-scripts/ProxmoxVE/pull/17858))
-    - QoL: Confirm third-party installers through confirm_external_installer [@MickLesk](https://github.com/MickLesk) ([#17857](https://github.com/community-scripts/ProxmoxVE/pull/17857))
     - docker: take the lxcfs toggle, TCP socket and Compose choice from app variables [@MickLesk](https://github.com/MickLesk) ([#17850](https://github.com/community-scripts/ProxmoxVE/pull/17850))
 
-  - #### 🔧 Refactor
-
-    - RustDesk Server: run the official server, make the web UI optional [@MickLesk](https://github.com/MickLesk) ([#17854](https://github.com/community-scripts/ProxmoxVE/pull/17854))
-    - Caddy: install the .deb from GitHub instead of the Cloudsmith repo [@MickLesk](https://github.com/MickLesk) ([#17862](https://github.com/community-scripts/ProxmoxVE/pull/17862))
-
 ### 💾 Core
 
-  - Add confirm_external_installer [@MickLesk](https://github.com/MickLesk) ([core#130](https://github.com/community-scripts/core/pull/130))
-- setup_docker: make LXC resource limits visible to nested containers [@andrebrait](https://github.com/andrebrait) ([core#9](https://github.com/community-scripts/core/pull/9))
+  - setup_docker: make LXC resource limits visible to nested containers [@andrebrait](https://github.com/andrebrait) ([core#9](https://github.com/community-scripts/core/pull/9))
 - Incus: fix ENABLE_FUSE / TUN vars [@MickLesk](https://github.com/MickLesk) ([core#127](https://github.com/community-scripts/core/pull/127))
 - Resolve a uv required-version range to the newest release inside it [@MickLesk](https://github.com/MickLesk) ([core#126](https://github.com/community-scripts/core/pull/126))
 - Upgrade MongoDB in place when an app package depends on it [@MickLesk](https://github.com/MickLesk) ([core#128](https://github.com/community-scripts/core/pull/128))

ct/caddy.sh

@@ -38,18 +38,11 @@ update_deb_based() {
     exit
   fi
 
-  cleanup_old_repo_files "caddy"
   msg_info "Updating Caddy LXC"
   apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated Caddy LXC"
 
-  [[ -f ~/.caddy ]] || dpkg-query -W -f='${Version}' caddy >~/.caddy 2>/dev/null || true
-  if check_for_gh_release "caddy" "caddyserver/caddy"; then
-    DPKG_FORCE_CONFOLD=1 fetch_and_deploy_gh_release "caddy" "caddyserver/caddy" "binary" "latest" "/opt/caddy" "caddy_*_linux_$(arch_resolve).deb"
-    systemctl restart caddy
-  fi
-
   if command -v xcaddy >/dev/null 2>&1; then
     if check_for_gh_release "xcaddy" "caddyserver/xcaddy"; then
       setup_go

ct/hermesagent.sh

@@ -31,7 +31,16 @@ function update_script() {
     exit
   fi
 
-  confirm_external_installer "https://hermes-agent.nousresearch.com/" "hermes update (https://hermes-agent.nousresearch.com/)"
+  msg_warn "WARNING: This script will run an external installer from a third-party source (https://hermes-agent.nousresearch.com/)."
+  msg_warn "The following code is NOT maintained or audited by our repository."
+  msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+  msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  hermes update (https://hermes-agent.nousresearch.com/)"
+  echo
+  read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+  if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+    msg_error "Aborted by user. No changes have been made."
+    exit 10
+  fi
 
   msg_info "Stopping Services"
   systemctl stop hermes-dashboard

ct/immich.sh

@@ -106,7 +106,7 @@ EOF
     libraries=("libjxl" "jpegli" "libheif" "libraw" "imagemagick" "libvips")
     cd "$BASE_DIR"
     msg_warn "Checking for updates to custom image-processing libraries (recompile time: 2-15min per library)"
-    ensure_dependencies liblcms2-dev libjpeg62-turbo-dev libspng-dev libexif-dev libopenjp2-7-dev
+    ensure_dependencies liblcms2-dev libjpeg62-turbo-dev libspng-dev libexif-dev
     $STD git pull
     for library in "${libraries[@]}"; do
       compile_"$library"
@@ -565,8 +565,7 @@ function compile_imagemagick() {
 function compile_libvips() {
   SOURCE=$SOURCE_DIR/libvips
   LIBVIPS_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libvips.json)"
-  if [[ "$LIBVIPS_REVISION" != "$(grep 'libvips' ~/.immich_library_revisions | awk '{print $2}')" ]] ||
-    [[ "$(vips -l foreign 2>/dev/null)" != *jp2kload* ]]; then
+  if [[ "$LIBVIPS_REVISION" != "$(grep 'libvips' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
     msg_info "Recompiling libvips"
     [[ -d "$SOURCE" ]] && rm -rf "$SOURCE"
     $STD git clone https://github.com/libvips/libvips.git "$SOURCE"

ct/kasm.sh

@@ -62,7 +62,16 @@ function update_script() {
     msg_info "Updating Kasm"
     cd /tmp
 
-    confirm_external_installer "https://www.kasmweb.com/" "upgrade.sh inside tar.gz $KASM_URL"
+    msg_warn "WARNING: This script will run an external installer from a third-party source (https://www.kasmweb.com/)."
+    msg_warn "The following code is NOT maintained or audited by our repository."
+    msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+    msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  upgrade.sh inside tar.gz $KASM_URL"
+    echo
+    read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+    if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+      msg_error "Aborted by user. No changes have been made."
+      exit 10
+    fi
     curl_download "/tmp/kasm_release_${KASM_VERSION}.tar.gz" "$KASM_URL"
     tar -xf "kasm_release_${KASM_VERSION}.tar.gz"
     chmod +x /tmp/kasm_release/install.sh

ct/paperless-ngx.sh

@@ -157,6 +157,8 @@ function update_script() {
             sed -i '$a\PAPERLESS_ARCHIVE_FILE_GENERATION=never' "$PAPERLESS_CONF"
           fi
         fi
+        [[ -n "$(sed -n '/^PAPERLESS_CONSUMER_IGNORE_PATTERNS=/p' "$PAPERLESS_CONF")" ]] &&
+          msg_warn "PAPERLESS_CONSUMER_IGNORE_PATTERNS now uses regex patterns; please verify custom values."
         [[ -n "$(sed -n '/^PAPERLESS_PRE_CONSUME_SCRIPT=/p;/^PAPERLESS_POST_CONSUME_SCRIPT=/p' "$PAPERLESS_CONF")" ]] &&
           msg_warn "Pre/post consume scripts no longer receive positional arguments in v3; please verify custom scripts."
         msg_ok "Migrated Paperless-ngx configuration"
@@ -170,9 +172,7 @@ function update_script() {
       fi
       for svc in consumer scheduler task-queue webserver; do
         unit="/etc/systemd/system/paperless-${svc}.service"
-        [[ -f "$unit" ]] || continue
-        sed -i 's|uv run -- |uv run --no-sync -- |g' "$unit"
-        grep -q '^Restart=' "$unit" || sed -i '/^\[Service\]/a Restart=on-failure\nRestartSec=5' "$unit"
+        [[ -f "$unit" ]] && sed -i 's|uv run -- |uv run --no-sync -- |g' "$unit"
       done
       $STD systemctl daemon-reload
       cd /opt/paperless
@@ -181,34 +181,6 @@ function update_script() {
       $STD uv run -- python manage.py migrate
       msg_ok "Updated Paperless-ngx"
 
-      if ((BRIDGE_UPDATE == 0)); then
-        IGNORE_FIXED="$(
-          /opt/paperless/.venv/bin/python - /opt/paperless/paperless.conf <<'EOF'
-import json, re, sys
-key = "PAPERLESS_CONSUMER_IGNORE_PATTERNS="
-lines = open(sys.argv[1]).read().splitlines(True)
-
-def is_glob(p):
-    if p.startswith("^") or p.endswith("$"):
-        return False
-    try:
-        return bool(re.search(p, "scan.pdf"))
-    except re.error:
-        return True
-
-for i, line in enumerate(lines):
-    if line.startswith(key):
-        patterns = json.loads(line[len(key):].strip().strip("'"))
-        fixed = ["^" + re.escape(p).replace(r"\*", ".*").replace(r"\?", ".") + "$" if is_glob(p) else p for p in patterns]
-        if fixed != patterns:
-            lines[i] = key + json.dumps(fixed) + "\n"
-            print(json.dumps(fixed))
-open(sys.argv[1], "w").writelines(lines)
-EOF
-        )" || IGNORE_FIXED=""
-        [[ -n "$IGNORE_FIXED" ]] && msg_warn "Converted glob PAPERLESS_CONSUMER_IGNORE_PATTERNS to regex (required since v3): ${IGNORE_FIXED}"
-      fi
-
       if ((BRIDGE_UPDATE == 0)) && [[ "$PAPERLESS_INSTALLED_VERSION" == "2.20.15" ]]; then
         $STD apt -y purge libzbar0t64 libzbar0 2>/dev/null || true
         $STD apt -y autoremove 2>/dev/null || true

ct/rustdeskserver.sh

@@ -11,7 +11,6 @@ var_tags="${var_tags:-remote-desktop}"
 var_cpu="${var_cpu:-1}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
-export var_rustdesk_api="${var_rustdesk_api:-}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
   var_os=$(msg_menu "Choose the container OS" \
     "debian" "Debian 13" \
@@ -39,32 +38,25 @@ update_deb_based() {
     exit
   fi
 
-  if check_for_gh_release "rustdesk-hbbs" "rustdesk/rustdesk-server"; then
-    msg_info "Stopping RustDesk Server"
-    systemctl stop rustdesk-hbbr rustdesk-hbbs
-    msg_ok "Stopped RustDesk Server"
-
-    fetch_and_deploy_gh_release "rustdesk-hbbr" "rustdesk/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbr*$(arch_resolve).deb"
-    fetch_and_deploy_gh_release "rustdesk-hbbs" "rustdesk/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbs*$(arch_resolve).deb"
-    fetch_and_deploy_gh_release "rustdesk-utils" "rustdesk/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-utils*$(arch_resolve).deb"
-
-    msg_info "Starting RustDesk Server"
-    systemctl start rustdesk-hbbs rustdesk-hbbr
-    msg_ok "Started RustDesk Server"
-    msg_ok "Updated RustDesk Server"
-  fi
-
-  if [[ -f /lib/systemd/system/rustdesk-api.service ]] && check_for_gh_release "rustdesk-api" "lejianwen/rustdesk-api"; then
-    msg_info "Stopping RustDesk API"
-    systemctl stop rustdesk-api
-    msg_ok "Stopped RustDesk API"
+  if check_for_gh_release "rustdesk-hbbs" "lejianwen/rustdesk-server"; then
+    msg_info "Stopping Service"
+    systemctl stop rustdesk-hbbr
+    systemctl stop rustdesk-hbbs
+    if [[ -f /lib/systemd/system/rustdesk-api.service ]]; then
+      systemctl stop rustdesk-api
+    fi
+    msg_ok "Stopped Service"
 
+    fetch_and_deploy_gh_release "rustdesk-hbbr" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbr*$(arch_resolve).deb"
+    fetch_and_deploy_gh_release "rustdesk-hbbs" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbs*$(arch_resolve).deb"
+    fetch_and_deploy_gh_release "rustdesk-utils" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-utils*$(arch_resolve).deb"
     fetch_and_deploy_gh_release "rustdesk-api" "lejianwen/rustdesk-api" "binary" "latest" "/opt/rustdesk" "rustdesk-api-server*$(arch_resolve).deb"
 
-    msg_info "Starting RustDesk API"
-    systemctl start rustdesk-api
-    msg_ok "Started RustDesk API"
-    msg_ok "Updated RustDesk API"
+    msg_info "Starting services"
+    systemctl start -q rustdesk-*
+    msg_ok "Services started"
+
+    msg_ok "Updated successfully!"
   fi
 }
 
@@ -74,26 +66,21 @@ update_alpine() {
     exit
   fi
 
-  msg_info "Updating Alpine Packages"
-  $STD apk -U upgrade
-  msg_ok "Updated Alpine Packages"
-
-  if check_for_gh_release "rustdesk-server" "rustdesk/rustdesk-server"; then
+  if check_for_gh_release "rustdesk-server" "lejianwen/rustdesk-server"; then
     msg_info "Stopping RustDesk Server"
+    $STD apk -U upgrade
     $STD service rustdesk-server-hbbs stop
     $STD service rustdesk-server-hbbr stop
     msg_ok "Stopped RustDesk Server"
 
-    fetch_and_deploy_gh_release "rustdesk-server" "rustdesk/rustdesk-server" "prebuild" "latest" "/opt/rustdesk-server" "rustdesk-server-linux-$(arch_resolve "amd64" "arm64v8").zip"
+    fetch_and_deploy_gh_release "rustdesk-server" "lejianwen/rustdesk-server" "prebuild" "latest" "/opt/rustdesk-server" "rustdesk-server-linux-$(arch_resolve "amd64" "arm64v8").zip"
 
     msg_info "Starting RustDesk Server"
     $STD service rustdesk-server-hbbs start
     $STD service rustdesk-server-hbbr start
     msg_ok "Started RustDesk Server"
-    msg_ok "Updated RustDesk Server"
   fi
-
-  if [[ -x /opt/rustdesk-api/apimain ]] && check_for_gh_release "rustdesk-api" "lejianwen/rustdesk-api"; then
+  if check_for_gh_release "rustdesk-api" "lejianwen/rustdesk-api"; then
     msg_info "Stopping RustDesk API"
     $STD service rustdesk-api stop
     msg_ok "Stopped RustDesk API"
@@ -103,8 +90,8 @@ update_alpine() {
     msg_info "Starting RustDesk API"
     $STD service rustdesk-api start
     msg_ok "Started RustDesk API"
-    msg_ok "Updated RustDesk API"
   fi
+  msg_ok "Updated successfully!"
 }
 
 function update_script() {
@@ -120,7 +107,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Set this as ID server in the RustDesk client, the key is in ~/rustdesk.creds:${CL}"
-echo -e "${GATEWAY}${BGN}${IP}${CL}"
-echo -e "${INFO}${YW}Web UI, if selected during setup:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:21114/_admin/${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:21114${CL}"

ct/tracearr.sh

@@ -125,7 +125,7 @@ EOF
     $STD ./scripts/fetch-basemap.sh || msg_warn "Basemap download failed, keeping the existing map"
     [[ -d /opt/tracearr/data ]] && mv /opt/tracearr/data /opt/tracearr.data
     rm -rf /opt/tracearr
-    mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db,assets}
+    mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db}
     cp -rf package.json /opt/tracearr/
     cp -rf pnpm-workspace.yaml /opt/tracearr/
     cp -rf pnpm-lock.yaml /opt/tracearr/
@@ -138,14 +138,13 @@ EOF
     cp -rf packages/emails/package.json /opt/tracearr/packages/emails/
     cp -rf packages/emails/dist /opt/tracearr/packages/emails/dist
     cp -rf apps/server/src/db/migrations /opt/tracearr/apps/server/src/db/migrations
-    cp -f assets/logo.png /opt/tracearr/assets/
     [[ -d /opt/tracearr.data ]] && mv /opt/tracearr.data /opt/tracearr/data
     mkdir -p /opt/tracearr/data
     cp -rf data/. /opt/tracearr/data/
     mkdir -p /opt/tracearr/data/image-cache
     rm -rf /opt/tracearr.build
     cd /opt/tracearr
-    $STD pnpm install --prod --frozen-lockfile --ignore-scripts --filter @tracearr/server...
+    $STD pnpm install --prod --frozen-lockfile --ignore-scripts
     $STD chown -R tracearr:tracearr /opt/tracearr
     msg_ok "Built Tracearr"
 

ct/tubearchivist.sh

@@ -71,6 +71,41 @@ EOF
 
     restore_backup
 
+    if grep -q '^TA_BACKEND_PORT=' /opt/tubearchivist/.env 2>/dev/null; then
+      msg_info "Migrating to v0.6.0 (dropping Nginx)"
+      systemctl disable -q --now nginx
+      $STD apt autoremove --purge -y nginx
+      sed -i 's/^TA_BACKEND_PORT=.*/TA_PORT=8000/' /opt/tubearchivist/.env
+      cat <<'RUNEOF' >/opt/tubearchivist/backend/run.sh
+#!/bin/bash
+set -e
+cd /opt/tubearchivist/backend
+set -a
+source /opt/tubearchivist/.env
+set +a
+PYTHON=/opt/tubearchivist/.venv/bin/python
+
+echo "Waiting for ElasticSearch..."
+for i in $(seq 1 30); do
+  if curl -sf http://localhost:9200/_cluster/health >/dev/null 2>&1; then
+    break
+  fi
+  sleep 2
+done
+
+$PYTHON manage.py ta_stop_on_error
+$PYTHON manage.py migrate
+$PYTHON manage.py collectstatic --noinput -c
+$PYTHON manage.py ta_envcheck
+$PYTHON manage.py ta_connection
+$PYTHON manage.py ta_startup
+
+exec $PYTHON backend_start.py
+RUNEOF
+      chmod +x /opt/tubearchivist/backend/run.sh
+      msg_ok "Migrated to v0.6.0 (dropping Nginx)"
+    fi
+
     msg_info "Rebuilding Tube Archivist"
     cd /opt/tubearchivist/frontend
     $STD npm install
@@ -113,7 +148,6 @@ EOF
 
     msg_info "Starting Services"
     systemctl start bgutil-provider tubearchivist tubearchivist-celery tubearchivist-beat
-    systemctl reload nginx
     msg_ok "Started Services"
     msg_ok "Updated successfully!"
   fi

ct/wanderer.sh

@@ -100,6 +100,7 @@ EOF
       -e "s|^MEILI_DB_PATH=.*|MEILI_DB_PATH=/opt/wanderer_data/meili_data|" \
       /opt/wanderer/.env
     sed -i "s|^db_path =.*|db_path = \"/opt/wanderer_data/meili_data\"|" /etc/meilisearch.toml
+    rm -f /usr/local/bin/wanderer-pb
 
     cat <<EOF >/etc/systemd/system/wanderer-pocketbase.service
 [Unit]
@@ -154,16 +155,6 @@ EOF
     msg_ok "Added POCKETBASE_PROXY_SECRET"
   fi
 
-  cat <<'EOF' >/usr/local/bin/wanderer-pb
-#!/usr/bin/env bash
-set -a
-source /opt/wanderer/.env
-set +a
-cd /opt/wanderer/db
-exec ./pocketbase "$@" --dir="$PB_DB_LOCATION"
-EOF
-  chmod +x /usr/local/bin/wanderer-pb
-
   if [[ -f /opt/wanderer_data/plugins/plugin.json ]]; then
     msg_info "Reinstalling wanderer plugins, one directory each"
     find /opt/wanderer_data/plugins -maxdepth 1 -type f -delete

ct/watchstate.sh

@@ -1,77 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/arabcoders/watchstate
-
-APP="WatchState"
-var_tags="${var_tags:-media;plex;jellyfin;emby}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-6}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/watchstate ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "watchstate" "arabcoders/watchstate" "" "" "v"; then
-    msg_info "Stopping WatchState"
-    systemctl stop watchstate-worker php8.5-fpm
-    msg_ok "Stopped WatchState"
-
-    create_backup /opt/watchstate/.env
-    setup_composer
-    NODE_VERSION="24" NODE_MODULE="bun" setup_nodejs
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "watchstate" "arabcoders/watchstate" "tarball" "latest" "/opt/watchstate" "" "v"
-    restore_backup
-
-    msg_info "Building WatchState"
-    cd /opt/watchstate
-    sed -i "s/'version' => 'dev-master'/'version' => 'v$(cat ~/.watchstate)'/" config/config.php
-    $STD composer install --no-dev --optimize-autoloader --no-interaction
-    cd /opt/watchstate/frontend
-    $STD bun install --frozen-lockfile --production
-    NODE_ENV=production $STD bun run generate
-    mv /opt/watchstate/frontend/exported /opt/watchstate/public/exported
-    rm -rf /opt/watchstate/frontend/node_modules /opt/watchstate/frontend/.nuxt
-    msg_ok "Built WatchState"
-
-    msg_info "Migrating WatchState Database"
-    $STD php /opt/watchstate/bin/console db:migrate --execute
-    $STD php /opt/watchstate/bin/console db:index
-    chown -R www-data:www-data /opt/watchstate_data
-    msg_ok "Migrated WatchState Database"
-
-    msg_info "Starting WatchState"
-    systemctl start php8.5-fpm watchstate-worker
-    msg_ok "Started WatchState"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"

ct/wazuh.sh

@@ -10,7 +10,7 @@ APP="Wazuh"
 var_tags="${var_tags:-security;monitoring}"
 var_cpu="${var_cpu:-4}"
 var_ram="${var_ram:-4096}"
-var_disk="${var_disk:-35}"
+var_disk="${var_disk:-25}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"

ct/wikijs.sh

@@ -32,14 +32,14 @@ function update_script() {
 
   NODE_VERSION="26" NODE_MODULE="yarn,node-gyp" setup_nodejs
 
-  if check_for_gh_release "wikijs" "requarks/wiki-v2"; then
-    #msg_info "Verifying whether ${APP}' new release is v3.x+ and current install uses SQLite."
-    #SQLITE_INSTALL=$([ -f /opt/wikijs/db.sqlite ] && echo "true" || echo "false")
-    #if [[ "${SQLITE_INSTALL}" == "true" && "${CHECK_UPDATE_RELEASE}" =~ ^3.* ]]; then
-    #  echo "SQLite is not supported in v3.x+, currently there is no update path availble."
-    #  exit
-    #fi
-    #msg_ok "There is an update path available for ${APP}"
+  if check_for_gh_release "wikijs" "requarks/wiki"; then
+    msg_info "Verifying whether ${APP}' new release is v3.x+ and current install uses SQLite."
+    SQLITE_INSTALL=$([ -f /opt/wikijs/db.sqlite ] && echo "true" || echo "false")
+    if [[ "${SQLITE_INSTALL}" == "true" && "${CHECK_UPDATE_RELEASE}" =~ ^3.* ]]; then
+      echo "SQLite is not supported in v3.x+, currently there is no update path availble."
+      exit
+    fi
+    msg_ok "There is an update path available for ${APP}"
 
     msg_info "Stopping Service"
     systemctl stop wikijs
@@ -47,17 +47,15 @@ function update_script() {
 
     msg_info "Backing up Data"
     mkdir /opt/wikijs-backup
-    #$SQLITE_INSTALL && 
-    cp /opt/wikijs/db.sqlite /opt/wikijs-backup
+    $SQLITE_INSTALL && cp /opt/wikijs/db.sqlite /opt/wikijs-backup
     cp -R /opt/wikijs/{config.yml,/data} /opt/wikijs-backup
     msg_ok "Backed up Data"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wikijs" "requarks/wiki-v2" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wikijs" "requarks/wiki" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
 
     msg_info "Restoring Data"
     cp -R /opt/wikijs-backup/* /opt/wikijs
-    #$SQLITE_INSTALL && 
-    $STD npm rebuild sqlite3
+    $SQLITE_INSTALL && $STD npm rebuild sqlite3
     rm -rf /opt/wikijs-backup
     msg_ok "Restored Data"
 

install/aria2-install.sh

@@ -17,8 +17,7 @@ msg_info "Installing Aria2"
 $STD apt install -y aria2
 msg_ok "Installed Aria2"
 
-prompt="${var_aria2_ariang:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add AriaNG? <y/N> " prompt
+read -r -p "${TAB3}Would you like to add AriaNG? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   msg_info "Installing Dependencies"
   $STD apt install -y nginx

install/bunkerweb-install.sh

@@ -20,7 +20,16 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"
 
 RELEASE=$(get_latest_github_release "bunkerity/bunkerweb")
-confirm_external_installer "install-bunkerweb.sh" "https://github.com/bunkerity/bunkerweb/raw/v${RELEASE}/misc/install-bunkerweb.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (install-bunkerweb.sh)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://github.com/bunkerity/bunkerweb/raw/v${RELEASE}/misc/install-bunkerweb.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 msg_info "Installing BunkerWeb (Patience)"
 curl -fsSL -o install-bunkerweb.sh "https://github.com/bunkerity/bunkerweb/raw/v${RELEASE}/misc/install-bunkerweb.sh"
 chmod +x install-bunkerweb.sh

install/bytestash-install.sh

@@ -24,8 +24,7 @@ cd /opt/bytestash/client
 $STD npm install
 msg_ok "Installed ByteStash"
 
-allowreg="${var_bytestash_registration:-}"
-[[ -n "$allowreg" ]] || read -rp "${TAB3}Do you want to allow registration of multiple accounts? [y/n]: " allowreg
+read -rp "${TAB3}Do you want to allow registration of multiple accounts? [y/n]: " allowreg
 
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/bytestash-backend.service
@@ -43,7 +42,7 @@ Environment=JWT_SECRET=$JWT_SECRET
 WantedBy=multi-user.target
 EOF
 
-if [[ "${allowreg,,}" =~ ^(y|yes)$ ]]; then
+if [[ "$allowreg" =~ ^[Yy]$ ]]; then
   sed -i '8i\Environment=ALLOW_NEW_ACCOUNTS=true' /etc/systemd/system/bytestash-backend.service
 fi
 

install/caddy-install.sh

@@ -14,11 +14,23 @@ network_check
 update_os
 
 setup_deb_based() {
-  fetch_and_deploy_gh_release "caddy" "caddyserver/caddy" "binary" "latest" "/opt/caddy" "caddy_*_linux_$(arch_resolve).deb"
-  systemctl enable -q --now caddy
+  msg_info "Installing Dependencies"
+  $STD apt install -y \
+    debian-keyring \
+    debian-archive-keyring \
+    apt-transport-https
+  msg_ok "Installed Dependencies"
 
-  prompt="${var_caddy_xcaddy:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
+  msg_info "Installing Caddy"
+  setup_deb822_repo \
+    "caddy" \
+    "https://dl.cloudsmith.io/public/caddy/stable/gpg.key" \
+    "https://dl.cloudsmith.io/public/caddy/stable/deb/debian" \
+    "any-version"
+  $STD apt install -y caddy
+  msg_ok "Installed Caddy"
+
+  read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
   if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
     setup_go
     fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "binary"
@@ -63,8 +75,7 @@ EOF
 EOF
   msg_ok "Installed Caddy"
 
-  prompt="${var_caddy_xcaddy:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
+  read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
   if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
     GO_VERSION="$(curl -fsSL https://go.dev/VERSION?m=text | head -1 | cut -c3-)" setup_go
     fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "prebuild" "latest" "/opt/xcaddy" "xcaddy_*_linux_$(arch_resolve).tar.gz"

install/casaos-install.sh

@@ -13,7 +13,16 @@ setting_up_container
 network_check
 update_os
 
-confirm_external_installer "https://casaos.zimaspace.com/" "https://get.casaos.io/"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://casaos.zimaspace.com/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://get.casaos.io/"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 msg_info "Installing CasaOS (Patience)"
 DOCKER_CONFIG_PATH='/etc/docker/daemon.json'
 mkdir -p $(dirname $DOCKER_CONFIG_PATH)

install/channels-install.sh

@@ -19,7 +19,16 @@ $STD apt install -y \
   xvfb
 msg_ok "Installed Dependencies"
 
-confirm_external_installer "https://getchannels.com" "https://getchannels.com/dvr/setup.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://getchannels.com)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://getchannels.com/dvr/setup.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 
 setup_hwaccel
 

install/cockpit-install.sh

@@ -31,10 +31,7 @@ sed -i "s/root//g" /etc/cockpit/disallowed-users
 msg_ok "Installed Cockpit"
 
 # 45Drives only publishes amd64 packages
-if [[ "$(arch_resolve)" != "arm64" ]]; then
-  prompt="${var_cockpit_45drives:-}"
-  [[ -n "$prompt" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator  <y/N> " prompt
-fi
+[[ "$(arch_resolve)" == "arm64" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator  <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
   msg_info "Installing 45Drives' cockpit extensions"
   setup_deb822_repo "45drives" \

install/cryptpad-install.sh

@@ -19,15 +19,14 @@ msg_ok "Installed Dependencies"
 
 NODE_VERSION="22" setup_nodejs
 
-onlyoffice="${var_cryptpad_onlyoffice:-}"
-[[ -n "$onlyoffice" ]] || read -rp "${TAB3}Install OnlyOffice components instead of CKEditor? (Y/N): " onlyoffice
+read -rp "${TAB3}Install OnlyOffice components instead of CKEditor? (Y/N): " onlyoffice
 fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"
 
 msg_info "Setup CryptPad"
 cd /opt/cryptpad
 $STD npm ci --allow-git=all
 $STD npm run install:components
-if [[ "${onlyoffice,,}" =~ ^(y|yes)$ ]]; then
+if [[ "$onlyoffice" =~ ^[Yy]$ ]]; then
   $STD bash -c "./install-onlyoffice.sh --accept-license"
 fi
 cp config/config.example.js config/config.js

install/emqx-install.sh

@@ -38,8 +38,7 @@ rm -f "$DEB_FILE"
 echo "$LATEST_VERSION" >~/.emqx
 msg_ok "Installed EMQX"
 
-prompt="${var_emqx_disable_mq:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to disable the EMQX MQ feature? (reduces disk/CPU usage) <y/N> " prompt
+read -r -p "${TAB3}Would you like to disable the EMQX MQ feature? (reduces disk/CPU usage) <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   msg_info "Disabling EMQX MQ feature"
   mkdir -p /etc/emqx

install/headscale-install.sh

@@ -15,8 +15,7 @@ update_os
 
 fetch_and_deploy_gh_release "headscale" "juanfont/headscale" "binary"
 
-prompt="${var_headscale_admin:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add headscale-admin UI? <y/N> " prompt
+read -r -p "${TAB3}Would you like to add headscale-admin UI? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   fetch_and_deploy_gh_release "headscale-admin" "GoodiesHQ/headscale-admin" "prebuild" "latest" "/opt/headscale-admin" "admin.zip"
 

install/hermesagent-install.sh

@@ -33,7 +33,16 @@ NODE_OPTIONS=${NODE_OPTIONS}
 EOF
 msg_ok "Configured Service Environment"
 
-confirm_external_installer "https://hermes-agent.nousresearch.com/" "https://hermes-agent.nousresearch.com/install.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://hermes-agent.nousresearch.com/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://hermes-agent.nousresearch.com/install.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 
 msg_info "Installing Hermes Agent"
 curl -fsSL https://hermes-agent.nousresearch.com/install.sh -o /tmp/hermes-install.sh

install/immich-install.sh

@@ -84,7 +84,6 @@ $STD apt install --no-install-recommends -y \
   liblqr-1-0 \
   libltdl7 \
   libopenjp2-7 \
-  libopenjp2-7-dev \
   meson \
   ninja-build \
   pkg-config \

install/influxdb-install.sh

@@ -50,8 +50,7 @@ else
 fi
 msg_ok "Installed InfluxDB"
 
-prompt="${var_influxdb_telegraf:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Telegraf? <y/N> " prompt
+read -r -p "${TAB3}Would you like to add Telegraf? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
   msg_info "Installing Telegraf"
   $STD apt install -y telegraf

install/iobroker-install.sh

@@ -17,7 +17,16 @@ msg_info "Installing Dependencies"
 $STD apt install -y ca-certificates
 msg_ok "Installed Dependencies"
 
-confirm_external_installer "https://iobroker.net/" "https://iobroker.net/install.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://iobroker.net/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://iobroker.net/install.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 
 NODE_VERSION="24" NPM_VERSION="11" setup_nodejs
 

install/kasm-install.sh

@@ -56,7 +56,16 @@ if [[ -z "$KASM_VERSION" ]] || [[ -z "$KASM_URL" ]]; then
 fi
 msg_ok "Detected Kasm Workspaces version $KASM_VERSION"
 
-confirm_external_installer "https://www.kasmweb.com/" "install.sh inside tar.gz $KASM_URL"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://www.kasmweb.com/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  install.sh inside tar.gz $KASM_URL"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 
 msg_info "Installing Kasm Workspaces"
 curl_download "/opt/kasm_release_${KASM_VERSION}.tar.gz" "$KASM_URL"

install/linkwarden-install.sh

@@ -24,8 +24,7 @@ PG_VERSION="16" setup_postgresql
 RUST_CRATES="monolith" setup_rust
 PG_DB_NAME="linkwardendb" PG_DB_USER="linkwarden" setup_postgresql_db
 
-prompt="${var_linkwarden_adminer:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
+read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
   setup_adminer
 fi

install/livebook-install.sh

@@ -28,7 +28,16 @@ export HOME=/opt/livebook
 $STD adduser --system --group --home /opt/livebook --shell /bin/bash livebook
 msg_ok "Created livebook user"
 
-confirm_external_installer "https://elixir-lang.org" "https://elixir-lang.org/install.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://elixir-lang.org)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://elixir-lang.org/install.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 curl -fsSO https://elixir-lang.org/install.sh
 $STD sh install.sh elixir@latest otp@latest
 

install/mariadb-install.sh

@@ -21,8 +21,7 @@ setup_deb_based() {
   sed -i 's/^bind-address/#bind-address/g' /etc/mysql/mariadb.conf.d/50-server.cnf
   msg_ok "Setup MariaDB"
 
-  prompt="${var_mariadb_phpmyadmin:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt
+  read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt
   if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
     msg_info "Installing phpMyAdmin"
     $STD apt install -y \
@@ -59,8 +58,7 @@ setup_alpine() {
   $STD rc-service mariadb start
   msg_ok "MariaDB Configured"
 
-  prompt="${var_mariadb_adminer:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt
+  read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt
   if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
     msg_info "Installing Adminer and dependencies"
     $STD apk add --no-cache \

install/mattermost-install.sh

@@ -13,7 +13,16 @@ setting_up_container
 network_check
 update_os
 
-confirm_external_installer "https://mattermost.com/" "https://deb.packages.mattermost.com/repo-setup.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://mattermost.com/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://deb.packages.mattermost.com/repo-setup.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 
 PG_VERSION="16" setup_postgresql
 

install/meilisearch-install.sh

@@ -15,8 +15,7 @@ update_os
 
 MEILISEARCH_BIND="0.0.0.0:7700" setup_meilisearch
 
-prompt="${var_meilisearch_ui:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Do you want add meilisearch-ui? [y/n]: " prompt
+read -r -p "${TAB3}Do you want add meilisearch-ui? [y/n]: " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   NODE_VERSION="22" NODE_MODULE="pnpm@latest" setup_nodejs
   fetch_and_deploy_gh_release "meilisearch-ui" "riccox/meilisearch-ui" "tarball"

install/nextcloudpi-install.sh

@@ -13,7 +13,16 @@ setting_up_container
 network_check
 update_os
 
-confirm_external_installer "https://nextcloudpi.com/" "https://raw.githubusercontent.com/nextcloud/nextcloudpi/master/install.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://nextcloudpi.com/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://raw.githubusercontent.com/nextcloud/nextcloudpi/master/install.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 
 msg_info "Making ssh.service reloads behave like restarts"
 mkdir -p /etc/systemd/system/ssh.service.d

install/openwebui-install.sh

@@ -26,8 +26,7 @@ setup_hwaccel
 PYTHON_VERSION="3.12" setup_uv
 
 OTEL_ARGS=()
-prompt="${var_openwebui_otel:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install OpenTelemetry instrumentation packages (requires manual .env configuration)? <y/N> " prompt
+read -r -p "${TAB3}Would you like to install OpenTelemetry instrumentation packages (requires manual .env configuration)? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   for pkg in \
     opentelemetry-api \
@@ -53,8 +52,7 @@ for attempt in $(seq 1 3); do
 done
 msg_ok "Installed Open WebUI"
 
-prompt="${var_openwebui_ollama:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Ollama? <y/N> " prompt
+read -r -p "${TAB3}Would you like to add Ollama? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   if [[ "$(arch_resolve)" == "amd64" ]]; then
   msg_info "Setting up Intel® Repositories"

install/paperless-ngx-install.sh

@@ -109,8 +109,6 @@ Requires=redis.service
 [Service]
 WorkingDirectory=/opt/paperless/src
 ExecStart=uv run --no-sync -- celery --app paperless beat --loglevel INFO
-Restart=on-failure
-RestartSec=5
 
 [Install]
 WantedBy=multi-user.target
@@ -125,8 +123,6 @@ After=postgresql.service
 [Service]
 WorkingDirectory=/opt/paperless/src
 ExecStart=uv run --no-sync -- celery --app paperless worker --loglevel INFO
-Restart=on-failure
-RestartSec=5
 
 [Install]
 WantedBy=multi-user.target
@@ -141,8 +137,6 @@ Requires=redis.service
 WorkingDirectory=/opt/paperless/src
 ExecStartPre=/bin/sleep 2
 ExecStart=uv run --no-sync -- python manage.py document_consumer
-Restart=on-failure
-RestartSec=5
 
 [Install]
 WantedBy=multi-user.target
@@ -159,8 +153,6 @@ Requires=redis.service
 WorkingDirectory=/opt/paperless/src
 #ExecStartPre=uv run --no-sync -- python manage.py document_index reindex --if-needed --no-progress-bar
 ExecStart=uv run --no-sync -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
-Restart=on-failure
-RestartSec=5
 Environment=GRANIAN_HOST=::
 Environment=GRANIAN_PORT=8000
 Environment=GRANIAN_WORKERS=1
@@ -171,8 +163,7 @@ EOF
 systemctl enable -q --now paperless-webserver paperless-scheduler paperless-task-queue paperless-consumer
 msg_ok "Created Services"
 
-prompt="${var_paperless_ngx_adminer:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
+read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
   setup_adminer
 fi

install/pihole-install.sh

@@ -13,7 +13,16 @@ setting_up_container
 network_check
 update_os
 
-confirm_external_installer "https://pi-hole.net/" "https://install.pi-hole.net"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://pi-hole.net/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://install.pi-hole.net"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 
 msg_info "Installing Dependencies"
 $STD apt install -y ufw
@@ -56,11 +65,9 @@ $STD pihole-FTL --config ntp.sync.interval 0
 systemctl restart pihole-FTL.service
 msg_ok "Installed Pi-hole"
 
-prompt="${var_pihole_unbound:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Unbound? <y/N> " prompt
+read -r -p "${TAB3}Would you like to add Unbound? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
-  prompt="${var_pihole_unbound_dot:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Unbound is configured as a recursive DNS server by default, would you like it to be configured as a forwarding DNS server (using DNS-over-TLS (DoT)) instead? <y/N> " prompt
+  read -r -p "${TAB3}Unbound is configured as a recursive DNS server by default, would you like it to be configured as a forwarding DNS server (using DNS-over-TLS (DoT)) instead? <y/N> " prompt
   msg_info "Installing Unbound"
   mkdir -p /etc/unbound/unbound.conf.d
   cat <<EOF >/etc/unbound/unbound.conf.d/pi-hole.conf

install/podman-homeassistant-install.sh

@@ -48,8 +48,7 @@ msg_ok "Installed Podman"
 
 mkdir -p /etc/containers/systemd
 
-prompt="${var_podman_homeassistant_portainer:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Portainer? <y/N> " prompt
+read -r -p "${TAB3}Would you like to add Portainer? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   msg_info "Installing Portainer $PORTAINER_LATEST_VERSION"
   podman volume create portainer_data >/dev/null
@@ -76,8 +75,7 @@ EOF
   $STD systemctl start portainer
   msg_ok "Installed Portainer $PORTAINER_LATEST_VERSION"
 else
-  prompt="${var_podman_homeassistant_portainer_agent:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add the Portainer Agent? <y/N> " prompt
+  read -r -p "${TAB3}Would you like to add the Portainer Agent? <y/N> " prompt
   if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
     msg_info "Installing Portainer agent $PORTAINER_AGENT_LATEST_VERSION"
     cat <<EOF >/etc/containers/systemd/portainer-agent.container

install/podman-install.sh

@@ -48,8 +48,7 @@ msg_ok "Installed Podman"
 
 mkdir -p /etc/containers/systemd
 
-prompt="${var_podman_portainer:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Portainer? <y/N> " prompt
+read -r -p "${TAB3}Would you like to add Portainer? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   msg_info "Installing Portainer $PORTAINER_LATEST_VERSION"
   podman volume create portainer_data >/dev/null
@@ -77,8 +76,7 @@ EOF
   $STD systemctl start portainer
   msg_ok "Installed Portainer $PORTAINER_LATEST_VERSION"
 else
-  prompt="${var_podman_portainer_agent:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add the Portainer Agent? <y/N> " prompt
+  read -r -p "${TAB3}Would you like to add the Portainer Agent? <y/N> " prompt
   if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
     msg_info "Installing Portainer agent $PORTAINER_AGENT_LATEST_VERSION"
     $STD podman pull docker.io/portainer/agent:latest

install/postgresql-install.sh

@@ -124,8 +124,7 @@ EOF
   systemctl restart postgresql
   msg_ok "Installed PostgreSQL"
 
-  prompt="${var_postgresql_adminer:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
+  read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
   if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
     msg_info "Installing Adminer"
     $STD apt install -y adminer
@@ -159,8 +158,7 @@ setup_alpine() {
   $STD rc-service postgresql restart
   msg_ok "Configured and Restarted PostgreSQL"
 
-  prompt="${var_postgresql_adminer:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt
+  read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt
   if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
     msg_info "Installing Adminer and dependencies"
     $STD apk add --no-cache \

install/rustdeskserver-install.sh

@@ -13,126 +13,108 @@ setting_up_container
 network_check
 update_os
 
-if [[ -n "${var_rustdesk_api:-}" ]]; then
-  prompt="$var_rustdesk_api"
-else
-  read -r -p "${TAB3}Would you like to add the RustDesk API web UI (lejianwen/rustdesk-api, unmaintained since 09/2025)? <y/N> " prompt
-fi
-INSTALL_API=0
-[[ "${prompt,,}" =~ ^(y|yes|true)$ ]] && INSTALL_API=1
-API_PASS="$(random_password 16)"
-
-# rustdesk-api hands these to clients; its shipped defaults point at 192.168.1.66
-api_env() {
-  printf '%s\n' \
-    "RUSTDESK_API_RUSTDESK_ID_SERVER=${LOCAL_IP}:21116" \
-    "RUSTDESK_API_RUSTDESK_RELAY_SERVER=${LOCAL_IP}:21117" \
-    "RUSTDESK_API_RUSTDESK_API_SERVER=http://${LOCAL_IP}:21114" \
-    "RUSTDESK_API_RUSTDESK_KEY_FILE=$1"
-}
-
-# hbbs creates its key pair in its working directory on first start
-write_creds() {
-  local key_file="$1"
-  for _ in $(seq 1 30); do
-    [[ -s "$key_file" ]] && break
-    sleep 1
-  done
-  if [[ ! -s "$key_file" ]]; then
-    msg_error "hbbs did not create ${key_file}"
-    exit 1
-  fi
-  cat <<EOF >~/rustdesk.creds
-RustDesk Server
-ID Server: ${LOCAL_IP}
-Key: $(<"$key_file")
-EOF
-  if ((INSTALL_API)); then
-    cat <<EOF >>~/rustdesk.creds
-
-RustDesk API Web UI: http://${LOCAL_IP}:21114/_admin/
-Username: admin
-Password: ${API_PASS}
-EOF
-  fi
-}
-
 setup_deb_based() {
-  fetch_and_deploy_gh_release "rustdesk-hbbr" "rustdesk/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbr*$(arch_resolve).deb"
-  fetch_and_deploy_gh_release "rustdesk-hbbs" "rustdesk/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbs*$(arch_resolve).deb"
-  fetch_and_deploy_gh_release "rustdesk-utils" "rustdesk/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-utils*$(arch_resolve).deb"
-  systemctl enable -q --now rustdesk-hbbs rustdesk-hbbr
-  write_creds /var/lib/rustdesk-server/id_ed25519.pub
-
-  if ((INSTALL_API)); then
-    fetch_and_deploy_gh_release "rustdesk-api" "lejianwen/rustdesk-api" "binary" "latest" "/opt/rustdesk" "rustdesk-api-server*$(arch_resolve).deb"
-    msg_info "Configuring RustDesk API"
-    mkdir -p /etc/systemd/system/rustdesk-api.service.d
-    {
-      echo "[Service]"
-      api_env /var/lib/rustdesk-server/id_ed25519.pub | sed 's/^/Environment=/'
-    } >/etc/systemd/system/rustdesk-api.service.d/override.conf
-    systemctl daemon-reload
-    systemctl stop rustdesk-api
-    cd /var/lib/rustdesk-api
-    $STD rustdesk-api reset-admin-pwd "$API_PASS"
-    systemctl enable -q --now rustdesk-api
-    msg_ok "Configured RustDesk API"
-  fi
+  fetch_and_deploy_gh_release "rustdesk-hbbr" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbr*$(arch_resolve).deb"
+  fetch_and_deploy_gh_release "rustdesk-hbbs" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbs*$(arch_resolve).deb"
+  fetch_and_deploy_gh_release "rustdesk-utils" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-utils*$(arch_resolve).deb"
+  fetch_and_deploy_gh_release "rustdesk-api" "lejianwen/rustdesk-api" "binary" "latest" "/opt/rustdesk" "rustdesk-api-server*$(arch_resolve).deb"
+  systemctl enable -q --now rustdesk-hbbr
+  systemctl enable -q --now rustdesk-hbbs
+  systemctl enable -q --now rustdesk-api
 }
 
 setup_alpine() {
-  fetch_and_deploy_gh_release "rustdesk-server" "rustdesk/rustdesk-server" "prebuild" "latest" "/opt/rustdesk-server" "rustdesk-server-linux-$(arch_resolve "amd64" "arm64v8").zip"
+  fetch_and_deploy_gh_release "rustdesk-server" "lejianwen/rustdesk-server" "prebuild" "latest" "/opt/rustdesk-server" "rustdesk-server-linux-$(arch_resolve "amd64" "arm64v8").zip"
 
-  msg_info "Creating RustDesk Server Services"
-  for svc in hbbs hbbr; do
-    cat <<EOF >"/etc/init.d/rustdesk-server-${svc}"
+  msg_info "Configuring RustDesk Server"
+  mkdir -p /root/.config/rustdesk
+  cd /opt/rustdesk-server
+  ./rustdesk-utils genkeypair >/tmp/rustdesk_keys.txt
+  grep "Public Key" /tmp/rustdesk_keys.txt | awk '{print $3}' >/root/.config/rustdesk/id_ed25519.pub
+  grep "Secret Key" /tmp/rustdesk_keys.txt | awk '{print $3}' >/root/.config/rustdesk/id_ed25519
+  chmod 600 /root/.config/rustdesk/id_ed25519
+  chmod 644 /root/.config/rustdesk/id_ed25519.pub
+  rm /tmp/rustdesk_keys.txt
+  msg_ok "Configured RustDesk Server"
+
+  fetch_and_deploy_gh_release "rustdesk-api" "lejianwen/rustdesk-api" "prebuild" "latest" "/opt/rustdesk-api" "linux-$(arch_resolve).tar.gz"
+
+  msg_info "Configuring RustDesk API"
+  cd /opt/rustdesk-api
+  ADMINPASS=$(head -c 16 /dev/urandom | xxd -p -c 16)
+  $STD ./apimain reset-admin-pwd "$ADMINPASS"
+  cat <<EOF >~/rustdesk.creds
+RustDesk WebUI
+
+Username: admin
+Password: $ADMINPASS
+EOF
+  msg_ok "Configured RustDesk API"
+
+  msg_info "Enabling RustDesk Server Services"
+  cat <<EOF >/etc/init.d/rustdesk-server-hbbs
 #!/sbin/openrc-run
-description="RustDesk ${svc^^} Service"
+description="RustDesk HBBS Service"
 directory="/opt/rustdesk-server"
-command="/opt/rustdesk-server/${svc}"
+command="/opt/rustdesk-server/hbbs"
+command_args=""
 command_background="true"
-pidfile="/var/run/rustdesk-server-${svc}.pid"
-output_log="/var/log/rustdesk-${svc}.log"
-error_log="/var/log/rustdesk-${svc}.err"
+command_user="root"
+pidfile="/var/run/rustdesk-server-hbbs.pid"
+output_log="/var/log/rustdesk-hbbs.log"
+error_log="/var/log/rustdesk-hbbs.err"
 
 depend() {
     use net
 }
 EOF
-    chmod +x "/etc/init.d/rustdesk-server-${svc}"
-    $STD rc-update add "rustdesk-server-${svc}" default
-    $STD service "rustdesk-server-${svc}" start
-  done
-  msg_ok "Created RustDesk Server Services"
-  write_creds /opt/rustdesk-server/id_ed25519.pub
 
-  if ((INSTALL_API)); then
-    fetch_and_deploy_gh_release "rustdesk-api" "lejianwen/rustdesk-api" "prebuild" "latest" "/opt/rustdesk-api" "linux-$(arch_resolve).tar.gz"
-    msg_info "Configuring RustDesk API"
-    api_env /opt/rustdesk-server/id_ed25519.pub | sed 's/^/export /' >/etc/conf.d/rustdesk-api
-    cd /opt/rustdesk-api
-    $STD ./apimain reset-admin-pwd "$API_PASS"
-    cat <<EOF >/etc/init.d/rustdesk-api
+  cat <<EOF >/etc/init.d/rustdesk-server-hbbr
+#!/sbin/openrc-run
+description="RustDesk HBBR Service"
+directory="/opt/rustdesk-server"
+command="/opt/rustdesk-server/hbbr"
+command_args=""
+command_background="true"
+command_user="root"
+pidfile="/var/run/rustdesk-server-hbbr.pid"
+output_log="/var/log/rustdesk-hbbr.log"
+error_log="/var/log/rustdesk-hbbr.err"
+
+depend() {
+    use net
+}
+EOF
+
+  cat <<EOF >/etc/init.d/rustdesk-api
 #!/sbin/openrc-run
 description="RustDesk API Service"
 directory="/opt/rustdesk-api"
 command="/opt/rustdesk-api/apimain"
+command_args=""
 command_background="true"
+command_user="root"
 pidfile="/var/run/rustdesk-api.pid"
 output_log="/var/log/rustdesk-api.log"
 error_log="/var/log/rustdesk-api.err"
 
 depend() {
     use net
-    after rustdesk-server-hbbs
 }
 EOF
-    chmod +x /etc/init.d/rustdesk-api
-    $STD rc-update add rustdesk-api default
-    $STD service rustdesk-api start
-    msg_ok "Configured RustDesk API"
-  fi
+  chmod +x /etc/init.d/rustdesk-server-hbbs
+  chmod +x /etc/init.d/rustdesk-server-hbbr
+  chmod +x /etc/init.d/rustdesk-api
+  $STD rc-update add rustdesk-server-hbbs default
+  $STD rc-update add rustdesk-server-hbbr default
+  $STD rc-update add rustdesk-api default
+  msg_ok "Enabled RustDesk Server Services"
+
+  msg_info "Starting RustDesk Server"
+  $STD service rustdesk-server-hbbs start
+  $STD service rustdesk-server-hbbr start
+  $STD service rustdesk-api start
+  msg_ok "Started RustDesk Server"
 }
 
 run_os_setup

install/sabnzbd-install.sh

@@ -40,8 +40,7 @@ $STD uv venv --clear /opt/sabnzbd/venv
 $STD uv pip install -r /opt/sabnzbd/requirements.txt --python=/opt/sabnzbd/venv/bin/python
 msg_ok "Installed SABnzbd"
 
-prompt="${var_sabnzbd_par2_turbo:-}"
-[[ -n "$prompt" ]] || read -r -p "Would you like to install par2cmdline-turbo? <y/N> " prompt
+read -r -p "Would you like to install par2cmdline-turbo? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
   mv /usr/bin/par2 /usr/bin/par2.old
   fetch_and_deploy_gh_release "par2cmdline-turbo" "animetosho/par2cmdline-turbo" "prebuild" "latest" "/usr/bin/" "*-linux-$(arch_resolve).zip"

install/silverbullet-install.sh

@@ -17,8 +17,7 @@ fetch_and_deploy_gh_release "silverbullet" "silverbulletmd/silverbullet" "prebui
 mkdir -p /opt/silverbullet/space
 
 RUNTIME_API_ENV=""
-runtime_api_prompt="${var_silverbullet_runtime_api:-}"
-[[ -n "$runtime_api_prompt" ]] || read -rp "${TAB3}Enable Silverbullet Runtime API? Requires Chromium (~700MB). Uses ~200MB extra RAM. (y/N): " runtime_api_prompt
+read -rp "${TAB3}Enable Silverbullet Runtime API? Requires Chromium (~700MB). Uses ~200MB extra RAM. (y/N): " runtime_api_prompt
 if [[ "${runtime_api_prompt,,}" =~ ^(y|yes)$ ]]; then
   msg_info "Installing Chromium for Runtime API"
   $STD apt install -y chromium

install/slskd-install.sh

@@ -36,8 +36,7 @@ sed -i \
   -e 's/^.*picture/#&/' /opt/slskd/config/slskd.yml
 msg_ok "Configured Slskd"
 
-soularr="${var_slskd_soularr:-}"
-[[ -n "$soularr" ]] || read -rp "${TAB3}Do you want to install Soularr? y/N " soularr
+read -rp "${TAB3}Do you want to install Soularr? y/N " soularr
 if [[ ${soularr,,} =~ ^(y|yes)$ ]]; then
   PYTHON_VERSION="3.11" setup_uv
   fetch_and_deploy_gh_release "Soularr" "mrusse/soularr" "tarball" "latest" "/opt/soularr"

install/splunk-enterprise-install.sh

@@ -51,8 +51,8 @@ $STD curl -fsSL -o "splunk-enterprise.tgz" "$DOWNLOAD_URL" || {
 }
 $STD tar -xzf "splunk-enterprise.tgz" -C /opt
 rm -f "splunk-enterprise.tgz"
-$STD addgroup --system splunk
-$STD adduser --system --home /opt/splunk --shell /bin/bash --ingroup splunk --no-create-home splunk
+addgroup --system splunk
+adduser --system --home /opt/splunk --shell /bin/bash --ingroup splunk --no-create-home splunk
 chown -R splunk:splunk /opt/splunk
 msg_ok "Setup Splunk Enterprise v${RELEASE}"
 
@@ -64,35 +64,17 @@ Splunk-Credentials
 Username: $ADMIN_USER
 Password: $ADMIN_PASS
 EOF
-chmod 600 ~/splunk.creds
 
-install -d -o splunk -g splunk -m 755 /opt/splunk/etc/system/local
-cat <<EOF >/opt/splunk/etc/system/local/user-seed.conf
+cat <<EOF >"/opt/splunk/etc/system/local/user-seed.conf"
 [user_info]
 USERNAME = $ADMIN_USER
 PASSWORD = $ADMIN_PASS
 EOF
-chown splunk:splunk /opt/splunk/etc/system/local/user-seed.conf
-chmod 600 /opt/splunk/etc/system/local/user-seed.conf
-if ! grep -q '^SPLUNK_OS_USER=' /opt/splunk/etc/splunk-launch.conf; then
-    echo 'SPLUNK_OS_USER=splunk' >>/opt/splunk/etc/splunk-launch.conf
-fi
-chown splunk:splunk /opt/splunk/etc/splunk-launch.conf
 msg_ok "Created Splunk admin user"
 
 msg_info "Starting Service"
-$STD sudo -H -u splunk /opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt
-$STD sudo -H -u splunk /opt/splunk/bin/splunk stop --answer-yes --no-prompt
-$STD /opt/splunk/bin/splunk enable boot-start \
-    -systemd-managed 1 \
-    -user splunk \
-    -group splunk \
-    --accept-license \
-    --answer-yes \
-    --no-prompt
-chown -R splunk:splunk /opt/splunk
-$STD systemctl daemon-reload
-$STD systemctl enable --now Splunkd
+$STD sudo -u splunk /opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt
+$STD /opt/splunk/bin/splunk enable boot-start -user splunk
 msg_ok "Started Service"
 
 motd_ssh

install/stirling-pdf-install.sh

@@ -34,8 +34,7 @@ msg_ok "Installed Dependencies"
 PYTHON_VERSION="3.12" setup_uv
 JAVA_VERSION="25" setup_java
 
-response="${var_stirling_pdf_login:-}"
-if [[ -z "$response" ]] && ! read -r -p "${TAB3}Do you want to use Stirling-PDF with Login? (no/n = without Login) [Y/n] " response; then
+if ! read -r -p "${TAB3}Do you want to use Stirling-PDF with Login? (no/n = without Login) [Y/n] " response; then
   # No interactive stdin (EOF): fall back to the no-login install instead of
   # silently selecting login, which the -z test below would otherwise do.
   response="n"

install/tracearr-install.sh

@@ -68,7 +68,7 @@ $STD pnpm install --frozen-lockfile --force
 $STD pnpm turbo telemetry disable
 $STD pnpm turbo run build --no-daemon --filter=@tracearr/shared --filter=@tracearr/server --filter=@tracearr/web
 $STD ./scripts/fetch-basemap.sh || msg_warn "Basemap download failed, the map will show without base tiles"
-mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db,assets}
+mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db}
 cp -rf package.json /opt/tracearr/
 cp -rf pnpm-workspace.yaml /opt/tracearr/
 cp -rf pnpm-lock.yaml /opt/tracearr/
@@ -81,12 +81,11 @@ cp -rf packages/shared/dist /opt/tracearr/packages/shared/dist
 cp -rf packages/emails/package.json /opt/tracearr/packages/emails/
 cp -rf packages/emails/dist /opt/tracearr/packages/emails/dist
 cp -rf apps/server/src/db/migrations /opt/tracearr/apps/server/src/db/migrations
-cp -f assets/logo.png /opt/tracearr/assets/
 cp -rf data /opt/tracearr/data
 mkdir -p /opt/tracearr/data/image-cache
 rm -rf /opt/tracearr.build
 cd /opt/tracearr
-$STD pnpm install --prod --frozen-lockfile --ignore-scripts --filter @tracearr/server...
+$STD pnpm install --prod --frozen-lockfile --ignore-scripts
 msg_ok "Built Tracearr"
 
 msg_info "Configuring Tracearr"

install/traefik-install.sh

@@ -105,9 +105,8 @@ setup_alpine() {
   $STD apk add traefik --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community
   msg_ok "Installed Traefik"
 
-  enable_webui="${var_traefik_webui:-}"
-  [[ -n "$enable_webui" ]] || read -p "${TAB3}Enable Traefik WebUI (Port 8080)? [y/N]: " enable_webui
-  if [[ "${enable_webui,,}" =~ ^(y|yes)$ ]]; then
+  read -p "${TAB3}Enable Traefik WebUI (Port 8080)? [y/N]: " enable_webui
+  if [[ "$enable_webui" =~ ^[Yy]$ ]]; then
     msg_info "Configuring Traefik WebUI"
     sed -i 's/localhost//g' /etc/traefik/traefik.yaml
     msg_ok "Configured Traefik WebUI"

install/tubearchivist-install.sh

@@ -17,7 +17,6 @@ msg_info "Installing Dependencies"
 $STD apt install -y \
   build-essential \
   git \
-  nginx \
   redis-server \
   atomicparsley \
   python3-dev \
@@ -107,7 +106,7 @@ cat <<EOF >/opt/tubearchivist/.env
 TA_HOST=http://${LOCAL_IP}:8000
 TA_USERNAME=admin
 TA_PASSWORD=${TA_PASSWORD}
-TA_BACKEND_PORT=8080
+TA_PORT=8000
 TA_APP_DIR=/opt/tubearchivist/backend
 TA_CACHE_DIR=/cache
 TA_MEDIA_DIR=/youtube
@@ -133,92 +132,6 @@ msg_info "Installing yt-dlp Nightly"
 $STD uv pip install --python /opt/tubearchivist/.venv/bin/python -U --prerelease allow "yt-dlp[default]"
 msg_ok "Installed yt-dlp Nightly"
 
-msg_info "Configuring Nginx"
-sed -i 's/^user www-data;$/user root;/' /etc/nginx/nginx.conf
-cat <<'EOF' >/etc/nginx/sites-available/default
-server {
-    listen 8000;
-
-    location = /_auth {
-        internal;
-        proxy_pass http://localhost:8080/api/ping/;
-        proxy_pass_request_body off;
-        proxy_set_header Content-Length "";
-        proxy_set_header Host $http_host;
-        proxy_set_header Cookie $http_cookie;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    }
-
-    location /cache/videos/ {
-        auth_request /_auth;
-        alias /cache/videos/;
-    }
-
-    location /cache/channels/ {
-        auth_request /_auth;
-        alias /cache/channels/;
-    }
-
-    location /cache/playlists/ {
-        auth_request /_auth;
-        alias /cache/playlists/;
-    }
-
-    location /media/ {
-        auth_request /_auth;
-        alias /youtube/;
-        types {
-            text/vtt vtt;
-        }
-    }
-
-    location /youtube/ {
-        auth_request /_auth;
-        alias /youtube/;
-        types {
-            video/mp4 mp4;
-        }
-    }
-
-    location /api {
-        include proxy_params;
-        proxy_pass http://localhost:8080;
-    }
-
-    location /admin {
-        include proxy_params;
-        proxy_pass http://localhost:8080;
-    }
-
-    location /static/ {
-        alias /opt/tubearchivist/backend/staticfiles/;
-    }
-
-    root /opt/tubearchivist/backend/static;
-    index index.html;
-
-    location ~* ^/(?!static/|cache/).*\.(?:css|js|png|jpg|jpeg|gif|ico|svg|woff2?)$ {
-        try_files $uri $uri/ /index.html =404;
-    }
-
-    location = /index.html {
-        add_header Cache-Control "no-store, no-cache, must-revalidate";
-        add_header Pragma "no-cache";
-        expires 0;
-    }
-
-    location / {
-        add_header Cache-Control "no-store, no-cache, must-revalidate";
-        add_header Pragma "no-cache";
-        expires 0;
-        try_files $uri $uri/ /index.html =404;
-    }
-}
-EOF
-systemctl enable -q nginx
-systemctl restart nginx
-msg_ok "Configured Nginx"
-
 msg_info "Creating Services"
 cat <<'RUNEOF' >/opt/tubearchivist/backend/run.sh
 #!/bin/bash
@@ -237,6 +150,7 @@ for i in $(seq 1 30); do
   sleep 2
 done
 
+$PYTHON manage.py ta_stop_on_error
 $PYTHON manage.py migrate
 $PYTHON manage.py collectstatic --noinput -c
 $PYTHON manage.py ta_envcheck

install/valkey-install.sh

@@ -36,11 +36,9 @@ setup_deb_based() {
   msg_ok "Installed Valkey"
 
   echo
-  prompt="${var_valkey_tls:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Enable TLS for Valkey (Sentinel mode does not supported)? [y/N]: " prompt
+  read -r -p "${TAB3}Enable TLS for Valkey (Sentinel mode does not supported)? [y/N]: " prompt
   if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
-      tls_only="${var_valkey_tls_only:-}"
-      [[ -n "$tls_only" ]] || read -r -p "${TAB3}Use TLS-only mode (disable TCP port 6379)? [y/N]: " tls_only
+      read -r -p "${TAB3}Use TLS-only mode (disable TCP port 6379)? [y/N]: " tls_only
       msg_info "Configuring TLS for Valkey..."
 
       create_self_signed_cert "Valkey"

install/versitygw-install.sh

@@ -16,8 +16,7 @@ update_os
 fetch_and_deploy_gh_release "versitygw" "versity/versitygw" "binary"
 
 WEBUI_CONF=""
-webui_prompt="${var_versitygw_webgui:-}"
-[[ -n "$webui_prompt" ]] || read -rp "Would you like to enable the VersityGW WebGUI (Beta)? (y/N): " webui_prompt
+read -rp "Would you like to enable the VersityGW WebGUI (Beta)? (y/N): " webui_prompt
 if [[ "${webui_prompt,,}" =~ ^(y|yes)$ ]]; then
   WEBUI_CONF="\nVGW_WEBUI_PORT=:7071\nVGW_WEBUI_NO_TLS=true"
   msg_ok "WebGUI will be enabled on port 7071"

install/victoriametrics-install.sh

@@ -27,8 +27,7 @@ msg_ok "Got version $victoriametrics_release of VictoriaMetrics"
 fetch_and_deploy_gh_release "victoriametrics" "VictoriaMetrics/VictoriaMetrics" "prebuild" "$victoriametrics_release" "/opt/victoriametrics" "$victoriametrics_filename"
 fetch_and_deploy_gh_release "vmutils" "VictoriaMetrics/VictoriaMetrics" "prebuild" "$victoriametrics_release" "/opt/victoriametrics" "$vmutils_filename"
 
-prompt="${var_victoriametrics_logs:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add VictoriaLogs? <y/N> " prompt
+read -r -p "${TAB3}Would you like to add VictoriaLogs? <y/N> " prompt
 
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   vl_release_json="$(mktemp)"

install/wanderer-install.sh

@@ -54,16 +54,6 @@ PB_DB_LOCATION=/opt/wanderer_data/pb_data
 MEILI_DB_PATH=/opt/wanderer_data/meili_data
 EOF
 
-cat <<'EOF' >/usr/local/bin/wanderer-pb
-#!/usr/bin/env bash
-set -a
-source /opt/wanderer/.env
-set +a
-cd /opt/wanderer/db
-exec ./pocketbase "$@" --dir="$PB_DB_LOCATION"
-EOF
-chmod +x /usr/local/bin/wanderer-pb
-
 cat <<EOF >/etc/systemd/system/wanderer-pocketbase.service
 [Unit]
 Description=wanderer PocketBase

install/watchstate-install.sh

@@ -1,99 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/arabcoders/watchstate
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  nginx \
-  redis-server \
-  ripgrep \
-  sqlite3
-msg_ok "Installed Dependencies"
-
-PHP_VERSION="8.5" PHP_FPM="YES" setup_php
-setup_composer
-setup_ffmpeg
-NODE_VERSION="24" NODE_MODULE="bun" setup_nodejs
-fetch_and_deploy_gh_release "watchstate" "arabcoders/watchstate" "tarball" "latest" "/opt/watchstate" "" "v"
-
-msg_info "Building WatchState"
-cd /opt/watchstate
-sed -i "s/'version' => 'dev-master'/'version' => 'v$(cat ~/.watchstate)'/" config/config.php
-$STD composer install --no-dev --optimize-autoloader --no-interaction
-cd /opt/watchstate/frontend
-$STD bun install --frozen-lockfile --production
-NODE_ENV=production $STD bun run generate
-mv /opt/watchstate/frontend/exported /opt/watchstate/public/exported
-rm -rf /opt/watchstate/frontend/node_modules /opt/watchstate/frontend/.nuxt
-msg_ok "Built WatchState"
-
-msg_info "Configuring WatchState"
-# loaded first by CLI, worker and php-fpm alike; the default data dir is /opt/watchstate/var, which every update wipes
-cat <<EOF >/opt/watchstate/.env
-WS_DATA_PATH=/opt/watchstate_data
-EOF
-$STD php /opt/watchstate/bin/console db:migrate --execute
-$STD php /opt/watchstate/bin/console system:apikey
-chown -R www-data:www-data /opt/watchstate_data
-msg_ok "Configured WatchState"
-
-msg_info "Configuring Nginx"
-PHP_SOCK=$(get_php_fpm_socket)
-cat <<EOF >/etc/nginx/sites-available/watchstate
-server {
-    listen 8080;
-    server_name _;
-    root /opt/watchstate/public;
-    index index.php;
-    client_max_body_size 100M;
-
-    location / {
-        try_files \$uri /index.php\$is_args\$args;
-    }
-
-    location ~ \.php\$ {
-        fastcgi_pass unix:${PHP_SOCK};
-        fastcgi_param SCRIPT_FILENAME \$realpath_root\$fastcgi_script_name;
-        include fastcgi_params;
-        fastcgi_read_timeout 600;
-    }
-}
-EOF
-nginx_enable_site "watchstate"
-msg_ok "Configured Nginx"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/watchstate-worker.service
-[Unit]
-Description=WatchState Worker
-After=network.target redis-server.service
-
-[Service]
-Type=simple
-User=www-data
-Group=www-data
-WorkingDirectory=/opt/watchstate
-ExecStart=/usr/bin/php /opt/watchstate/bin/console system:worker -v
-Restart=always
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now watchstate-worker
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc

install/wazuh-install.sh

@@ -15,7 +15,16 @@ update_os
 
 RELEASE=$(get_latest_github_release "wazuh/wazuh" | cut -d. -f1,2)
 
-confirm_external_installer "https://wazuh.com/" "https://packages.wazuh.com/$RELEASE/wazuh-install.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://wazuh.com/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://packages.wazuh.com/$RELEASE/wazuh-install.sh "
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 
 msg_info "Setup Wazuh"
 curl -fsSL https://packages.wazuh.com/$RELEASE/wazuh-install.sh -o wazuh-install.sh

install/wikijs-install.sh

@@ -20,7 +20,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="26" NODE_MODULE="yarn,node-gyp" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="wiki" PG_DB_USER="wikijs_user" PG_DB_EXTENSIONS="pg_trgm" setup_postgresql_db
-fetch_and_deploy_gh_release "wikijs" "requarks/wiki-v2" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
+fetch_and_deploy_gh_release "wikijs" "requarks/wiki" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
 
 msg_info "Configuring Wiki.js"
 mv /opt/wikijs/config.sample.yml /opt/wikijs/config.yml

install/wireguard-install.sh

@@ -24,8 +24,7 @@ setup_deb_based() {
   $STD netfilter-persistent reload
   msg_ok "Installed WireGuard"
 
-  prompt="${var_wireguard_wgdashboard:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add WGDashboard? <y/N> " prompt
+  read -r -p "${TAB3}Would you like to add WGDashboard? <y/N> " prompt
   if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
     git clone -q https://github.com/WGDashboard/WGDashboard.git /etc/wgdashboard
 
@@ -110,9 +109,8 @@ EOF
   $STD sysctl -p /etc/sysctl.conf
   msg_ok "Installed WireGuard"
 
-  INSTALL_WGD="${var_wireguard_wgdashboard:-}"
-  [[ -n "$INSTALL_WGD" ]] || read -rp "${TAB3}Do you want to install WGDashboard? (y/N): " INSTALL_WGD
-  if [[ "${INSTALL_WGD,,}" =~ ^(y|yes)$ ]]; then
+  read -rp "${TAB3}Do you want to install WGDashboard? (y/N): " INSTALL_WGD
+  if [[ "$INSTALL_WGD" =~ ^[Yy]$ ]]; then
     msg_info "Installing additional dependencies for WGDashboard"
     $STD apk add --no-cache \
       python3 \

install/yunohost-install.sh

@@ -20,7 +20,16 @@ $STD apt install -y \
   ca-certificates
 msg_ok "Installed Dependencies"
 
-confirm_external_installer "https://yunohost.org/" "https://install.yunohost.org"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://yunohost.org/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://install.yunohost.org"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 
 msg_info "Installing YunoHost (Patience)"
 touch /etc/.pve-ignore.resolv.conf

install/zerotier-one-install.sh

@@ -13,7 +13,16 @@ setting_up_container
 network_check
 update_os
 
-confirm_external_installer "https://install.zerotier.com" "https://install.zerotier.com"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://install.zerotier.com)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://install.zerotier.com"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! $CONFIRM =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 
 msg_info "Setting up Zerotier-One"
 curl -fsSL https://raw.githubusercontent.com/zerotier/ZeroTierOne/main/doc/contact%40zerotier.com.gpg | gpg --import >/dev/null 2>&1

tools/addon/immich-public-proxy.sh

@@ -33,9 +33,7 @@ APP_TYPE="addon"
 INSTALL_PATH="/opt/immich-proxy"
 CONFIG_PATH="/opt/immich-proxy/app"
 SERVICE_PATH="/etc/systemd/system/immich-proxy.service"
-UPLOAD_SERVICE_PATH="/etc/systemd/system/immich-proxy-upload.service"
 DEFAULT_PORT=3000
-UPLOAD_PORT=3001
 
 # Initialize all core functions (colors, formatting, icons, $STD mode)
 load_functions
@@ -46,8 +44,8 @@ require_debian_like
 # ==============================================================================
 function uninstall() {
   msg_info "Uninstalling ${APP}"
-  systemctl disable --now immich-proxy.service immich-proxy-upload.service &>/dev/null || true
-  rm -f "$SERVICE_PATH" "$UPLOAD_SERVICE_PATH"
+  systemctl disable --now immich-proxy.service &>/dev/null || true
+  rm -f "$SERVICE_PATH"
   rm -rf "$INSTALL_PATH"
   rm -f "/usr/local/bin/update_immich-public-proxy"
   rm -f "$HOME/.immichpublicproxy"
@@ -60,33 +58,32 @@ function uninstall() {
 function update() {
   if check_for_gh_release "Immich Public Proxy" "alangrainger/immich-public-proxy"; then
     msg_info "Stopping service"
-    systemctl stop immich-proxy.service immich-proxy-upload.service &>/dev/null || true
+    systemctl stop immich-proxy.service &>/dev/null || true
     msg_ok "Stopped service"
 
     BACKUP_DIR="/opt/immich-public-proxy_backup"
     create_backup "$CONFIG_PATH"/.env "$CONFIG_PATH"/config.json
-    if [[ -f "$UPLOAD_SERVICE_PATH" ]]; then
-      create_backup "$INSTALL_PATH"/upload-app/config.json
-    fi
 
     NODE_VERSION="24" setup_nodejs
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Immich Public Proxy" "alangrainger/immich-public-proxy" "tarball" "latest" "$INSTALL_PATH"
 
     restore_backup
-    build_app
+
+    msg_info "Installing dependencies"
+    cd "$CONFIG_PATH"
+    $STD npm ci
+    msg_ok "Installed dependencies"
+
+    msg_info "Building ${APP}"
+    $STD npm run build
+    msg_ok "Built ${APP}"
 
     msg_info "Updating service"
     create_service
-    if [[ -f "$UPLOAD_SERVICE_PATH" ]]; then
-      create_upload_service
-    fi
     msg_ok "Updated service"
 
     msg_info "Starting service"
     systemctl start immich-proxy
-    if [[ -f "$UPLOAD_SERVICE_PATH" ]]; then
-      systemctl start immich-proxy-upload
-    fi
     msg_ok "Started service"
     msg_ok "Updated successfully"
     exit
@@ -114,55 +111,6 @@ EOF
   systemctl daemon-reload
 }
 
-# The workspace root builds shared, app and upload-app together
-function build_app() {
-  msg_info "Installing dependencies"
-  cd "$INSTALL_PATH"
-  $STD npm ci
-  msg_ok "Installed dependencies"
-
-  msg_info "Building ${APP}"
-  $STD npm run build
-  msg_ok "Built ${APP}"
-}
-
-# env sets the port after EnvironmentFile, so an IPP_PORT in .env cannot clash with IPP
-function create_upload_service() {
-  cat <<EOF >"$UPLOAD_SERVICE_PATH"
-[Unit]
-Description=Immich Public Proxy visitor uploads
-After=network.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=${INSTALL_PATH}/upload-app
-EnvironmentFile=${CONFIG_PATH}/.env
-ExecStart=/usr/bin/env IPP_PORT=${UPLOAD_PORT} /usr/bin/node ${INSTALL_PATH}/upload-app/dist/index.js
-Restart=always
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target
-EOF
-  systemctl daemon-reload
-}
-
-function enable_uploads() {
-  if [[ ! -d "$INSTALL_PATH"/upload-app ]]; then
-    msg_error "Visitor uploads need ${APP} 4.0 or newer. Update first."
-    exit 1
-  fi
-  if [[ ! -f "$INSTALL_PATH"/upload-app/dist/index.js ]]; then
-    build_app
-  fi
-  msg_info "Enabling visitor uploads"
-  create_upload_service
-  systemctl enable -q --now immich-proxy-upload
-  msg_ok "Enabled visitor uploads on port ${UPLOAD_PORT}"
-  msg_warn "Route /upload/* on your reverse proxy to http://${LOCAL_IP}:${UPLOAD_PORT} and turn on 'Allow public user to upload' for the share in Immich"
-}
-
 # ==============================================================================
 # INSTALL
 # ==============================================================================
@@ -172,7 +120,15 @@ function install() {
   # Force fresh download by removing version cache
   rm -f "$HOME/.immichpublicproxy"
   fetch_and_deploy_gh_release "Immich Public Proxy" "alangrainger/immich-public-proxy" "tarball" "latest" "$INSTALL_PATH"
-  build_app
+
+  msg_info "Installing dependencies"
+  cd "$CONFIG_PATH"
+  $STD npm ci
+  msg_ok "Installed dependencies"
+
+  msg_info "Building ${APP}"
+  $STD npm run build
+  msg_ok "Built ${APP}"
 
   MAX_ATTEMPTS=3
   attempt=0
@@ -220,12 +176,6 @@ EOF
   systemctl enable -q --now immich-proxy
   msg_ok "Created and started service"
 
-  prompt="${var_ipp_uploads:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Enable visitor uploads (second service on port ${UPLOAD_PORT})? <y/N> " prompt
-  if [[ "${prompt,,}" =~ ^(y|yes|true)$ ]]; then
-    enable_uploads
-  fi
-
   # Create update script (simple wrapper that calls this addon with type=update)
   msg_info "Creating update script"
   cat <<'UPDATEEOF' >/usr/local/bin/update_immich-public-proxy
@@ -280,15 +230,6 @@ if [[ -d "$INSTALL_PATH" && -f "$SERVICE_PATH" ]]; then
     exit 0
   fi
 
-  if [[ ! -f "$UPLOAD_SERVICE_PATH" ]]; then
-    echo -n "${TAB}Enable visitor uploads (second service on port ${UPLOAD_PORT})? (y/N): "
-    read -r upload_prompt
-    if [[ "${upload_prompt,,}" =~ ^(y|yes)$ ]]; then
-      enable_uploads
-      exit 0
-    fi
-  fi
-
   msg_warn "No action selected. Exiting."
   exit 0
 fi