Immich Public Proxy: optional visitor upload service

IPP 4.0 lets visitors upload through a second, optional app in the same
repository. The addon now builds the whole workspace, so upload-app is
always ready, and can run it as immich-proxy-upload on port 3001: asked
on install (var_ipp_uploads), offered in the menu of an existing
install, rebuilt and restarted on update with its config.json kept, and
removed on uninstall. It stays off unless chosen.

CHANGELOG.md

@@ -562,31 +562,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
-## 2026-10-12
-
-### 🆕 New Scripts
-
-  - WatchState ([#17881](https://github.com/community-scripts/ProxmoxVE/pull/17881))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Wanderer: bring back the wanderer-pb wrapper [@MickLesk](https://github.com/MickLesk) ([#17874](https://github.com/community-scripts/ProxmoxVE/pull/17874))
-    - Tracearr: install only the server's production dependencies [@MickLesk](https://github.com/MickLesk) ([#17873](https://github.com/community-scripts/ProxmoxVE/pull/17873))
-    - Paperless-ngx: QoL restart crashed services | patch regex [@MickLesk](https://github.com/MickLesk) ([#17812](https://github.com/community-scripts/ProxmoxVE/pull/17812))
-    - Splunk Enterprise: start the service as the splunk user [@rcastley](https://github.com/rcastley) ([#17816](https://github.com/community-scripts/ProxmoxVE/pull/17816))
-
-### 💾 Core
-
-  - gh: curl_download: wait between attempts [@MickLesk](https://github.com/MickLesk) ([core#131](https://github.com/community-scripts/core/pull/131))
-
-### 🧰 Tools
-
-  - #### ✨ New Features
-
-    - Immich Public Proxy: optional visitor upload service (v4 Release) [@MickLesk](https://github.com/MickLesk) ([#17875](https://github.com/community-scripts/ProxmoxVE/pull/17875))
-
 ## 2026-10-11
 
 ### 🆕 New Scripts

ct/paperless-ngx.sh

@@ -157,6 +157,8 @@ function update_script() {
             sed -i '$a\PAPERLESS_ARCHIVE_FILE_GENERATION=never' "$PAPERLESS_CONF"
           fi
         fi
+        [[ -n "$(sed -n '/^PAPERLESS_CONSUMER_IGNORE_PATTERNS=/p' "$PAPERLESS_CONF")" ]] &&
+          msg_warn "PAPERLESS_CONSUMER_IGNORE_PATTERNS now uses regex patterns; please verify custom values."
         [[ -n "$(sed -n '/^PAPERLESS_PRE_CONSUME_SCRIPT=/p;/^PAPERLESS_POST_CONSUME_SCRIPT=/p' "$PAPERLESS_CONF")" ]] &&
           msg_warn "Pre/post consume scripts no longer receive positional arguments in v3; please verify custom scripts."
         msg_ok "Migrated Paperless-ngx configuration"
@@ -170,9 +172,7 @@ function update_script() {
       fi
       for svc in consumer scheduler task-queue webserver; do
         unit="/etc/systemd/system/paperless-${svc}.service"
-        [[ -f "$unit" ]] || continue
-        sed -i 's|uv run -- |uv run --no-sync -- |g' "$unit"
-        grep -q '^Restart=' "$unit" || sed -i '/^\[Service\]/a Restart=on-failure\nRestartSec=5' "$unit"
+        [[ -f "$unit" ]] && sed -i 's|uv run -- |uv run --no-sync -- |g' "$unit"
       done
       $STD systemctl daemon-reload
       cd /opt/paperless
@@ -181,34 +181,6 @@ function update_script() {
       $STD uv run -- python manage.py migrate
       msg_ok "Updated Paperless-ngx"
 
-      if ((BRIDGE_UPDATE == 0)); then
-        IGNORE_FIXED="$(
-          /opt/paperless/.venv/bin/python - /opt/paperless/paperless.conf <<'EOF'
-import json, re, sys
-key = "PAPERLESS_CONSUMER_IGNORE_PATTERNS="
-lines = open(sys.argv[1]).read().splitlines(True)
-
-def is_glob(p):
-    if p.startswith("^") or p.endswith("$"):
-        return False
-    try:
-        return bool(re.search(p, "scan.pdf"))
-    except re.error:
-        return True
-
-for i, line in enumerate(lines):
-    if line.startswith(key):
-        patterns = json.loads(line[len(key):].strip().strip("'"))
-        fixed = ["^" + re.escape(p).replace(r"\*", ".*").replace(r"\?", ".") + "$" if is_glob(p) else p for p in patterns]
-        if fixed != patterns:
-            lines[i] = key + json.dumps(fixed) + "\n"
-            print(json.dumps(fixed))
-open(sys.argv[1], "w").writelines(lines)
-EOF
-        )" || IGNORE_FIXED=""
-        [[ -n "$IGNORE_FIXED" ]] && msg_warn "Converted glob PAPERLESS_CONSUMER_IGNORE_PATTERNS to regex (required since v3): ${IGNORE_FIXED}"
-      fi
-
       if ((BRIDGE_UPDATE == 0)) && [[ "$PAPERLESS_INSTALLED_VERSION" == "2.20.15" ]]; then
         $STD apt -y purge libzbar0t64 libzbar0 2>/dev/null || true
         $STD apt -y autoremove 2>/dev/null || true

ct/tracearr.sh

@@ -125,7 +125,7 @@ EOF
     $STD ./scripts/fetch-basemap.sh || msg_warn "Basemap download failed, keeping the existing map"
     [[ -d /opt/tracearr/data ]] && mv /opt/tracearr/data /opt/tracearr.data
     rm -rf /opt/tracearr
-    mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db,assets}
+    mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db}
     cp -rf package.json /opt/tracearr/
     cp -rf pnpm-workspace.yaml /opt/tracearr/
     cp -rf pnpm-lock.yaml /opt/tracearr/
@@ -138,14 +138,13 @@ EOF
     cp -rf packages/emails/package.json /opt/tracearr/packages/emails/
     cp -rf packages/emails/dist /opt/tracearr/packages/emails/dist
     cp -rf apps/server/src/db/migrations /opt/tracearr/apps/server/src/db/migrations
-    cp -f assets/logo.png /opt/tracearr/assets/
     [[ -d /opt/tracearr.data ]] && mv /opt/tracearr.data /opt/tracearr/data
     mkdir -p /opt/tracearr/data
     cp -rf data/. /opt/tracearr/data/
     mkdir -p /opt/tracearr/data/image-cache
     rm -rf /opt/tracearr.build
     cd /opt/tracearr
-    $STD pnpm install --prod --frozen-lockfile --ignore-scripts --filter @tracearr/server...
+    $STD pnpm install --prod --frozen-lockfile --ignore-scripts
     $STD chown -R tracearr:tracearr /opt/tracearr
     msg_ok "Built Tracearr"
 

ct/wanderer.sh

@@ -100,6 +100,7 @@ EOF
       -e "s|^MEILI_DB_PATH=.*|MEILI_DB_PATH=/opt/wanderer_data/meili_data|" \
       /opt/wanderer/.env
     sed -i "s|^db_path =.*|db_path = \"/opt/wanderer_data/meili_data\"|" /etc/meilisearch.toml
+    rm -f /usr/local/bin/wanderer-pb
 
     cat <<EOF >/etc/systemd/system/wanderer-pocketbase.service
 [Unit]
@@ -154,16 +155,6 @@ EOF
     msg_ok "Added POCKETBASE_PROXY_SECRET"
   fi
 
-  cat <<'EOF' >/usr/local/bin/wanderer-pb
-#!/usr/bin/env bash
-set -a
-source /opt/wanderer/.env
-set +a
-cd /opt/wanderer/db
-exec ./pocketbase "$@" --dir="$PB_DB_LOCATION"
-EOF
-  chmod +x /usr/local/bin/wanderer-pb
-
   if [[ -f /opt/wanderer_data/plugins/plugin.json ]]; then
     msg_info "Reinstalling wanderer plugins, one directory each"
     find /opt/wanderer_data/plugins -maxdepth 1 -type f -delete

ct/watchstate.sh

@@ -1,77 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/arabcoders/watchstate
-
-APP="WatchState"
-var_tags="${var_tags:-media;plex;jellyfin;emby}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-6}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/watchstate ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "watchstate" "arabcoders/watchstate" "" "" "v"; then
-    msg_info "Stopping WatchState"
-    systemctl stop watchstate-worker php8.5-fpm
-    msg_ok "Stopped WatchState"
-
-    create_backup /opt/watchstate/.env
-    setup_composer
-    NODE_VERSION="24" NODE_MODULE="bun" setup_nodejs
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "watchstate" "arabcoders/watchstate" "tarball" "latest" "/opt/watchstate" "" "v"
-    restore_backup
-
-    msg_info "Building WatchState"
-    cd /opt/watchstate
-    sed -i "s/'version' => 'dev-master'/'version' => 'v$(cat ~/.watchstate)'/" config/config.php
-    $STD composer install --no-dev --optimize-autoloader --no-interaction
-    cd /opt/watchstate/frontend
-    $STD bun install --frozen-lockfile --production
-    NODE_ENV=production $STD bun run generate
-    mv /opt/watchstate/frontend/exported /opt/watchstate/public/exported
-    rm -rf /opt/watchstate/frontend/node_modules /opt/watchstate/frontend/.nuxt
-    msg_ok "Built WatchState"
-
-    msg_info "Migrating WatchState Database"
-    $STD php /opt/watchstate/bin/console db:migrate --execute
-    $STD php /opt/watchstate/bin/console db:index
-    chown -R www-data:www-data /opt/watchstate_data
-    msg_ok "Migrated WatchState Database"
-
-    msg_info "Starting WatchState"
-    systemctl start php8.5-fpm watchstate-worker
-    msg_ok "Started WatchState"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"

install/paperless-ngx-install.sh

@@ -109,8 +109,6 @@ Requires=redis.service
 [Service]
 WorkingDirectory=/opt/paperless/src
 ExecStart=uv run --no-sync -- celery --app paperless beat --loglevel INFO
-Restart=on-failure
-RestartSec=5
 
 [Install]
 WantedBy=multi-user.target
@@ -125,8 +123,6 @@ After=postgresql.service
 [Service]
 WorkingDirectory=/opt/paperless/src
 ExecStart=uv run --no-sync -- celery --app paperless worker --loglevel INFO
-Restart=on-failure
-RestartSec=5
 
 [Install]
 WantedBy=multi-user.target
@@ -141,8 +137,6 @@ Requires=redis.service
 WorkingDirectory=/opt/paperless/src
 ExecStartPre=/bin/sleep 2
 ExecStart=uv run --no-sync -- python manage.py document_consumer
-Restart=on-failure
-RestartSec=5
 
 [Install]
 WantedBy=multi-user.target
@@ -159,8 +153,6 @@ Requires=redis.service
 WorkingDirectory=/opt/paperless/src
 #ExecStartPre=uv run --no-sync -- python manage.py document_index reindex --if-needed --no-progress-bar
 ExecStart=uv run --no-sync -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
-Restart=on-failure
-RestartSec=5
 Environment=GRANIAN_HOST=::
 Environment=GRANIAN_PORT=8000
 Environment=GRANIAN_WORKERS=1

install/splunk-enterprise-install.sh

@@ -51,8 +51,8 @@ $STD curl -fsSL -o "splunk-enterprise.tgz" "$DOWNLOAD_URL" || {
 }
 $STD tar -xzf "splunk-enterprise.tgz" -C /opt
 rm -f "splunk-enterprise.tgz"
-$STD addgroup --system splunk
-$STD adduser --system --home /opt/splunk --shell /bin/bash --ingroup splunk --no-create-home splunk
+addgroup --system splunk
+adduser --system --home /opt/splunk --shell /bin/bash --ingroup splunk --no-create-home splunk
 chown -R splunk:splunk /opt/splunk
 msg_ok "Setup Splunk Enterprise v${RELEASE}"
 
@@ -64,35 +64,17 @@ Splunk-Credentials
 Username: $ADMIN_USER
 Password: $ADMIN_PASS
 EOF
-chmod 600 ~/splunk.creds
 
-install -d -o splunk -g splunk -m 755 /opt/splunk/etc/system/local
-cat <<EOF >/opt/splunk/etc/system/local/user-seed.conf
+cat <<EOF >"/opt/splunk/etc/system/local/user-seed.conf"
 [user_info]
 USERNAME = $ADMIN_USER
 PASSWORD = $ADMIN_PASS
 EOF
-chown splunk:splunk /opt/splunk/etc/system/local/user-seed.conf
-chmod 600 /opt/splunk/etc/system/local/user-seed.conf
-if ! grep -q '^SPLUNK_OS_USER=' /opt/splunk/etc/splunk-launch.conf; then
-    echo 'SPLUNK_OS_USER=splunk' >>/opt/splunk/etc/splunk-launch.conf
-fi
-chown splunk:splunk /opt/splunk/etc/splunk-launch.conf
 msg_ok "Created Splunk admin user"
 
 msg_info "Starting Service"
-$STD sudo -H -u splunk /opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt
-$STD sudo -H -u splunk /opt/splunk/bin/splunk stop --answer-yes --no-prompt
-$STD /opt/splunk/bin/splunk enable boot-start \
-    -systemd-managed 1 \
-    -user splunk \
-    -group splunk \
-    --accept-license \
-    --answer-yes \
-    --no-prompt
-chown -R splunk:splunk /opt/splunk
-$STD systemctl daemon-reload
-$STD systemctl enable --now Splunkd
+$STD sudo -u splunk /opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt
+$STD /opt/splunk/bin/splunk enable boot-start -user splunk
 msg_ok "Started Service"
 
 motd_ssh

install/tracearr-install.sh

@@ -68,7 +68,7 @@ $STD pnpm install --frozen-lockfile --force
 $STD pnpm turbo telemetry disable
 $STD pnpm turbo run build --no-daemon --filter=@tracearr/shared --filter=@tracearr/server --filter=@tracearr/web
 $STD ./scripts/fetch-basemap.sh || msg_warn "Basemap download failed, the map will show without base tiles"
-mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db,assets}
+mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db}
 cp -rf package.json /opt/tracearr/
 cp -rf pnpm-workspace.yaml /opt/tracearr/
 cp -rf pnpm-lock.yaml /opt/tracearr/
@@ -81,12 +81,11 @@ cp -rf packages/shared/dist /opt/tracearr/packages/shared/dist
 cp -rf packages/emails/package.json /opt/tracearr/packages/emails/
 cp -rf packages/emails/dist /opt/tracearr/packages/emails/dist
 cp -rf apps/server/src/db/migrations /opt/tracearr/apps/server/src/db/migrations
-cp -f assets/logo.png /opt/tracearr/assets/
 cp -rf data /opt/tracearr/data
 mkdir -p /opt/tracearr/data/image-cache
 rm -rf /opt/tracearr.build
 cd /opt/tracearr
-$STD pnpm install --prod --frozen-lockfile --ignore-scripts --filter @tracearr/server...
+$STD pnpm install --prod --frozen-lockfile --ignore-scripts
 msg_ok "Built Tracearr"
 
 msg_info "Configuring Tracearr"

install/wanderer-install.sh

@@ -54,16 +54,6 @@ PB_DB_LOCATION=/opt/wanderer_data/pb_data
 MEILI_DB_PATH=/opt/wanderer_data/meili_data
 EOF
 
-cat <<'EOF' >/usr/local/bin/wanderer-pb
-#!/usr/bin/env bash
-set -a
-source /opt/wanderer/.env
-set +a
-cd /opt/wanderer/db
-exec ./pocketbase "$@" --dir="$PB_DB_LOCATION"
-EOF
-chmod +x /usr/local/bin/wanderer-pb
-
 cat <<EOF >/etc/systemd/system/wanderer-pocketbase.service
 [Unit]
 Description=wanderer PocketBase

install/watchstate-install.sh

@@ -1,99 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/arabcoders/watchstate
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  nginx \
-  redis-server \
-  ripgrep \
-  sqlite3
-msg_ok "Installed Dependencies"
-
-PHP_VERSION="8.5" PHP_FPM="YES" setup_php
-setup_composer
-setup_ffmpeg
-NODE_VERSION="24" NODE_MODULE="bun" setup_nodejs
-fetch_and_deploy_gh_release "watchstate" "arabcoders/watchstate" "tarball" "latest" "/opt/watchstate" "" "v"
-
-msg_info "Building WatchState"
-cd /opt/watchstate
-sed -i "s/'version' => 'dev-master'/'version' => 'v$(cat ~/.watchstate)'/" config/config.php
-$STD composer install --no-dev --optimize-autoloader --no-interaction
-cd /opt/watchstate/frontend
-$STD bun install --frozen-lockfile --production
-NODE_ENV=production $STD bun run generate
-mv /opt/watchstate/frontend/exported /opt/watchstate/public/exported
-rm -rf /opt/watchstate/frontend/node_modules /opt/watchstate/frontend/.nuxt
-msg_ok "Built WatchState"
-
-msg_info "Configuring WatchState"
-# loaded first by CLI, worker and php-fpm alike; the default data dir is /opt/watchstate/var, which every update wipes
-cat <<EOF >/opt/watchstate/.env
-WS_DATA_PATH=/opt/watchstate_data
-EOF
-$STD php /opt/watchstate/bin/console db:migrate --execute
-$STD php /opt/watchstate/bin/console system:apikey
-chown -R www-data:www-data /opt/watchstate_data
-msg_ok "Configured WatchState"
-
-msg_info "Configuring Nginx"
-PHP_SOCK=$(get_php_fpm_socket)
-cat <<EOF >/etc/nginx/sites-available/watchstate
-server {
-    listen 8080;
-    server_name _;
-    root /opt/watchstate/public;
-    index index.php;
-    client_max_body_size 100M;
-
-    location / {
-        try_files \$uri /index.php\$is_args\$args;
-    }
-
-    location ~ \.php\$ {
-        fastcgi_pass unix:${PHP_SOCK};
-        fastcgi_param SCRIPT_FILENAME \$realpath_root\$fastcgi_script_name;
-        include fastcgi_params;
-        fastcgi_read_timeout 600;
-    }
-}
-EOF
-nginx_enable_site "watchstate"
-msg_ok "Configured Nginx"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/watchstate-worker.service
-[Unit]
-Description=WatchState Worker
-After=network.target redis-server.service
-
-[Service]
-Type=simple
-User=www-data
-Group=www-data
-WorkingDirectory=/opt/watchstate
-ExecStart=/usr/bin/php /opt/watchstate/bin/console system:worker -v
-Restart=always
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now watchstate-worker
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc