Warn when host CA inheritance is disabled

Changes the log level from info to warning when host CA inheritance is skipped by configuration, and includes the number of host certificates detected. This makes intentional skips more visible while still showing useful context.
Add host CA inheritance for container builds
2026-07-20 21:33:45 +03:00 · 2026-07-19 10:00:29 +02:00 · 2026-07-19 09:57:17 +02:00
25 changed files with 658 additions and 444 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -505,60 +505,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

-## 2026-07-20
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - RomM: use backup helpers in update / clear folder [@MickLesk](https://github.com/MickLesk) ([#15915](https://github.com/community-scripts/ProxmoxVE/pull/15915))
-    - fix: vikunja: asset selection [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15929](https://github.com/community-scripts/ProxmoxVE/pull/15929))
-    - Zammad : bind Elasticsearch to 127.0.0.1 [@MickLesk](https://github.com/MickLesk) ([#15909](https://github.com/community-scripts/ProxmoxVE/pull/15909))
-    - Omada: fix package version extraction [@MickLesk](https://github.com/MickLesk) ([#15908](https://github.com/community-scripts/ProxmoxVE/pull/15908))
-    - fix(wanderer): use PocketBase-relative plugin symlink in unprivileged LXC [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15911](https://github.com/community-scripts/ProxmoxVE/pull/15911))
-
-  - #### ✨ New Features
-
-    - AFFiNE: Bump version to v0.27.2 [@MickLesk](https://github.com/MickLesk) ([#15930](https://github.com/community-scripts/ProxmoxVE/pull/15930))
-
-  - #### 💥 Breaking Changes
-
-    - Gotify: Migration to v3 [@MickLesk](https://github.com/MickLesk) ([#15912](https://github.com/community-scripts/ProxmoxVE/pull/15912))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - tools.func: add support for extracting 7z archives [@MickLesk](https://github.com/MickLesk) ([#15919](https://github.com/community-scripts/ProxmoxVE/pull/15919))
-    - Meilisearch : use dumpless Meilisearch upgrades [@MickLesk](https://github.com/MickLesk) ([#15921](https://github.com/community-scripts/ProxmoxVE/pull/15921))
-
-  - #### 🔧 Refactor
-
-    - core: Improve GPU detection and mapping logic [@MickLesk](https://github.com/MickLesk) ([#15918](https://github.com/community-scripts/ProxmoxVE/pull/15918))
-
 ## 2026-07-19

-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - change trek repo to liketrek/TREK [@asylumexp](https://github.com/asylumexp) ([#15893](https://github.com/community-scripts/ProxmoxVE/pull/15893))
-    - update authentik to 2026.5.5 [@thieneret](https://github.com/thieneret) ([#15855](https://github.com/community-scripts/ProxmoxVE/pull/15855))
-    - [FIX] BookOrbit: add missing `restore_backup` during update [@vhsdream](https://github.com/vhsdream) ([#15881](https://github.com/community-scripts/ProxmoxVE/pull/15881))
-
-  - #### ✨ New Features
-
-    - tools.func: centralize deploy tail + trap-based tmpdir cleanup [@MickLesk](https://github.com/MickLesk) ([#15872](https://github.com/community-scripts/ProxmoxVE/pull/15872))
-    - Update OPNsense from 26.1 to 26.7 [@tdn131](https://github.com/tdn131) ([#15895](https://github.com/community-scripts/ProxmoxVE/pull/15895))
-
 ### 💾 Core

  - Revert "core: add configurable host CA inheritance during bootstrap" [@MickLesk](https://github.com/MickLesk) ([#15886](https://github.com/community-scripts/ProxmoxVE/pull/15886))

-  - #### 🐞 Bug Fixes
-
-    - fix(build.func): expand glob in SSH key "Scan Folder/Glob" so it can find keys [@TowyTowy](https://github.com/TowyTowy) ([#15873](https://github.com/community-scripts/ProxmoxVE/pull/15873))
-
 ## 2026-07-18

 ### 💾 Core
--- a/ct/affine.sh
+++ b/ct/affine.sh
@@ -30,7 +30,7 @@ function update_script() {
    exit
  fi

-  RELEASE="v0.27.2"
+  RELEASE="v0.27.0"
  if check_for_gh_release "affine_app" "toeverything/AFFiNE" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
    msg_info "Stopping Services"
    systemctl stop affine-web affine-worker
@@ -38,19 +38,10 @@ function update_script() {

    ensure_dependencies cmake

-    create_backup /opt/affine/.env /root/.affine/config /root/.affine/storage
+    create_backup /root/.affine/config /root/.affine/storage

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "${RELEASE}" "/opt/affine"

-    # Restore BEFORE the build: CLEAN_INSTALL wiped /opt/affine including .env,
-    # and the build below sources it
-    restore_backup
-
-    if [[ ! -f /opt/affine/.env ]]; then
-      msg_error "/opt/affine/.env is missing (lost by an earlier update). Recreate it before retrying — see the AFFiNE install script for the expected variables."
-      exit 1
-    fi
-
    msg_info "Rebuilding Application (Patience ~25 mins, don't close the console!)"
    cd /opt/affine
    source /root/.profile
@@ -120,6 +111,8 @@ TURBO
    set -a && source /opt/affine/.env && set +a
    $STD node ./scripts/self-host-predeploy.js

+    restore_backup
+
    msg_info "Starting Services"
    systemctl start affine-web affine-worker
    msg_ok "Started Services"
--- a/ct/authentik.sh
+++ b/ct/authentik.sh
@@ -38,14 +38,13 @@ function update_script() {

  NODE_VERSION="24" setup_nodejs
  setup_go
-  $STD uv cache clean
-  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
+  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
  RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
  setup_yq

-  AUTHENTIK_VERSION="version/2026.5.5"
+  AUTHENTIK_VERSION="version/2026.5.3"
  # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
-  XMLSEC_VERSION="1.3.12"
+  XMLSEC_VERSION="1.3.11"

  if check_for_gh_release "geoipupdate" "maxmind/geoipupdate"; then
    fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
--- a/ct/bookorbit.sh
+++ b/ct/bookorbit.sh
@@ -53,7 +53,6 @@ function update_script() {
    mkdir -p /opt/bookorbit/server/migrations
    cp -r /opt/bookorbit/server/src/db/migrations/. /opt/bookorbit/server/migrations/
    chmod +x /opt/bookorbit/server/bin/kepubify/*
-    restore_backup
    APP_VER=$(cat ~/.bookorbit)
    sed -i "s/^APP_VERSION=.*/APP_VERSION=v$APP_VER/" /opt/bookorbit/.env
    msg_ok "Rebuilt Application"
--- a/ct/gotify.sh
+++ b/ct/gotify.sh
@@ -36,30 +36,6 @@ function update_script() {
    fetch_and_deploy_gh_release "gotify" "gotify/server" "prebuild" "latest" "/opt/gotify" "gotify-linux-$(arch_resolve).zip"
    chmod +x /opt/gotify/gotify-linux-$(arch_resolve)

-    if [[ ! -f /opt/gotify/gotify-server.env ]]; then
-      gotify_old_config=""
-      for f in /opt/gotify/config.yml /etc/gotify/config.yml; do
-        [[ -f "$f" ]] && gotify_old_config="$f" && break
-      done
-      if [[ -n "$gotify_old_config" ]]; then
-        msg_info "Migrating ${gotify_old_config} to env format (Gotify 3.x)"
-        if /opt/gotify/gotify-linux-$(arch_resolve) migrate-config "$gotify_old_config" >/opt/gotify/gotify-server.env 2>/dev/null; then
-          mv "$gotify_old_config" "${gotify_old_config}.bak"
-          msg_ok "Migrated config to /opt/gotify/gotify-server.env (backup: ${gotify_old_config}.bak)"
-        else
-          rm -f /opt/gotify/gotify-server.env
-          msg_warn "Config migration failed — left ${gotify_old_config} in place, review manually"
-        fi
-      fi
-    fi
-
-    if ! grep -qE '^ExecStart=.* serve' /etc/systemd/system/gotify.service 2>/dev/null; then
-      msg_info "Migrating service to serve subcommand (Gotify 3.x)"
-      sed -i -E 's|^(ExecStart=/opt/gotify/.*gotify-linux-[^ ]+)$|\1 serve|' /etc/systemd/system/gotify.service
-      systemctl daemon-reload
-      msg_ok "Migrated service to serve subcommand"
-    fi
-
    msg_info "Starting Service"
    systemctl start gotify
    msg_ok "Started Service"
--- a/ct/nametag.sh
+++ b/ct/nametag.sh
@@ -42,9 +42,6 @@ function update_script() {

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/opt/nametag"

-    # Restore .env BEFORE the build: CLEAN_INSTALL wiped it and the build sources it
-    cp /opt/nametag.env.bak /opt/nametag/.env
-
    msg_info "Rebuilding Application"
    cd /opt/nametag
    $STD npm ci
--- a/ct/omada.sh
+++ b/ct/omada.sh
@@ -43,7 +43,7 @@ function update_script() {
    grep -o 'https://static\.tp-link\.com/upload/software/[^"]*linux_x64[^"]*\.deb' |
    head -n1)
  OMADA_PKG=$(basename "${OMADA_URL}")
-  VERSION=$(sed -n 's/.*_v\([0-9.]*\)_linux.*/\1/p' <<<"${OMADA_PKG}")
+  VERSION=$(sed -n 's/.*_v\([0-9.]*\)_.*_\([0-9]\{14\}\)\.deb$/\1-\2/p' <<<"${OMADA_PKG}")

  CURRENT_VERSION=$(cat $HOME/.omada 2>/dev/null || echo "0")

--- a/ct/postiz.sh
+++ b/ct/postiz.sh
@@ -41,12 +41,9 @@ function update_script() {

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "postiz" "gitroomhq/postiz-app" "tarball"

-    # Restore BEFORE the build: CLEAN_INSTALL wiped /opt/postiz including .env,
-    # and the build below sources it
-    restore_backup
-
    msg_info "Building Application"
    cd /opt/postiz
+    cp /opt/postiz_env.bak /opt/postiz/.env
    set -a && source /opt/postiz/.env && set +a
    export NODE_OPTIONS="--max-old-space-size=4096"
    $STD pnpm install
@@ -60,6 +57,7 @@ function update_script() {
    msg_ok "Ran Database Migrations"

    mkdir -p /opt/postiz/uploads
+    restore_backup

    msg_info "Starting Services"
    systemctl start postiz-backend postiz-frontend postiz-orchestrator
--- a/ct/romm.sh
+++ b/ct/romm.sh
@@ -37,29 +37,18 @@ function update_script() {
    systemctl stop romm-backend romm-worker romm-scheduler romm-watcher
    msg_ok "Stopped Services"

-    create_backup /opt/romm/.env
-    BACKUP_DIR=/opt/romm-players.backup create_backup \
-      /opt/romm/frontend/dist/assets/emulatorjs \
-      /opt/romm/frontend/dist/assets/ruffle
+    msg_info "Backing up configuration"
+    cp /opt/romm/.env /opt/romm/.env.backup
+    msg_ok "Backed up configuration"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball" "latest" "/opt/romm"
-
-    restore_backup
+    fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball" "latest" "/opt/romm"

    msg_info "Updating ROMM"
+    cp /opt/romm/.env.backup /opt/romm/.env
    cd /opt/romm
    $STD uv sync --all-extras
    cd /opt/romm/backend
    $STD uv run alembic upgrade head
-    if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
-      cd /opt/romm/backend/utils/rom_patcher
-      $STD npm install --ignore-scripts --no-audit --no-fund
-      if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
-        rm -rf rom-patcher-js
-        cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js
-      fi
-      rm -rf node_modules
-    fi
    cd /opt/romm/frontend
    $STD npm install
    $STD npm run build
@@ -84,12 +73,6 @@ function update_script() {
    msg_ok "Started Services"
    msg_ok "Updated successfully"
  fi
-
-  if check_for_gh_release "EmulatorJS" "EmulatorJS/EmulatorJS" "v4.2.3"; then
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "EmulatorJS" "EmulatorJS/EmulatorJS" "prebuild" "v4.2.3" "/opt/romm/frontend/dist/assets/emulatorjs" "4.2.3.7z"
-    systemctl restart romm-backend romm-worker romm-scheduler romm-watcher
-    msg_ok "Updated EmulatorJS successfully"
-  fi
  exit
 }

--- a/ct/trek.sh
+++ b/ct/trek.sh
@@ -3,7 +3,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/liketrek/TREK
+# Source: https://github.com/mauriceboe/TREK

 APP="TREK"
 var_tags="${var_tags:-travel;planning;collaboration}"
@@ -32,7 +32,7 @@ function update_script() {

  NODE_VERSION="24" setup_nodejs

-  if check_for_gh_release "trek" "liketrek/TREK"; then
+  if check_for_gh_release "trek" "mauriceboe/TREK"; then
    MIGRATION=0
    grep -qF "ExecStart=/usr/bin/node --import tsx src/index.ts" \
      /etc/systemd/system/trek.service && MIGRATION=1
@@ -47,7 +47,7 @@ function update_script() {
      /opt/trek/data \
      /opt/trek/uploads

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "trek" "liketrek/TREK" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "trek" "mauriceboe/TREK" "tarball"

    msg_info "Building TREK"
    cd /opt/trek
@@ -79,7 +79,7 @@ function update_script() {
      cat <<EOF >/etc/systemd/system/trek.service
 [Unit]
 Description=TREK Travel Planner
-Documentation=https://github.com/liketrek/TREK
+Documentation=https://github.com/mauriceboe/TREK
 After=network-online.target
 Wants=network-online.target

--- a/ct/vikunja.sh
+++ b/ct/vikunja.sh
@@ -65,7 +65,7 @@ function update_script() {
    systemctl stop vikunja
    msg_ok "Stopped Service"

-    fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "latest" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
+    fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary"
    $STD systemctl daemon-reload

    msg_info "Starting Service"
--- a/ct/wanderer.sh
+++ b/ct/wanderer.sh
@@ -46,8 +46,8 @@ function update_script() {
    cd /opt/wanderer/source/web
    $STD npm ci
    $STD npm run build
-    mkdir -p /opt/wanderer/data/plugins /opt/wanderer/source/db/data
-    [[ -e /opt/wanderer/source/db/data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /opt/wanderer/source/db/data/plugins
+    mkdir -p /opt/wanderer/data/plugins
+    [[ -e /data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /data/plugins
    msg_info "Installing wanderer plugins"
    for plugin in hammerhead komoot strava; do
      fetch_and_deploy_gh_release "wanderer-plugin-${plugin}" "open-wanderer/wanderer" "prebuild" "${CHECK_UPDATE_RELEASE:-latest}" "/opt/wanderer/data/plugins" "wanderer-plugin-${plugin}.tar.gz" || msg_warn "Failed to install wanderer plugin: ${plugin}"
--- a/install/affine-install.sh
+++ b/install/affine-install.sh
@@ -31,7 +31,7 @@ PG_DB_NAME="affine" PG_DB_USER="affine" setup_postgresql_db
 NODE_VERSION="22" setup_nodejs
 setup_rust

-fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "v0.27.2" "/opt/affine"
+fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "v0.27.0" "/opt/affine"

 msg_info "Setting up Directories"
 rm -rf /root/.affine
--- a/install/authentik-install.sh
+++ b/install/authentik-install.sh
@@ -54,12 +54,12 @@ NODE_VERSION="24" setup_nodejs
 setup_yq
 setup_go
 RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
-UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
+UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db

-XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.5.5"
+XMLSEC_VERSION="1.3.11"
+AUTHENTIK_VERSION="version/2026.5.3"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
--- a/install/gotify-install.sh
+++ b/install/gotify-install.sh
@@ -27,7 +27,7 @@ After=network.target
 Type=simple
 User=root
 WorkingDirectory=/opt/gotify
-ExecStart=/opt/gotify/gotify-linux-$(arch_resolve) serve
+ExecStart=/opt/gotify/./gotify-linux-$(arch_resolve)
 Restart=always
 RestartSec=3

--- a/install/manyfold-install.sh
+++ b/install/manyfold-install.sh
@@ -31,14 +31,13 @@ NODE_VERSION="24" NODE_MODULE="corepack,yarn" setup_nodejs

 fetch_and_deploy_gh_release "manyfold" "manyfold3d/manyfold" "tarball" "latest" "/opt/manyfold/app"

-useradd -m -s /usr/bin/bash manyfold
-
 RUBY_INSTALL_VERSION=$(cat /opt/manyfold/app/.ruby-version)
 RUBY_VERSION=${RUBY_INSTALL_VERSION} RUBY_INSTALL_RAILS="true" HOME=/home/manyfold setup_ruby

 msg_info "Configuring Manyfold"
 YARN_VERSION=$(grep '"packageManager":' /opt/manyfold/app/package.json | sed -E 's/.*"(yarn@[0-9\.]+)".*/\1/')
 RELEASE=$(get_latest_github_release "manyfold3d/manyfold")
+useradd -m -s /usr/bin/bash manyfold
 cat <<EOF >/opt/manyfold/.env
 export APP_VERSION=${RELEASE}
 export GUID=1002
--- a/install/omada-install.sh
+++ b/install/omada-install.sh
@@ -42,7 +42,7 @@ OMADA_PKG=$(basename "${OMADA_URL}")
 curl_download "${OMADA_PKG}" "${OMADA_URL}"
 $STD dpkg -i "${OMADA_PKG}"
 rm -rf "${OMADA_PKG}"
-VERSION=$(sed -n 's/.*_v\([0-9.]*\)_linux.*/\1/p' <<<"${OMADA_PKG}")
+VERSION=$(sed -n 's/.*_v\([0-9.]*\)_.*_\([0-9]\{14\}\)\.deb$/\1-\2/p' <<<"${OMADA_PKG}")
 echo "${VERSION}" >$HOME/.omada
 msg_ok "Installed Omada Controller"

--- a/install/romm-install.sh
+++ b/install/romm-install.sh
@@ -134,8 +134,6 @@ else
 fi

 fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball"
-fetch_and_deploy_gh_release "ruffle" "ruffle-rs/ruffle" "prebuild" "latest" "/opt/romm/frontend/dist/assets/ruffle" "ruffle-*-web-selfhosted.zip"
-fetch_and_deploy_gh_release "EmulatorJS" "EmulatorJS/EmulatorJS" "prebuild" "v4.2.3" "/opt/romm/frontend/dist/assets/emulatorjs" "4.2.3.7z"

 msg_info "Creating environment file"
 sed -i 's/^supervised no/supervised systemd/' /etc/redis/redis.conf
@@ -161,9 +159,6 @@ ROMM_AUTH_SECRET_KEY=$AUTH_SECRET_KEY
 DISABLE_DOWNLOAD_ENDPOINT_AUTH=false
 DISABLE_CSRF_PROTECTION=false

-SCREENSCRAPER_DEV_ID=
-SCREENSCRAPER_DEV_PASSWORD=
-
 ENABLE_RESCAN_ON_FILESYSTEM_CHANGE=true
 RESCAN_ON_FILESYSTEM_CHANGE_DELAY=5

@@ -186,18 +181,6 @@ cd /opt/romm/backend
 $STD uv run alembic upgrade head
 msg_ok "Set up RomM Backend"

-if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
-  msg_info "Building ROM Patcher helper"
-  cd /opt/romm/backend/utils/rom_patcher
-  $STD npm install --ignore-scripts --no-audit --no-fund
-  if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
-    rm -rf rom-patcher-js
-    cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js
-  fi
-  rm -rf node_modules
-  msg_ok "Built ROM Patcher helper"
-fi
-
 msg_info "Setting up RomM Frontend"
 cd /opt/romm/frontend
 $STD npm install
--- a/install/trek-install.sh
+++ b/install/trek-install.sh
@@ -3,7 +3,7 @@
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/liketrek/TREK
+# Source: https://github.com/mauriceboe/TREK

 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
@@ -20,7 +20,7 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"

 NODE_VERSION="24" setup_nodejs
-fetch_and_deploy_gh_release "trek" "liketrek/TREK" "tarball"
+fetch_and_deploy_gh_release "trek" "mauriceboe/TREK" "tarball"

 msg_info "Setup TREK"
 cd /opt/trek
@@ -78,7 +78,7 @@ msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/trek.service
 [Unit]
 Description=TREK Travel Planner
-Documentation=https://github.com/liketrek/TREK
+Documentation=https://github.com/mauriceboe/TREK
 After=network-online.target
 Wants=network-online.target

--- a/install/vikunja-install.sh
+++ b/install/vikunja-install.sh
@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "latest" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
+fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary"

 msg_info "Setting up Vikunja"
 sed -i 's|^# \(service:\)|\1|' /etc/vikunja/config.yml
--- a/install/wanderer-install.sh
+++ b/install/wanderer-install.sh
@@ -21,9 +21,8 @@ else
  fetch_and_deploy_gh_release "meilisearch" "meilisearch/meilisearch" "binary" "latest" "/opt/wanderer/source/search"
 fi
 mkdir -p /opt/wanderer/{source,data/pb_data,data/meili_data,data/plugins}
+[[ -e /data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /data/plugins
 fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest" "/opt/wanderer/source"
-mkdir -p /opt/wanderer/source/db/data
-[[ -e /opt/wanderer/source/db/data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /opt/wanderer/source/db/data/plugins

 msg_info "Installing wanderer (patience)"
 cd /opt/wanderer/source/db
--- a/install/zammad-install.sh
+++ b/install/zammad-install.sh
@@ -31,10 +31,7 @@ $STD apt install -y elasticsearch
 sed -i 's/^#\{0,2\} *-Xms[0-9]*g.*/-Xms2g/' /etc/elasticsearch/jvm.options
 sed -i 's/^#\{0,2\} *-Xmx[0-9]*g.*/-Xmx2g/' /etc/elasticsearch/jvm.options
 cat <<EOF >/etc/elasticsearch/elasticsearch.yml
-path.data: /var/lib/elasticsearch
-path.logs: /var/log/elasticsearch
 discovery.type: single-node
-network.host: 127.0.0.1
 xpack.security.enabled: false
 bootstrap.memory_lock: false
 EOF
@@ -43,7 +40,7 @@ systemctl daemon-reload
 systemctl enable -q elasticsearch
 systemctl restart -q elasticsearch
 for i in $(seq 1 30); do
-  if curl -s http://127.0.0.1:9200 >/dev/null 2>&1; then
+  if curl -s http://localhost:9200 >/dev/null 2>&1; then
    break
  fi
  sleep 2
@@ -58,7 +55,7 @@ setup_deb822_repo \
  "$(get_os_info version_id)" \
  "main"
 $STD apt install -y zammad
-$STD zammad run rails r "Setting.set('es_url', 'http://127.0.0.1:9200')"
+$STD zammad run rails r "Setting.set('es_url', 'http://localhost:9200')"
 $STD zammad run rake zammad:searchindex:rebuild
 msg_ok "Installed Zammad"

--- a/misc/build.func
+++ b/misc/build.func
@@ -1009,6 +1009,7 @@ base_settings() {

  APT_CACHER=${var_apt_cacher:-""}
  APT_CACHER_IP=${var_apt_cacher_ip:-""}
+  INHERIT_HOST_CA="${var_inherit_host_ca:-auto}"

  # Runtime check: Verify APT cacher is reachable if configured
  if [[ -n "$APT_CACHER_IP" && "$APT_CACHER" == "yes" ]]; then
@@ -1088,7 +1089,7 @@ load_vars_file() {

  # Allowed var_* keys
  local VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
    var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
    var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
    var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
@@ -1285,6 +1286,12 @@ load_vars_file() {
            continue
          fi
          ;;
+        var_inherit_host_ca)
+          if [[ "$var_val" != "yes" && "$var_val" != "no" && "$var_val" != "auto" ]]; then
+            msg_warn "Invalid host CA inheritance value '$var_val' in $file (must be yes/no/auto), ignoring"
+            continue
+          fi
+          ;;
        var_container_storage | var_template_storage)
          # Validate that the storage exists and is active on the current node
          local _storage_status
@@ -1324,7 +1331,7 @@ default_var_settings() {
  # Allowed var_* keys (alphabetically sorted)
  # Note: Removed var_ctid (can only exist once), var_ipv6_static (static IPs are unique)
  local VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
    var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
    var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
    var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage
@@ -1407,6 +1414,7 @@ var_ssh=no
 # HTTP/HTTPS proxy (optional - for networks requiring a proxy)
 # var_http_proxy=http://proxy.local:8080
 # var_http_no_proxy=localhost,127.0.0.1,.local
+# var_inherit_host_ca=auto

 # Features/Tags/verbosity
 var_fuse=no
@@ -1507,7 +1515,7 @@ get_app_defaults_path() {
 if ! declare -p VAR_WHITELIST >/dev/null 2>&1; then
  # Note: Removed var_ctid (can only exist once), var_ipv6_static (static IPs are unique)
  declare -ag VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
    var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
    var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
    var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
@@ -1657,6 +1665,7 @@ _build_current_app_vars_tmp() {
  _apt_cacher_ip="${APT_CACHER_IP:-}"
  _http_proxy="${HTTP_PROXY:-${var_http_proxy:-}}"
  _http_no_proxy="${HTTP_NO_PROXY:-${var_http_no_proxy:-}}"
+  _inherit_host_ca="${INHERIT_HOST_CA:-${var_inherit_host_ca:-auto}}"
  _fuse="${ENABLE_FUSE:-no}"
  _tun="${ENABLE_TUN:-no}"
  _gpu="${ENABLE_GPU:-no}"
@@ -1710,6 +1719,7 @@ _build_current_app_vars_tmp() {
    [ -n "$_apt_cacher_ip" ] && echo "var_apt_cacher_ip=$(_sanitize_value "$_apt_cacher_ip")"
    [ -n "$_http_proxy" ] && echo "var_http_proxy=$(_sanitize_value "$_http_proxy")"
    [ -n "$_http_no_proxy" ] && echo "var_http_no_proxy=$(_sanitize_value "$_http_no_proxy")"
+    [ -n "$_inherit_host_ca" ] && echo "var_inherit_host_ca=$(_sanitize_value "$_inherit_host_ca")"

    [ -n "$_fuse" ] && echo "var_fuse=$(_sanitize_value "$_fuse")"
    [ -n "$_tun" ] && echo "var_tun=$(_sanitize_value "$_tun")"
@@ -1874,7 +1884,7 @@ advanced_settings() {
    TAGS="community-script${var_tags:+;${var_tags}}"
  fi
  local STEP=1
-  local MAX_STEP=30
+  local MAX_STEP=31

  # Store values for back navigation - inherit from var_* app defaults
  local _ct_type="${var_unprivileged:-1}"
@@ -1896,6 +1906,7 @@ advanced_settings() {
  local _apt_cacher_ip="${var_apt_cacher_ip:-}"
  local _http_proxy="${var_http_proxy:-}"
  local _http_no_proxy="${var_http_no_proxy:-}"
+  local _inherit_host_ca="${var_inherit_host_ca:-auto}"
  local _mtu="${var_mtu:-}"
  local _sd="${var_searchdomain:-}"
  local _ns="${var_ns:-}"
@@ -2725,9 +2736,47 @@ advanced_settings() {
      ;;

    # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 25: Container Timezone
+    # STEP 25: Host CA Inheritance
    # ═══════════════════════════════════════════════════════════════════════════
    25)
+      local host_ca_count=0
+      local host_ca_dir="/usr/local/share/ca-certificates"
+      local cert
+      shopt -s nullglob
+      for cert in "$host_ca_dir"/*.crt; do
+        host_ca_count=$((host_ca_count + 1))
+      done
+      shopt -u nullglob
+
+      if [[ $host_ca_count -eq 0 ]]; then
+        _inherit_host_ca="auto"
+        ((STEP++))
+        continue
+      fi
+
+      local host_ca_default_flag=""
+      [[ "$_inherit_host_ca" == "no" ]] && host_ca_default_flag="--defaultno"
+      if whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
+        --title "HOST CA INHERITANCE" \
+        --ok-button "Next" --cancel-button "Back" \
+        $host_ca_default_flag \
+        --yesno "\nInherit host CA certificates into this container?\n\nDetected on host: ${host_ca_count} certificate(s) in:\n${host_ca_dir}\n\nRecommended for private PKI / TLS-inspection environments.\n\n(App default: ${var_inherit_host_ca:-auto})" 16 72; then
+        _inherit_host_ca="yes"
+      else
+        if [ $? -eq 1 ]; then
+          _inherit_host_ca="no"
+        else
+          ((STEP--))
+          continue
+        fi
+      fi
+      ((STEP++))
+      ;;
+
+    # ═══════════════════════════════════════════════════════════════════════════
+    # STEP 26: Container Timezone
+    # ═══════════════════════════════════════════════════════════════════════════
+    26)
      local tz_hint="$_ct_timezone"
      [[ -z "$tz_hint" ]] && tz_hint="(empty - will use host timezone)"

@@ -2750,9 +2799,9 @@ advanced_settings() {
      ;;

    # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 26: Container Protection
+    # STEP 27: Container Protection
    # ═══════════════════════════════════════════════════════════════════════════
-    26)
+    27)
      local protect_default_flag="--defaultno"
      [[ "$_protect_ct" == "yes" || "$_protect_ct" == "1" ]] && protect_default_flag=""

@@ -2774,9 +2823,9 @@ advanced_settings() {
      ;;

    # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 27: Device Node Creation (mknod)
+    # STEP 28: Device Node Creation (mknod)
    # ═══════════════════════════════════════════════════════════════════════════
-    27)
+    28)
      local mknod_default_flag="--defaultno"
      [[ "$_enable_mknod" == "1" ]] && mknod_default_flag=""

@@ -2798,9 +2847,9 @@ advanced_settings() {
      ;;

    # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 28: Mount Filesystems
+    # STEP 29: Mount Filesystems
    # ═══════════════════════════════════════════════════════════════════════════
-    28)
+    29)
      local mount_hint=""
      [[ -n "$_mount_fs" ]] && mount_hint="$_mount_fs" || mount_hint="(none)"

@@ -2821,9 +2870,9 @@ advanced_settings() {
      ;;

    # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 29: Optional host-side post-install hook (path on the Proxmox HOST)
+    # STEP 30: Optional host-side post-install hook (path on the Proxmox HOST)
    # ═══════════════════════════════════════════════════════════════════════════
-    29)
+    30)
      local _hook_prompt="Optional: absolute path to a *.sh file ON THE PROXMOX HOST.

 It runs as root on the HOST (NOT in the LXC) after the container
@@ -2873,9 +2922,9 @@ Leave empty to skip."
      ;;

    # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 30: Verbose Mode & Confirmation
+    # STEP 31: Verbose Mode & Confirmation
    # ═══════════════════════════════════════════════════════════════════════════
-    30)
+    31)
      local verbose_default_flag="--defaultno"
      [[ "$_verbose" == "yes" ]] && verbose_default_flag=""

@@ -2904,6 +2953,7 @@ Leave empty to skip."
      local apt_display="${_apt_cacher:-no}"
      [[ "$_apt_cacher" == "yes" && -n "$_apt_cacher_ip" ]] && apt_display="$_apt_cacher_ip"
      local http_proxy_display="${_http_proxy:-(none)}"
+      local inherit_ca_display="${_inherit_host_ca:-auto}"

      local post_install_display="${_post_install:-(none)}"
      local post_install_warn=""
@@ -2934,6 +2984,7 @@ Advanced:
  Timezone: $tz_display
  APT Cacher: $apt_display
  HTTP Proxy: $http_proxy_display
+  Inherit Host CAs: $inherit_ca_display
  Verbose: $_verbose
  Post-Install Script: ${post_install_display}${post_install_warn}"

@@ -2979,6 +3030,7 @@ Advanced:
  APT_CACHER_IP="$_apt_cacher_ip"
  HTTP_PROXY="$_http_proxy"
  HTTP_NO_PROXY="$_http_no_proxy"
+  INHERIT_HOST_CA="$_inherit_host_ca"
  VERBOSE="$_verbose"
  var_post_install="$_post_install"

@@ -2997,6 +3049,7 @@ Advanced:
  var_sdn_vnet="$_sdn_vnet"
  var_http_proxy="$_http_proxy"
  var_http_no_proxy="$_http_no_proxy"
+  var_inherit_host_ca="$_inherit_host_ca"

  # Format optional values
  [[ -n "$_mtu" ]] && MTU=",mtu=$_mtu" || MTU=""
@@ -3600,9 +3653,9 @@ configure_ssh_settings() {
    glob_path=$(whiptail --backtitle "$backtitle" \
      --inputbox "Enter a folder or glob to scan (e.g. /root/.ssh/*.pub)" 10 72 --title "Scan Folder/Glob" 3>&1 1>&2 2>&3)
    if [[ -n "$glob_path" ]]; then
-      [[ -d "$glob_path" ]] && glob_path="${glob_path%/}/*"
-      local -a _scan_files
-      mapfile -t _scan_files < <(compgen -G "$glob_path")
+      shopt -s nullglob
+      read -r -a _scan_files <<<"$glob_path"
+      shopt -u nullglob
      if [[ "${#_scan_files[@]}" -gt 0 ]]; then
        ssh_build_choices_from_files "${_scan_files[@]}"
        if [[ "$COUNT" -gt 0 ]]; then
@@ -3945,6 +3998,81 @@ EOF
  msg_ok "Applied HTTP proxy in container"
 }

+# ------------------------------------------------------------------------------
+# _apply_host_ca_certs_in_container()
+#
+# - Copies administrator-provided CA certificates from the Proxmox host into the
+#   container before base package bootstrap
+# - Source: /usr/local/share/ca-certificates/*.crt (Debian convention)
+# - Refreshes the container trust store when update-ca-certificates is available
+# - No-op when no host certificates are present; failures are non-fatal
+# ------------------------------------------------------------------------------
+_apply_host_ca_certs_in_container() {
+  local host_ca_dir="/usr/local/share/ca-certificates"
+  [[ -z "${CTID:-}" ]] && return 0
+  local inherit_host_ca="${INHERIT_HOST_CA:-${var_inherit_host_ca:-auto}}"
+
+  local -a host_certs=()
+  local cert
+  shopt -s nullglob
+  for cert in "$host_ca_dir"/*.crt; do
+    host_certs+=("$cert")
+  done
+  shopt -u nullglob
+
+  [[ ${#host_certs[@]} -eq 0 ]] && return 0
+
+  case "${inherit_host_ca,,}" in
+  no | false | 0 | off)
+    msg_warn "Skipping host CA inheritance by configuration (${#host_certs[@]} host certificate(s) available)"
+    return 0
+    ;;
+  esac
+
+  msg_info "Inheriting host CA certificates into container"
+
+  local found=${#host_certs[@]}
+  local copied=0
+  local skipped=0
+  local cert_name
+
+  pct exec "$CTID" -- mkdir -p /usr/local/share/ca-certificates >/dev/null 2>&1 || {
+    msg_warn "Failed to create CA certificate directory in container"
+    return 0
+  }
+
+  for cert in "${host_certs[@]}"; do
+    cert_name="$(basename "$cert")"
+    if [[ ! -r "$cert" || "$cert_name" != *.crt ]]; then
+      msg_warn "Skipping invalid or unreadable host CA certificate: ${cert_name}"
+      skipped=$((skipped + 1))
+      continue
+    fi
+
+    if pct push "$CTID" "$cert" "/usr/local/share/ca-certificates/${cert_name}" >/dev/null 2>&1; then
+      pct exec "$CTID" -- chmod 644 "/usr/local/share/ca-certificates/${cert_name}" >/dev/null 2>&1 || true
+      copied=$((copied + 1))
+    else
+      msg_warn "Failed to push host CA certificate: ${cert_name}"
+      skipped=$((skipped + 1))
+    fi
+  done
+
+  if [[ $copied -eq 0 ]]; then
+    msg_warn "No host CA certificates were copied (${found} found, ${skipped} skipped)"
+    return 0
+  fi
+
+  local refresh_shell="bash"
+  [[ "$var_os" == "alpine" ]] && refresh_shell="ash"
+
+  if pct exec "$CTID" -- "$refresh_shell" -c 'command -v update-ca-certificates >/dev/null 2>&1 && update-ca-certificates' >/dev/null 2>&1; then
+    msg_ok "Inherited ${copied} host CA certificate(s) and updated trust store (${skipped} skipped)"
+  else
+    msg_warn "Copied ${copied} host CA certificate(s), but trust store update failed or update-ca-certificates is unavailable (${skipped} skipped)"
+  fi
+}
+
 # ------------------------------------------------------------------------------
 # build_container()
 #
@@ -4233,31 +4361,27 @@ $PCT_OPTIONS_STRING"
      return 0
    fi

-    # Map each DRI render/card node to its owning GPU via the PCI vendor ID
-    # exposed in sysfs (/sys/class/drm/<node>/device/vendor). This is required
-    # on multi-GPU hosts: globbing every /dev/dri node onto the first detected
-    # vendor would pass through *both* GPUs and skip the selection prompt.
-    if [[ -d /dev/dri ]]; then
-      for d in /dev/dri/renderD* /dev/dri/card*; do
-        [[ -e "$d" ]] || continue
-        local node vendor
-        node=$(basename "$d")
-        vendor=$(cat "/sys/class/drm/${node}/device/vendor" 2>/dev/null || true)
-        case "$vendor" in
-        0x8086) INTEL_DEVICES+=("$d") ;;        # Intel
-        0x1002 | 0x1022) AMD_DEVICES+=("$d") ;; # AMD/ATI
-        0x10de) ;;                              # NVIDIA - handled via /dev/nvidia* below
-        *) msg_debug "Unmapped GPU vendor '${vendor:-unknown}' for $d" ;;
-        esac
-      done
+    # Check for Intel GPU - look for Intel vendor ID [8086]
+    if grep -q "\[8086:" <<<"$pci_vga_info"; then
+      msg_custom "🎮" "${BL}" "Detected Intel GPU"
+      if [[ -d /dev/dri ]]; then
+        for d in /dev/dri/renderD* /dev/dri/card*; do
+          [[ -e "$d" ]] && INTEL_DEVICES+=("$d")
+        done
+      fi
    fi

-    [[ ${#INTEL_DEVICES[@]} -gt 0 ]] && msg_custom "🎮" "${BL}" "Detected Intel GPU"
-    [[ ${#AMD_DEVICES[@]} -gt 0 ]] && msg_custom "🎮" "${RD}" "Detected AMD GPU"
-
-    # AMD compute (ROCm) additionally needs /dev/kfd alongside the render nodes
-    if [[ ${#AMD_DEVICES[@]} -gt 0 && -e /dev/kfd ]]; then
-      AMD_DEVICES+=("/dev/kfd")
+    # Check for AMD GPU - look for AMD vendor IDs [1002] (AMD/ATI) or [1022] (AMD)
+    if grep -qE "\[1002:|\[1022:" <<<"$pci_vga_info"; then
+      msg_custom "🎮" "${RD}" "Detected AMD GPU"
+      if [[ -d /dev/dri ]]; then
+        # Only add if not already claimed by Intel
+        if [[ ${#INTEL_DEVICES[@]} -eq 0 ]]; then
+          for d in /dev/dri/renderD* /dev/dri/card* /dev/kfd; do
+            [[ -e "$d" ]] && AMD_DEVICES+=("$d")
+          done
+        fi
+      fi
    fi

    # Check for NVIDIA GPU - look for NVIDIA vendor ID [10de]
@@ -4569,6 +4693,7 @@ EOF
  local install_exit_code=0

  _apply_http_proxy_in_container
+  _apply_host_ca_certs_in_container

  # Continue with standard container setup
  if [ "$var_os" == "alpine" ]; then
--- a/misc/tools.func
+++ b/misc/tools.func
--- a/vm/opnsense-vm.sh
+++ b/vm/opnsense-vm.sh
@@ -24,7 +24,7 @@ RANDOM_UUID="$(cat /proc/sys/kernel/random/uuid)"
 METHOD=""
 NSAPP="opnsense-vm"
 var_os="opnsense"
-var_version="26.7"
+var_version="26.1"
 #
 GEN_MAC=02:$(openssl rand -hex 5 | awk '{print toupper($0)}' | sed 's/\(..\)/\1:/g; s/.$//')
 GEN_MAC_LAN=02:$(openssl rand -hex 5 | awk '{print toupper($0)}' | sed 's/\(..\)/\1:/g; s/.$//')
@@ -814,7 +814,7 @@ if [ -n "$WAN_BRG" ]; then
  msg_ok "WAN interface added"
  sleep 5 # Brief pause after adding network interface
 fi
-send_line_to_vm "sh ./opnsense-bootstrap.sh.in -y -f -r 26.7"
+send_line_to_vm "sh ./opnsense-bootstrap.sh.in -y -f -r 26.1"
 msg_ok "OPNsense VM is being installed, do not close the terminal, or the installation will fail."
 #We need to wait for the OPNsense build proccess to finish, this takes a few minutes
 sleep 1000