Update CHANGELOG.md (#18038)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -571,9 +571,26 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - Plane: give Silo its own HOME [@MickLesk](https://github.com/MickLesk) ([#18028](https://github.com/community-scripts/ProxmoxVE/pull/18028))
+    - Immich: Pin version to 3.3.4 [@vhsdream](https://github.com/vhsdream) ([#18036](https://github.com/community-scripts/ProxmoxVE/pull/18036))
+    - InvenTree: run apt under systemd so postinst can finish [@MickLesk](https://github.com/MickLesk) ([#18029](https://github.com/community-scripts/ProxmoxVE/pull/18029))
+    - Profilarr: pass the deno pin as the version [@MickLesk](https://github.com/MickLesk) ([#18025](https://github.com/community-scripts/ProxmoxVE/pull/18025))
+    - Silo: keep the version file out of ~/.silo [@MickLesk](https://github.com/MickLesk) ([#18030](https://github.com/community-scripts/ProxmoxVE/pull/18030))
     - InvenTree: move to go.packager.io [@MickLesk](https://github.com/MickLesk) ([#18015](https://github.com/community-scripts/ProxmoxVE/pull/18015))
     - Zitadel: run init and setup in the foreground [@MickLesk](https://github.com/MickLesk) ([#18016](https://github.com/community-scripts/ProxmoxVE/pull/18016))
 
+  - #### ✨ New Features
+
+    - Zitadel: Support v1 and v2 Login [@MickLesk](https://github.com/MickLesk) ([#18031](https://github.com/community-scripts/ProxmoxVE/pull/18031))
+
+  - #### 🔧 Refactor
+
+    - Refactor: OpenWebUI (remove numba pin)  [@MickLesk](https://github.com/MickLesk) ([#18026](https://github.com/community-scripts/ProxmoxVE/pull/18026))
+
+### 💾 Core
+
+  - Only treat an NVIDIA GPU as present when its device nodes are [@MickLesk](https://github.com/MickLesk) ([core#153](https://github.com/community-scripts/core/pull/153))
+
 ## 2026-10-19
 
 ### 🆕 New Scripts

ct/immich.sh

@@ -77,7 +77,7 @@ EOF
   BASE_DIR=${STAGING_DIR}/base-images
   SOURCE_DIR=${STAGING_DIR}/image-source
   cd /tmp
-  RELEASE="v3.3.1"
+  RELEASE="v3.3.4"
   if [[ -f ~/.intel_version ]]; then
     INTEL_SRC="https://raw.githubusercontent.com/immich-app/immich/${RELEASE}/machine-learning"
     curl -fsSL "${INTEL_SRC}/scripts/install-intel-runtime.sh" -o ./intel-runtime 2>/dev/null ||

ct/openwebui.sh

@@ -49,10 +49,13 @@ function update_script() {
 
     msg_info "Installing uv-based Open-WebUI"
     PYTHON_VERSION="3.12" setup_uv
-    for attempt in $(seq 1 3); do
-      $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") open-webui[all] && break
-      [[ $attempt -lt 3 ]] && msg_warn "Open WebUI install attempt $attempt failed, retrying..." && sleep 10
+    installed=0
+    for attempt in 1 2; do
+      $STD uv tool install --python 3.12 open-webui[all] && { installed=1; break; }
+      msg_warn "Open WebUI install attempt $attempt failed, retrying..."
+      sleep 10
     done
+    ((installed)) || $STD uv tool install --python 3.12 open-webui[all]
     msg_ok "Installed uv-based Open-WebUI"
 
     msg_info "Restoring data"
@@ -125,10 +128,13 @@ EOF
       OTEL_ARGS+=(--with "$pkg")
     done < <(uv pip list --python "$OWUI_PYTHON" --format freeze 2>/dev/null | grep -i '^opentelemetry-' | cut -d= -f1)
   fi
-  for attempt in $(seq 1 3); do
-    $STD uv tool install --force --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] && break
-    [[ $attempt -lt 3 ]] && msg_warn "Open WebUI update attempt $attempt failed, retrying..." && sleep 10
+  updated=0
+  for attempt in 1 2; do
+    $STD uv tool install --force --python 3.12 "${OTEL_ARGS[@]}" open-webui[all] && { updated=1; break; }
+    msg_warn "Open WebUI update attempt $attempt failed, retrying..."
+    sleep 10
   done
+  ((updated)) || $STD uv tool install --force --python 3.12 "${OTEL_ARGS[@]}" open-webui[all]
   systemctl restart open-webui
   msg_ok "Updated Open WebUI"
   msg_ok "Updated successfully!"

ct/profilarr.sh

@@ -41,7 +41,7 @@ function update_script() {
   ARCH=$(uname -m)
 
   if check_for_gh_release "deno" "denoland/deno" "v2.7.5" "Deno is pinned to 2.7.5 because the known WouldBlock: Resource temporarily unavailable (os error 11) Issue"; then
-    fetch_and_deploy_gh_release "deno" "denoland/deno" "v2.7.5" "latest" "/usr/local/bin" "deno-${ARCH}-unknown-linux-gnu.zip"
+    fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "v2.7.5" "/usr/local/bin" "deno-${ARCH}-unknown-linux-gnu.zip"
   fi
 
   if check_for_gh_release "profilarr" "Dictionarry-Hub/profilarr"; then

ct/silo.sh

@@ -31,12 +31,13 @@ function update_script() {
     exit
   fi
 
-  if check_for_gh_release "silo" "pgsty/silo"; then
+  [[ -f ~/.silo ]] && mv ~/.silo ~/.silo_s3
+  if check_for_gh_release "silo_s3" "pgsty/silo"; then
     msg_info "Stopping Silo"
     systemctl stop silo
     msg_ok "Stopped Silo"
 
-    DPKG_FORCE_CONFOLD=1 fetch_and_deploy_gh_release "silo" "pgsty/silo" "binary"
+    DPKG_FORCE_CONFOLD=1 fetch_and_deploy_gh_release "silo_s3" "pgsty/silo" "binary"
 
     msg_info "Starting Silo"
     systemctl start silo

ct/zitadel.sh

@@ -2,7 +2,7 @@
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: dave-yap (dave-yap)
+# Author: dave-yap (dave-yap) | Co-Author: remz1337, MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://zitadel.com/ | Github: https://github.com/zitadel/zitadel
 
@@ -16,11 +16,23 @@ var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 
+if [[ -z "${var_zitadel_login:-}" ]] && command -v pveversion >/dev/null 2>&1; then
+  var_zitadel_login=$(msg_menu "Choose the Zitadel login UI" \
+    "v2" "Login V2, Zitadel's default (HTTPS, self-signed certificate)" \
+    "v1" "Login V1, the classic login built into the API (HTTP)")
+fi
+export var_zitadel_login="${var_zitadel_login:-v2}"
+
 header_info "$APP"
 variables
 color
 catch_errors
 
+if [[ ! "${var_zitadel_login}" =~ ^v[12]$ ]]; then
+  msg_error "var_zitadel_login must be v1 or v2"
+  exit 1
+fi
+
 function update_script() {
   header_info
   check_container_storage
@@ -31,20 +43,29 @@ function update_script() {
   fi
 
   if check_for_gh_release "zitadel" "zitadel/zitadel"; then
-    msg_info "Stopping Service"
+    msg_info "Stopping Zitadel"
+    if [[ -f /etc/systemd/system/zitadel-login.service ]]; then
+      systemctl stop zitadel-login
+    fi
     systemctl stop zitadel
-    msg_ok "Stopped Service"
+    msg_ok "Stopped Zitadel"
 
-    rm -f /usr/local/bin/zitadel
-    fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "latest" "/usr/local/bin" "zitadel-linux-$(arch_resolve).tar.gz"
+    fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "${CHECK_UPDATE_RELEASE}" "/usr/local/bin" "zitadel-linux-$(arch_resolve).tar.gz"
+    if [[ -f /etc/systemd/system/zitadel-login.service ]]; then
+      NODE_VERSION="24" setup_nodejs
+      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "zitadel-login" "zitadel/zitadel" "prebuild" "${CHECK_UPDATE_RELEASE}" "/opt/zitadel-login" "zitadel-login.tar.gz"
+    fi
 
-    msg_info "Updating Zitadel"
+    msg_info "Migrating Zitadel Database"
     $STD zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml --init-projections=true
-    msg_ok "Updated Zitadel"
+    msg_ok "Migrated Zitadel Database"
 
-    msg_info "Starting Service"
+    msg_info "Starting Zitadel"
     systemctl start zitadel
-    msg_ok "Started Service"
+    if [[ -f /etc/systemd/system/zitadel-login.service ]]; then
+      systemctl start zitadel-login
+    fi
+    msg_ok "Started Zitadel"
     msg_ok "Updated successfully!"
   fi
   exit
@@ -57,4 +78,9 @@ description
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8080/ui/console${CL}"
+if [[ "${var_zitadel_login}" == "v1" ]]; then
+  echo -e "${GATEWAY}${BGN}http://${IP}:8080/ui/console${CL}"
+else
+  echo -e "${GATEWAY}${BGN}https://${IP}:8080/ui/console${CL}"
+fi
+echo -e "${INFO}${YW}Admin credentials: ~/zitadel.creds (inside the container)${CL}"

install/immich-install.sh

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os
 
-RELEASE="v3.3.1"
+RELEASE="v3.3.4"
 if lscpu | grep -q 'GenuineIntel'; then
   echo ""
   echo ""

install/openwebui-install.sh

@@ -47,10 +47,13 @@ if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
 fi
 
 msg_info "Installing Open WebUI"
-for attempt in $(seq 1 3); do
-  $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] && break
-  [[ $attempt -lt 3 ]] && msg_warn "Open WebUI install attempt $attempt failed, retrying..." && sleep 10
+installed=0
+for attempt in 1 2; do
+  $STD uv tool install --python 3.12 "${OTEL_ARGS[@]}" open-webui[all] && { installed=1; break; }
+  msg_warn "Open WebUI install attempt $attempt failed, retrying..."
+  sleep 10
 done
+((installed)) || $STD uv tool install --python 3.12 "${OTEL_ARGS[@]}" open-webui[all]
 msg_ok "Installed Open WebUI"
 
 prompt="${var_openwebui_ollama:-}"

install/plane-install.sh

@@ -43,7 +43,7 @@ $STD rabbitmqctl add_user plane "${RABBITMQ_PASS}"
 $STD rabbitmqctl set_permissions -p plane plane ".*" ".*" ".*"
 msg_ok "Configured RabbitMQ"
 
-fetch_and_deploy_gh_release "silo" "pgsty/silo" "prebuild" "latest" "/opt/silo" "silo_*_linux_$(arch_resolve).tar.gz"
+fetch_and_deploy_gh_release "silo_s3" "pgsty/silo" "prebuild" "latest" "/opt/silo" "silo_*_linux_$(arch_resolve).tar.gz"
 fetch_and_deploy_gh_release "silo_mcli" "pgsty/mc" "prebuild" "latest" "/opt/mcli" "mcli_*_linux_$(arch_resolve).tar.gz"
 
 msg_info "Configuring Silo"

install/silo-install.sh

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os
 
-fetch_and_deploy_gh_release "silo" "pgsty/silo" "binary"
+fetch_and_deploy_gh_release "silo_s3" "pgsty/silo" "binary"
 
 msg_info "Configuring Silo"
 mkdir -p /opt/silo_data

install/zitadel-install.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: dave-yap
+# Author: dave-yap (dave-yap) | Co-Author: remz1337, MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://zitadel.com/ | Github: https://github.com/zitadel/zitadel
 
@@ -13,131 +13,174 @@ setting_up_container
 network_check
 update_os
 
-msg_info "Installing Dependencies (Patience)"
-$STD apt install -y ca-certificates
-msg_ok "Installed Dependecies"
+var_zitadel_login="${var_zitadel_login:-v2}"
 
 PG_VERSION="17" setup_postgresql
-
-msg_info "Installing Postgresql"
-DB_NAME="zitadel"
-DB_USER="zitadel"
-DB_PASS=$(random_password 13)
-DB_ADMIN_USER="root"
-DB_ADMIN_PASS=$(random_password 13)
-systemctl start postgresql
-$STD sudo -u postgres psql -c "CREATE USER $DB_USER WITH PASSWORD '$DB_PASS';"
-$STD sudo -u postgres psql -c "CREATE USER $DB_ADMIN_USER WITH PASSWORD '$DB_ADMIN_PASS' SUPERUSER;"
-$STD sudo -u postgres psql -c "CREATE DATABASE $DB_NAME OWNER $DB_ADMIN_USER;"
-cat <<EOF >~/zitadel.creds
-Application Credentials
-DB_NAME: $DB_NAME
-DB_USER: $DB_USER
-DB_PASS: $DB_PASS
-DB_ADMIN_USER: $DB_ADMIN_USER
-DB_ADMIN_PASS: $DB_ADMIN_PASS
-EOF
-msg_ok "Installed PostgreSQL"
-
+PG_DB_NAME="zitadel" PG_DB_USER="zitadel" setup_postgresql_db
 fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "latest" "/usr/local/bin" "zitadel-linux-$(arch_resolve).tar.gz"
 
-msg_info "Setting up Zitadel Environments"
+msg_info "Configuring Zitadel"
 mkdir -p /opt/zitadel
-echo "/opt/zitadel/config.yaml" >"/opt/zitadel/.config"
-random_password 32 >"/opt/zitadel/.masterkey"
-cat <<EOF >~/zitadel.creds
-Config location: $(cat "/opt/zitadel/.config")
-Masterkey: $(cat "/opt/zitadel/.masterkey")
-EOF
+random_password 32 >/opt/zitadel/.masterkey
+ADMIN_PASS="$(random_password 20)Aa1!"
 cat <<EOF >/opt/zitadel/config.yaml
-Port: 8080
+ExternalDomain: ${LOCAL_IP}
 ExternalPort: 8080
-ExternalDomain: localhost
-ExternalSecure: false
 TLS:
   Enabled: false
-  KeyPath: ""
-  Key: ""
-  CertPath: ""
-  Cert: ""
-
 Database:
   postgres:
     Host: localhost
     Port: 5432
-    Database: ${DB_NAME}
+    Database: zitadel
     User:
-      Username: ${DB_USER}
-      Password: ${DB_PASS}
+      Username: zitadel
+      Password: ${PG_DB_PASS}
       SSL:
         Mode: disable
-        RootCert: ""
-        Cert: ""
-        Key: ""
-    Admin:
-      Username: ${DB_ADMIN_USER}
-      Password: ${DB_ADMIN_PASS}
-      SSL:
-        Mode: disable
-        RootCert: ""
-        Cert: ""
-        Key: ""
+EOF
+if [[ "$var_zitadel_login" == "v1" ]]; then
+  cat <<EOF >>/opt/zitadel/config.yaml
+Port: 8080
+ExternalSecure: false
 DefaultInstance:
   Features:
     LoginV2:
       Required: false
+FirstInstance:
+  Org:
+    Human:
+      UserName: zitadel-admin@zitadel.localhost
+      Password: ${ADMIN_PASS}
+      PasswordChangeRequired: true
 EOF
-msg_ok "Installed Zitadel Enviroments"
+else
+  cat <<EOF >>/opt/zitadel/config.yaml
+Port: 8081
+ExternalSecure: true
+DefaultInstance:
+  Features:
+    LoginV2:
+      Required: true
+FirstInstance:
+  LoginClientPatPath: /opt/zitadel/login-client.pat
+  Org:
+    Human:
+      UserName: zitadel-admin@zitadel.localhost
+      Password: ${ADMIN_PASS}
+      PasswordChangeRequired: true
+    LoginClient:
+      Machine:
+        Username: login-client
+        Name: Automatically Initialized IAM_LOGIN_CLIENT
+      Pat:
+        ExpirationDate: 2099-01-01T00:00:00Z
+EOF
+fi
+chmod 600 /opt/zitadel/.masterkey /opt/zitadel/config.yaml
+msg_ok "Configured Zitadel"
 
-msg_info "Creating Services"
+msg_info "Initializing Zitadel"
+$STD zitadel init zitadel --config /opt/zitadel/config.yaml
+$STD zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml --steps /opt/zitadel/config.yaml
+cat <<EOF >>~/zitadel.creds
+
+Zitadel Admin
+Username: zitadel-admin@zitadel.localhost
+Initial Password: ${ADMIN_PASS}
+EOF
+chmod 600 ~/zitadel.creds
+msg_ok "Initialized Zitadel"
+
+msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/zitadel.service
 [Unit]
-Description=ZITADEL Identiy Server
+Description=Zitadel
 After=network.target postgresql.service
 Wants=postgresql.service
 
 [Service]
 Type=simple
-User=zitadel
-Group=zitadel
-ExecStart=/usr/local/bin/zitadel start --masterkeyFile "/opt/zitadel/.masterkey" --config "/opt/zitadel/config.yaml"
+ExecStart=/usr/local/bin/zitadel start --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml
 Restart=always
 RestartSec=5
-TimeoutStartSec=0
-
-# Security Hardening options
-ProtectSystem=full
-ProtectHome=true
-PrivateTmp=true
-NoNewPrivileges=true
 
 [Install]
 WantedBy=multi-user.target
 EOF
-systemctl enable -q zitadel
-msg_ok "Created Services"
+systemctl enable -q --now zitadel
+msg_ok "Created Service"
 
-msg_info "Zitadel initial setup"
-$STD zitadel init --config /opt/zitadel/config.yaml
-$STD zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml
-useradd zitadel
-msg_ok "Zitadel initialized"
+if [[ "$var_zitadel_login" != "v1" ]]; then
+  NODE_VERSION="24" setup_nodejs
+  fetch_and_deploy_gh_release "zitadel-login" "zitadel/zitadel" "prebuild" "latest" "/opt/zitadel-login" "zitadel-login.tar.gz"
 
-msg_info "Set ExternalDomain to current IP and restart Zitadel"
-IP=$(ip a s dev eth0 | awk '/inet / {print $2}' | cut -d/ -f1)
-sed -i "0,/localhost/s/localhost/${IP}/" /opt/zitadel/config.yaml
-systemctl stop -q zitadel
-$STD zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml
-systemctl restart -q zitadel
-msg_ok "Zitadel restarted with ExternalDomain set to current IP"
-
-msg_info "Create zitadel-rerun.sh"
-cat <<EOF >~/zitadel-rerun.sh
-systemctl stop zitadel
-timeout --kill-after=5s 15s zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml
-systemctl restart zitadel
+  msg_info "Setting up Zitadel Login"
+  $STD apt install -y nginx
+  create_self_signed_cert "zitadel"
+  cat <<EOF >/opt/zitadel/login.env
+ZITADEL_API_URL=http://127.0.0.1:8081
+ZITADEL_API_AWAITINITIALCONN=5m
+ZITADEL_SERVICE_USER_TOKEN_FILE=/opt/zitadel/login-client.pat
+ZITADEL_SESSION_COOKIE_SECRET=$(random_password 48)
+NEXT_PUBLIC_BASE_PATH=/ui/v2/login
+HOSTNAME=127.0.0.1
+PORT=3000
 EOF
-msg_ok "Bash script for rerunning Zitadel after changing Zitadel config.yaml"
+  chmod 600 /opt/zitadel/login.env /opt/zitadel/login-client.pat
+  cat <<EOF >/etc/systemd/system/zitadel-login.service
+[Unit]
+Description=Zitadel Login
+After=network.target zitadel.service
+Wants=zitadel.service
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/zitadel-login
+EnvironmentFile=/opt/zitadel/login.env
+ExecStart=/opt/zitadel-login/entrypoint.sh node apps/login/server.js
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+  systemctl enable -q --now zitadel-login
+  cat <<'EOF' >/etc/nginx/sites-available/zitadel
+server {
+    listen 8080 ssl;
+    http2 on;
+    server_name _;
+    ssl_certificate /etc/ssl/zitadel/zitadel.crt;
+    ssl_certificate_key /etc/ssl/zitadel/zitadel.key;
+    error_page 497 =301 https://$http_host$request_uri;
+
+    location = / {
+        return 302 /ui/v2/login/;
+    }
+
+    location /ui/v2/login {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /api/ {
+        rewrite ^/api(/.*)$ $1 break;
+        grpc_pass grpc://127.0.0.1:8081;
+        grpc_set_header Host $http_host;
+    }
+
+    location / {
+        grpc_pass grpc://127.0.0.1:8081;
+        grpc_set_header Host $http_host;
+    }
+}
+EOF
+  nginx_enable_site "zitadel"
+  msg_ok "Set up Zitadel Login"
+fi
 
 motd_ssh
 customize