Bind Elasticsearch to 127.0.0.1 in Zammad install

Explicitly bind Elasticsearch to 127.0.0.1 instead of relying on localhost resolution. Updates elasticsearch.yml, health check curl, and Zammad ES URL setting to use 127.0.0.1 for consistency and to avoid potential IPv6 resolution issues.
Update CHANGELOG.md (#15904 )
2026-07-21 05:44:03 +03:00 · 2026-07-20 08:53:51 +02:00 · 2026-07-19 17:02:04 +00:00 · 2026-07-19 19:01:41 +02:00 · 2026-07-19 12:54:11 +00:00 · 2026-07-19 22:53:46 +10:00
14 changed files with 479 additions and 492 deletions
--- a/.github/changelogs/2026/07.md
+++ b/.github/changelogs/2026/07.md
@@ -1,3 +1,173 @@
+## 2026-07-18
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - core: add configurable host CA inheritance during bootstrap [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15840](https://github.com/community-scripts/ProxmoxVE/pull/15840))
+
+  - #### 🔧 Refactor
+
+    - tools.func: Safe Delete Directorys & Update PYTHON_VERSION with setup_uv [@MickLesk](https://github.com/MickLesk) ([#15870](https://github.com/community-scripts/ProxmoxVE/pull/15870))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - [tools.update-lxcs] feat: optional reporting success/failures to heathchecks.io (or others) [@sir106](https://github.com/sir106) ([#15701](https://github.com/community-scripts/ProxmoxVE/pull/15701))
+
+## 2026-07-17
+
+### 🆕 New Scripts
+
+  - Invidious ([#15824](https://github.com/community-scripts/ProxmoxVE/pull/15824))
+- OxiCloud ([#15823](https://github.com/community-scripts/ProxmoxVE/pull/15823))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - webtrees: initialize database schema before admin user creation [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15837](https://github.com/community-scripts/ProxmoxVE/pull/15837))
+    - Fix DocuSeal missing Leptonica deps on install and update [@Copilot](https://github.com/Copilot) ([#15858](https://github.com/community-scripts/ProxmoxVE/pull/15858))
+    - apache-guacamole: detect installed extensions during update [@TowyTowy](https://github.com/TowyTowy) ([#15841](https://github.com/community-scripts/ProxmoxVE/pull/15841))
+    - CLIProxyAPI: fix update deleting config.yaml [@austinpilz](https://github.com/austinpilz) ([#15834](https://github.com/community-scripts/ProxmoxVE/pull/15834))
+    - esphome: install libusb-1.0-0 for ESP-IDF native builds [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15838](https://github.com/community-scripts/ProxmoxVE/pull/15838))
+
+  - #### ✨ New Features
+
+    - AFFiNE: Bump to 0.27.0 [@MickLesk](https://github.com/MickLesk) ([#15848](https://github.com/community-scripts/ProxmoxVE/pull/15848))
+    - n8n: unpin / use latest release [@MickLesk](https://github.com/MickLesk) ([#15817](https://github.com/community-scripts/ProxmoxVE/pull/15817))
+    - Pin Opencloud to v7.3.0 [@vhsdream](https://github.com/vhsdream) ([#15826](https://github.com/community-scripts/ProxmoxVE/pull/15826))
+
+  - #### 🔧 Refactor
+
+    - SFTPGo: Update APT Repo & Re-Enable Script [@MickLesk](https://github.com/MickLesk) ([#15829](https://github.com/community-scripts/ProxmoxVE/pull/15829))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - tools.func: enhance rbenv with profile updates / bundle in bashrc [@MickLesk](https://github.com/MickLesk) ([#15822](https://github.com/community-scripts/ProxmoxVE/pull/15822))
+    - feat(build.func): notify users when already on a pinned script version [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15819](https://github.com/community-scripts/ProxmoxVE/pull/15819))
+
+  - #### 💥 Breaking Changes
+
+    - MongoDB: Implement kernel version check and patch [@MickLesk](https://github.com/MickLesk) ([#15821](https://github.com/community-scripts/ProxmoxVE/pull/15821))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - update-lxc: autoremove and autoclean after apt full-upgrade [@soupy-boy](https://github.com/soupy-boy) ([#15831](https://github.com/community-scripts/ProxmoxVE/pull/15831))
+
+## 2026-07-16
+
+### 🆕 New Scripts
+
+  - Sync-In ([#15812](https://github.com/community-scripts/ProxmoxVE/pull/15812))
+- Beaverhabits ([#15813](https://github.com/community-scripts/ProxmoxVE/pull/15813))
+- Notediscovery ([#15811](https://github.com/community-scripts/ProxmoxVE/pull/15811))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Pin Immich to v3.0.3 [@vhsdream](https://github.com/vhsdream) ([#15790](https://github.com/community-scripts/ProxmoxVE/pull/15790))
+
+## 2026-07-15
+
+### 🆕 New Scripts
+
+  - Nexterm ([#15688](https://github.com/community-scripts/ProxmoxVE/pull/15688))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - 2fauth: minor fixes for 8.0.0 [@MickLesk](https://github.com/MickLesk) ([#15795](https://github.com/community-scripts/ProxmoxVE/pull/15795))
+    - SnapOtter: refactor update process to prebuild [@MickLesk](https://github.com/MickLesk) ([#15797](https://github.com/community-scripts/ProxmoxVE/pull/15797))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - tools.func: default Docker setup to official repo [@MickLesk](https://github.com/MickLesk) ([#15794](https://github.com/community-scripts/ProxmoxVE/pull/15794))
+
+## 2026-07-14
+
+### 🆕 New Scripts
+
+  - Grav ([#15773](https://github.com/community-scripts/ProxmoxVE/pull/15773))
+- Yuvomi ([#15772](https://github.com/community-scripts/ProxmoxVE/pull/15772))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Lychee: Preserve uploads and ownership during update [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15768](https://github.com/community-scripts/ProxmoxVE/pull/15768))
+    - Wanderer: Clean deploy and install plugins for v0.20.0 update [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15759](https://github.com/community-scripts/ProxmoxVE/pull/15759))
+    - FileFlows: Handle update API 401, force update, and Node install [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15766](https://github.com/community-scripts/ProxmoxVE/pull/15766))
+    - BirdNET-Go: Match new upstream release asset naming [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15758](https://github.com/community-scripts/ProxmoxVE/pull/15758))
+    - [Upstream Fix] Immich: Fix loader priority [@vhsdream](https://github.com/vhsdream) ([#15755](https://github.com/community-scripts/ProxmoxVE/pull/15755))
+
+  - #### ✨ New Features
+
+    - Bump OpenCloud version to v7.2.2 [@MickLesk](https://github.com/MickLesk) ([#15769](https://github.com/community-scripts/ProxmoxVE/pull/15769))
+    - Silverbullet: Add optional Runtime API install via Chromium [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15761](https://github.com/community-scripts/ProxmoxVE/pull/15761))
+
+  - #### 💥 Breaking Changes
+
+    - Pangolin: Bump to 1.20.0 | BREAKING: Switch to PostgreSQL [@MickLesk](https://github.com/MickLesk) ([#15682](https://github.com/community-scripts/ProxmoxVE/pull/15682))
+
+  - #### 🔧 Refactor
+
+    - AFFiNE: Pin to v0.26.3 [@MickLesk](https://github.com/MickLesk) ([#15782](https://github.com/community-scripts/ProxmoxVE/pull/15782))
+
+## 2026-07-13
+
+### 🆕 New Scripts
+
+  - LeafWiki ([#15748](https://github.com/community-scripts/ProxmoxVE/pull/15748))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(hyperion): keep service running after container reboot [@TowyTowy](https://github.com/TowyTowy) ([#15653](https://github.com/community-scripts/ProxmoxVE/pull/15653))
+    - Change sign-in URL to admin URL in affine.sh [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15741](https://github.com/community-scripts/ProxmoxVE/pull/15741))
+    - immich: use actual PostgreSQL version for VectorChord package lookup [@mnavon](https://github.com/mnavon) ([#15705](https://github.com/community-scripts/ProxmoxVE/pull/15705))
+    - fix storyteller release selection for stable web tags [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15736](https://github.com/community-scripts/ProxmoxVE/pull/15736))
+    - Docmost: Fix update procedure [@MickLesk](https://github.com/MickLesk) ([#15732](https://github.com/community-scripts/ProxmoxVE/pull/15732))
+    - fix(shinobi): remove obsolete --unsafe-perm npm flag [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15730](https://github.com/community-scripts/ProxmoxVE/pull/15730))
+
+  - #### 💥 Breaking Changes
+
+    - reitti: update to v5 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15635](https://github.com/community-scripts/ProxmoxVE/pull/15635))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - fix(build.func): parse script status without jq dependency [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15729](https://github.com/community-scripts/ProxmoxVE/pull/15729))
+
+  - #### 🔧 Refactor
+
+    - tools.func: some improvements (sql injection / command injection / guard) [@MickLesk](https://github.com/MickLesk) ([#15661](https://github.com/community-scripts/ProxmoxVE/pull/15661))
+
+## 2026-07-12
+
+### 🆕 New Scripts
+
+  - AFFiNE ([#15690](https://github.com/community-scripts/ProxmoxVE/pull/15690))
+
+### 🚀 Updated Scripts
+
+  - Immich: Bump version to 3.0.2 [@vhsdream](https://github.com/vhsdream) ([#15668](https://github.com/community-scripts/ProxmoxVE/pull/15668))
+
+### ❔ Uncategorized
+
+  - fix(immich): correct Python indentation error in ct/immich.sh heredoc patch [@Copilot](https://github.com/Copilot) ([#15723](https://github.com/community-scripts/ProxmoxVE/pull/15723))
+
 ## 2026-07-11

 ### 🆕 New Scripts
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -77,6 +77,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



+
+
+



@@ -90,7 +93,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit


 <details>
-<summary><h4>July (11 entries)</h4></summary>
+<summary><h4>July (18 entries)</h4></summary>

 [View July 2026 Changelog](.github/changelogs/2026/07.md)

@@ -502,6 +505,47 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

+## 2026-07-19
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - change trek repo to liketrek/TREK [@asylumexp](https://github.com/asylumexp) ([#15893](https://github.com/community-scripts/ProxmoxVE/pull/15893))
+    - update authentik to 2026.5.5 [@thieneret](https://github.com/thieneret) ([#15855](https://github.com/community-scripts/ProxmoxVE/pull/15855))
+    - [FIX] BookOrbit: add missing `restore_backup` during update [@vhsdream](https://github.com/vhsdream) ([#15881](https://github.com/community-scripts/ProxmoxVE/pull/15881))
+
+  - #### ✨ New Features
+
+    - tools.func: centralize deploy tail + trap-based tmpdir cleanup [@MickLesk](https://github.com/MickLesk) ([#15872](https://github.com/community-scripts/ProxmoxVE/pull/15872))
+    - Update OPNsense from 26.1 to 26.7 [@tdn131](https://github.com/tdn131) ([#15895](https://github.com/community-scripts/ProxmoxVE/pull/15895))
+
+### 💾 Core
+
+  - Revert "core: add configurable host CA inheritance during bootstrap" [@MickLesk](https://github.com/MickLesk) ([#15886](https://github.com/community-scripts/ProxmoxVE/pull/15886))
+
+  - #### 🐞 Bug Fixes
+
+    - fix(build.func): expand glob in SSH key "Scan Folder/Glob" so it can find keys [@TowyTowy](https://github.com/TowyTowy) ([#15873](https://github.com/community-scripts/ProxmoxVE/pull/15873))
+
+## 2026-07-18
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - core: add configurable host CA inheritance during bootstrap [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15840](https://github.com/community-scripts/ProxmoxVE/pull/15840))
+
+  - #### 🔧 Refactor
+
+    - tools.func: Safe Delete Directorys & Update PYTHON_VERSION with setup_uv [@MickLesk](https://github.com/MickLesk) ([#15870](https://github.com/community-scripts/ProxmoxVE/pull/15870))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - [tools.update-lxcs] feat: optional reporting success/failures to heathchecks.io (or others) [@sir106](https://github.com/sir106) ([#15701](https://github.com/community-scripts/ProxmoxVE/pull/15701))
+
 ## 2026-07-17

 ### 🆕 New Scripts
@@ -1135,128 +1179,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

  - chore(ct): sync coredns defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15182](https://github.com/community-scripts/ProxmoxVE/pull/15182))
 - chore(ct): sync gatus defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15184](https://github.com/community-scripts/ProxmoxVE/pull/15184))
- chore(ct): sync bitmagnet defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15183](https://github.com/community-scripts/ProxmoxVE/pull/15183))
-
-## 2026-06-18
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - flowise: add deps / uv / python 3.11 [@MickLesk](https://github.com/MickLesk) ([#15177](https://github.com/community-scripts/ProxmoxVE/pull/15177))
-
-  - #### 💥 Breaking Changes
-
-    - refactor: crafty-controller [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15178](https://github.com/community-scripts/ProxmoxVE/pull/15178))
-
-## 2026-06-17
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - kasm: fix release detection [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15151](https://github.com/community-scripts/ProxmoxVE/pull/15151))
-
-  - #### ✨ New Features
-
-    - trek: update install and upgrade workflow for v3.1.0 [@MickLesk](https://github.com/MickLesk) ([#15165](https://github.com/community-scripts/ProxmoxVE/pull/15165))
-
-  - #### 💥 Breaking Changes
-
-    - TREK: Pin version [@tremor021](https://github.com/tremor021) ([#15156](https://github.com/community-scripts/ProxmoxVE/pull/15156))
-
-  - #### 🔧 Refactor
-
-    - chore(paperless-ngx): pin version to prevent v3 update [@tomfrenzel](https://github.com/tomfrenzel) ([#15171](https://github.com/community-scripts/ProxmoxVE/pull/15171))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - immich public proxy: replace npm install with npm ci for consistent dependency installation [@MickLesk](https://github.com/MickLesk) ([#15166](https://github.com/community-scripts/ProxmoxVE/pull/15166))
-
-## 2026-06-16
-
-### 🆕 New Scripts
-
-  - Feishin ([#15130](https://github.com/community-scripts/ProxmoxVE/pull/15130))
- Kiwix ([#15131](https://github.com/community-scripts/ProxmoxVE/pull/15131))
- Add runtime status guard and deleted script stubs [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15125](https://github.com/community-scripts/ProxmoxVE/pull/15125))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(degoog): use localhost for valkey url [@ethan-hgwr](https://github.com/ethan-hgwr) ([#15149](https://github.com/community-scripts/ProxmoxVE/pull/15149))
-    - Fix InvoiceShelf install/update Yarn package manager mismatch [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15141](https://github.com/community-scripts/ProxmoxVE/pull/15141))
-    - fix storyteller install failure with yarn 4 corepack [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15140](https://github.com/community-scripts/ProxmoxVE/pull/15140))
-    - fix: generate policy-compliant OpenObserve root password [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15137](https://github.com/community-scripts/ProxmoxVE/pull/15137))
-
-## 2026-06-15
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Watcharr: Clean install on update [@tremor021](https://github.com/tremor021) ([#15119](https://github.com/community-scripts/ProxmoxVE/pull/15119))
-    - Vaultwarden: extend version check for VaultWarden update [@MickLesk](https://github.com/MickLesk) ([#15105](https://github.com/community-scripts/ProxmoxVE/pull/15105))
-
-  - #### ✨ New Features
-
-    - degoog: add curl-impersonate to script [@MickLesk](https://github.com/MickLesk) ([#15117](https://github.com/community-scripts/ProxmoxVE/pull/15117))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - tools.func: extend mesa-vulkan-drivers and vulkan-tools to installation for ARC GPU's [@MickLesk](https://github.com/MickLesk) ([#15106](https://github.com/community-scripts/ProxmoxVE/pull/15106))
-
-  - #### 🔧 Refactor
-
-    - core: improve mirror selection and error handling [@MickLesk](https://github.com/MickLesk) ([#15108](https://github.com/community-scripts/ProxmoxVE/pull/15108))
-    - core: implement gateway validation for DHCP and static networks [@MickLesk](https://github.com/MickLesk) ([#15107](https://github.com/community-scripts/ProxmoxVE/pull/15107))
-
-## 2026-06-14
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Iinvoiceninja: fix nginx setup assets port [@MickLesk](https://github.com/MickLesk) ([#15090](https://github.com/community-scripts/ProxmoxVE/pull/15090))
-    - CheckMK: remove stale backup site before creating new backup during update [@MickLesk](https://github.com/MickLesk) ([#15088](https://github.com/community-scripts/ProxmoxVE/pull/15088))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Implement backup functions for scripts C-D [@tremor021](https://github.com/tremor021) ([#15096](https://github.com/community-scripts/ProxmoxVE/pull/15096))
-
-## 2026-06-13
-
-### 🆕 New Scripts
-
-  - BookOrbit ([#15080](https://github.com/community-scripts/ProxmoxVE/pull/15080))
-
-### 🚀 Updated Scripts
-
-  - Update authentik version to 2026.5.3 [@thieneret](https://github.com/thieneret) ([#15093](https://github.com/community-scripts/ProxmoxVE/pull/15093))
-
-  - #### 🐞 Bug Fixes
-
-    - Immich: Update image-processing libraries [@vhsdream](https://github.com/vhsdream) ([#15082](https://github.com/community-scripts/ProxmoxVE/pull/15082))
-    - HomeBox: Support v0.26.0 [@tomfrenzel](https://github.com/tomfrenzel) ([#15086](https://github.com/community-scripts/ProxmoxVE/pull/15086))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Implement backup functions for scripts A-B [@tremor021](https://github.com/tremor021) ([#15075](https://github.com/community-scripts/ProxmoxVE/pull/15075))
-
-## 2026-06-12
-
-### 🆕 New Scripts
-
-  - Twenty ([#15047](https://github.com/community-scripts/ProxmoxVE/pull/15047))
- Alpine-Cinny ([#15044](https://github.com/community-scripts/ProxmoxVE/pull/15044))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - [core] Implement backup and restore functions [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15067](https://github.com/community-scripts/ProxmoxVE/pull/15067))
+- chore(ct): sync bitmagnet defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15183](https://github.com/community-scripts/ProxmoxVE/pull/15183))
--- a/ct/authentik.sh
+++ b/ct/authentik.sh
@@ -38,13 +38,14 @@ function update_script() {

  NODE_VERSION="24" setup_nodejs
  setup_go
-  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
+  $STD uv cache clean
+  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
  RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
  setup_yq

-  AUTHENTIK_VERSION="version/2026.5.3"
+  AUTHENTIK_VERSION="version/2026.5.5"
  # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
-  XMLSEC_VERSION="1.3.11"
+  XMLSEC_VERSION="1.3.12"

  if check_for_gh_release "geoipupdate" "maxmind/geoipupdate"; then
    fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
--- a/ct/bookorbit.sh
+++ b/ct/bookorbit.sh
@@ -53,6 +53,7 @@ function update_script() {
    mkdir -p /opt/bookorbit/server/migrations
    cp -r /opt/bookorbit/server/src/db/migrations/. /opt/bookorbit/server/migrations/
    chmod +x /opt/bookorbit/server/bin/kepubify/*
+    restore_backup
    APP_VER=$(cat ~/.bookorbit)
    sed -i "s/^APP_VERSION=.*/APP_VERSION=v$APP_VER/" /opt/bookorbit/.env
    msg_ok "Rebuilt Application"
--- a/ct/trek.sh
+++ b/ct/trek.sh
@@ -3,7 +3,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/mauriceboe/TREK
+# Source: https://github.com/liketrek/TREK

 APP="TREK"
 var_tags="${var_tags:-travel;planning;collaboration}"
@@ -32,7 +32,7 @@ function update_script() {

  NODE_VERSION="24" setup_nodejs

-  if check_for_gh_release "trek" "mauriceboe/TREK"; then
+  if check_for_gh_release "trek" "liketrek/TREK"; then
    MIGRATION=0
    grep -qF "ExecStart=/usr/bin/node --import tsx src/index.ts" \
      /etc/systemd/system/trek.service && MIGRATION=1
@@ -47,7 +47,7 @@ function update_script() {
      /opt/trek/data \
      /opt/trek/uploads

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "trek" "mauriceboe/TREK" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "trek" "liketrek/TREK" "tarball"

    msg_info "Building TREK"
    cd /opt/trek
@@ -79,7 +79,7 @@ function update_script() {
      cat <<EOF >/etc/systemd/system/trek.service
 [Unit]
 Description=TREK Travel Planner
-Documentation=https://github.com/mauriceboe/TREK
+Documentation=https://github.com/liketrek/TREK
 After=network-online.target
 Wants=network-online.target

--- a/install/authentik-install.sh
+++ b/install/authentik-install.sh
@@ -54,12 +54,12 @@ NODE_VERSION="24" setup_nodejs
 setup_yq
 setup_go
 RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
-UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
+UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db

-XMLSEC_VERSION="1.3.11"
-AUTHENTIK_VERSION="version/2026.5.3"
+XMLSEC_VERSION="1.3.12"
+AUTHENTIK_VERSION="version/2026.5.5"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
--- a/install/manyfold-install.sh
+++ b/install/manyfold-install.sh
@@ -31,13 +31,14 @@ NODE_VERSION="24" NODE_MODULE="corepack,yarn" setup_nodejs

 fetch_and_deploy_gh_release "manyfold" "manyfold3d/manyfold" "tarball" "latest" "/opt/manyfold/app"

+useradd -m -s /usr/bin/bash manyfold
+
 RUBY_INSTALL_VERSION=$(cat /opt/manyfold/app/.ruby-version)
 RUBY_VERSION=${RUBY_INSTALL_VERSION} RUBY_INSTALL_RAILS="true" HOME=/home/manyfold setup_ruby

 msg_info "Configuring Manyfold"
 YARN_VERSION=$(grep '"packageManager":' /opt/manyfold/app/package.json | sed -E 's/.*"(yarn@[0-9\.]+)".*/\1/')
 RELEASE=$(get_latest_github_release "manyfold3d/manyfold")
-useradd -m -s /usr/bin/bash manyfold
 cat <<EOF >/opt/manyfold/.env
 export APP_VERSION=${RELEASE}
 export GUID=1002
--- a/install/trek-install.sh
+++ b/install/trek-install.sh
@@ -3,7 +3,7 @@
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/mauriceboe/TREK
+# Source: https://github.com/liketrek/TREK

 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
@@ -20,7 +20,7 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"

 NODE_VERSION="24" setup_nodejs
-fetch_and_deploy_gh_release "trek" "mauriceboe/TREK" "tarball"
+fetch_and_deploy_gh_release "trek" "liketrek/TREK" "tarball"

 msg_info "Setup TREK"
 cd /opt/trek
@@ -78,7 +78,7 @@ msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/trek.service
 [Unit]
 Description=TREK Travel Planner
-Documentation=https://github.com/mauriceboe/TREK
+Documentation=https://github.com/liketrek/TREK
 After=network-online.target
 Wants=network-online.target

--- a/install/zammad-install.sh
+++ b/install/zammad-install.sh
@@ -32,6 +32,7 @@ sed -i 's/^#\{0,2\} *-Xms[0-9]*g.*/-Xms2g/' /etc/elasticsearch/jvm.options
 sed -i 's/^#\{0,2\} *-Xmx[0-9]*g.*/-Xmx2g/' /etc/elasticsearch/jvm.options
 cat <<EOF >/etc/elasticsearch/elasticsearch.yml
 discovery.type: single-node
+network.host: 127.0.0.1
 xpack.security.enabled: false
 bootstrap.memory_lock: false
 EOF
@@ -40,7 +41,7 @@ systemctl daemon-reload
 systemctl enable -q elasticsearch
 systemctl restart -q elasticsearch
 for i in $(seq 1 30); do
-  if curl -s http://localhost:9200 >/dev/null 2>&1; then
+  if curl -s http://127.0.0.1:9200 >/dev/null 2>&1; then
    break
  fi
  sleep 2
@@ -55,7 +56,7 @@ setup_deb822_repo \
  "$(get_os_info version_id)" \
  "main"
 $STD apt install -y zammad
-$STD zammad run rails r "Setting.set('es_url', 'http://localhost:9200')"
+$STD zammad run rails r "Setting.set('es_url', 'http://127.0.0.1:9200')"
 $STD zammad run rake zammad:searchindex:rebuild
 msg_ok "Installed Zammad"

--- a/misc/build.func
+++ b/misc/build.func
@@ -3600,9 +3600,9 @@ configure_ssh_settings() {
    glob_path=$(whiptail --backtitle "$backtitle" \
      --inputbox "Enter a folder or glob to scan (e.g. /root/.ssh/*.pub)" 10 72 --title "Scan Folder/Glob" 3>&1 1>&2 2>&3)
    if [[ -n "$glob_path" ]]; then
-      shopt -s nullglob
-      read -r -a _scan_files <<<"$glob_path"
-      shopt -u nullglob
+      [[ -d "$glob_path" ]] && glob_path="${glob_path%/}/*"
+      local -a _scan_files
+      mapfile -t _scan_files < <(compgen -G "$glob_path")
      if [[ "${#_scan_files[@]}" -gt 0 ]]; then
        ssh_build_choices_from_files "${_scan_files[@]}"
        if [[ "$COUNT" -gt 0 ]]; then
--- a/misc/tools.func
+++ b/misc/tools.func
@@ -2483,6 +2483,150 @@ verify_gpg_fingerprint() {
  return 65
 }

+# ------------------------------------------------------------------------------
+# _download_source_tarball <url> <dest> [curl args...]
+#
+# Downloads a source .tar.gz to <dest> and verifies the gzip stream is complete
+# before returning. Source forges (GitHub/GitLab/Codeberg) build these archives
+# on the fly; for large repos the response is occasionally a truncated-but-
+# cleanly-closed gzip that curl accepts as success (HTTP 200) and which then
+# fails at extraction time. We validate with `gzip -t` and re-download on
+# failure, and abort stalled transfers (--speed-time) so a hung generation
+# retries instead of blocking for minutes. Extra args pass through to curl
+# (e.g. auth headers like -H "PRIVATE-TOKEN: ...").
+#
+# Returns: 0 on success, 250 on persistent failure.
+# ------------------------------------------------------------------------------
+_download_source_tarball() {
+  local url="$1" dest="$2"
+  shift 2
+  local attempt max=3
+  for ((attempt = 1; attempt <= max; attempt++)); do
+    if curl --connect-timeout 15 --max-time 900 --speed-limit 1024 --speed-time 60 \
+      -fsSL "$@" -o "$dest" "$url" && gzip -t "$dest" 2>/dev/null; then
+      return 0
+    fi
+    rm -f "$dest"
+    ((attempt < max)) && {
+      msg_warn "Source archive download failed or incomplete (attempt ${attempt}/${max}), retrying..."
+      sleep $((attempt * 3))
+    }
+  done
+  return 250
+}
+
+# ------------------------------------------------------------------------------
+# _deploy_source_tarball <tarball_path> <target> <workdir>
+#
+# Shared tail for the *source tarball* modes of the fetch_and_deploy_* helpers
+# (GitHub/GitLab/Codeberg archive tarballs that contain a single top-level
+# directory). Extracts <tarball_path> into <workdir>, then copies the contents
+# of that top-level directory into <target>.
+#
+#   - Honors CLEAN_INSTALL=1 (wipes <target> first, dotfiles included).
+#   - Does NOT own <workdir>: the caller creates it and is responsible for its
+#     cleanup (typically via a RETURN trap on its tmpdir).
+#   - cp failures are non-fatal here, matching the previous inline behavior.
+#
+# Returns: 0 on success (or non-fatal cp failure), 251 on extraction failure.
+# ------------------------------------------------------------------------------
+_deploy_source_tarball() {
+  local tarball="$1" target="$2" workdir="$3"
+
+  mkdir -p "$target"
+  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
+    find "${target:?}" -mindepth 1 -delete
+  fi
+
+  tar --no-same-owner -xzf "$tarball" -C "$workdir" || {
+    msg_error "Failed to extract tarball"
+    return 251
+  }
+
+  local unpack_dir
+  unpack_dir=$(find "$workdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
+
+  shopt -s dotglob nullglob
+  cp -r "$unpack_dir"/* "$target/"
+  shopt -u dotglob nullglob
+  return 0
+}
+
+# ------------------------------------------------------------------------------
+# _deploy_unpacked_archive <archive_path> <target> <workdir>
+#
+# Shared tail for the *prebuild* modes of the fetch_and_deploy_*_release helpers
+# (release assets shipped as .zip / .tar.* / .tgz / .txz). Extracts the archive
+# into <workdir>, then copies its payload into <target>. If the archive contains
+# a single top-level directory, that directory is stripped (its contents land
+# directly in <target>); otherwise the archive contents are copied as-is.
+#
+#   - Honors CLEAN_INSTALL=1 (wipes <target> first, dotfiles included).
+#   - Does NOT own <workdir>: the caller creates it and cleans it up.
+#
+# Returns: 0 on success, 65 on unsupported format, 251 on extraction failure,
+#          252 on copy failure / empty archive.
+# ------------------------------------------------------------------------------
+_deploy_unpacked_archive() {
+  local archive="$1" target="$2" workdir="$3"
+  local filename="${archive##*/}"
+
+  mkdir -p "$target"
+  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
+    find "${target:?}" -mindepth 1 -delete
+  fi
+
+  if [[ "$filename" == *.zip ]]; then
+    ensure_dependencies unzip
+    unzip -q "$archive" -d "$workdir" || {
+      msg_error "Failed to extract ZIP archive"
+      return 251
+    }
+  elif [[ "$filename" == *.tar.* || "$filename" == *.tgz || "$filename" == *.txz ]]; then
+    tar --no-same-owner -xf "$archive" -C "$workdir" || {
+      msg_error "Failed to extract TAR archive"
+      return 251
+    }
+  else
+    msg_error "Unsupported archive format: $filename"
+    return 65
+  fi
+
+  local top_entries inner_dir
+  top_entries=$(find "$workdir" -mindepth 1 -maxdepth 1)
+  if [[ "$(echo "$top_entries" | wc -l)" -eq 1 && -d "$top_entries" ]]; then
+    inner_dir="$top_entries"
+    shopt -s dotglob nullglob
+    if compgen -G "$inner_dir/*" >/dev/null; then
+      cp -r "$inner_dir"/* "$target/" || {
+        msg_error "Failed to copy contents from $inner_dir to $target"
+        shopt -u dotglob nullglob
+        return 252
+      }
+    else
+      msg_error "Inner directory is empty: $inner_dir"
+      shopt -u dotglob nullglob
+      return 252
+    fi
+    shopt -u dotglob nullglob
+  else
+    shopt -s dotglob nullglob
+    if compgen -G "$workdir/*" >/dev/null; then
+      cp -r "$workdir"/* "$target/" || {
+        msg_error "Failed to copy contents to $target"
+        shopt -u dotglob nullglob
+        return 252
+      }
+    else
+      msg_error "Unpacked archive is empty"
+      shopt -u dotglob nullglob
+      return 252
+    fi
+    shopt -u dotglob nullglob
+  fi
+  return 0
+}
+
 # ------------------------------------------------------------------------------
 # Fetches and deploys a GitHub tag-based source tarball.
 #
@@ -2531,36 +2675,19 @@ fetch_and_deploy_gh_tag() {

  local tmpdir
  tmpdir=$(mktemp -d) || return 1
+  trap 'rm -rf "$tmpdir"' RETURN
  local tarball_url="https://github.com/${repo}/archive/refs/tags/${version}.tar.gz"
  local filename="${app_lc}-${version}.tar.gz"

  msg_info "Fetching GitHub tag: ${app} (${version})"

-  download_file "$tarball_url" "$tmpdir/$filename" || {
+  _download_source_tarball "$tarball_url" "$tmpdir/$filename" || {
    msg_error "Download failed: $tarball_url"
-    rm -rf "$tmpdir"
    return 7
  }

-  mkdir -p "$target"
-  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    rm -rf "${target:?}/"*
-  fi
+  _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 251

-  tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
-    msg_error "Failed to extract tarball"
-    rm -rf "$tmpdir"
-    return 251
-  }
-
-  local unpack_dir
-  unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
-
-  shopt -s dotglob nullglob
-  cp -r "$unpack_dir"/* "$target/"
-  shopt -u dotglob nullglob
-
-  rm -rf "$tmpdir"
  echo "$version" >"$version_file"
  msg_ok "Deployed ${app} ${version} to ${target}"
  return 0
@@ -2725,35 +2852,18 @@ fetch_and_deploy_gl_tag() {

  local tmpdir
  tmpdir=$(mktemp -d) || return 1
+  trap 'rm -rf "$tmpdir"' RETURN
  local filename="${app_lc}-${version_safe}.tar.gz"

  msg_info "Fetching GitLab tag: ${app} (${resolved_tag})"

-  curl $download_timeout -fsSL "${header[@]}" -o "$tmpdir/$filename" "$tarball_url" || {
+  _download_source_tarball "$tarball_url" "$tmpdir/$filename" "${header[@]}" || {
    msg_error "Download failed: $tarball_url"
-    rm -rf "$tmpdir"
    return 7
  }

-  mkdir -p "$target"
-  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    rm -rf "${target:?}/"*
-  fi
+  _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 251

-  tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
-    msg_error "Failed to extract tarball"
-    rm -rf "$tmpdir"
-    return 251
-  }
-
-  local unpack_dir
-  unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
-
-  shopt -s dotglob nullglob
-  cp -r "$unpack_dir"/* "$target/"
-  shopt -u dotglob nullglob
-
-  rm -rf "$tmpdir"
  echo "$resolved_tag" >"$version_file"
  msg_ok "Deployed ${app} ${resolved_tag} to ${target}"
  return 0
@@ -3450,6 +3560,7 @@ fetch_and_deploy_codeberg_release() {

    local tmpdir
    tmpdir=$(mktemp -d) || return 252
+    trap 'rm -rf "$tmpdir"' RETURN

    msg_info "Fetching Codeberg tag: $app ($tag_name)"

@@ -3460,37 +3571,19 @@ fetch_and_deploy_codeberg_release() {

    # Codeberg archive URL format: https://codeberg.org/{owner}/{repo}/archive/{tag}.tar.gz
    local archive_url="https://codeberg.org/$repo/archive/${tag_name}.tar.gz"
-    if curl_download "$tmpdir/$filename" "$archive_url"; then
+    if _download_source_tarball "$archive_url" "$tmpdir/$filename"; then
      download_success=true
    fi

    if [[ "$download_success" != "true" ]]; then
      msg_error "Download failed for $app ($tag_name)"
-      rm -rf "$tmpdir"
      return 250
    fi

-    mkdir -p "$target"
-    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      rm -rf "${target:?}/"*
-    fi
-
-    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
-      msg_error "Failed to extract tarball"
-      rm -rf "$tmpdir"
-      return 251
-    }
-
-    local unpack_dir
-    unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
-
-    shopt -s dotglob nullglob
-    cp -r "$unpack_dir"/* "$target/"
-    shopt -u dotglob nullglob
+    _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 251

    echo "$version" >"$version_file"
    msg_ok "Deployed: $app ($version)"
-    rm -rf "$tmpdir"
    return 0
  fi

@@ -3509,7 +3602,7 @@ fetch_and_deploy_codeberg_release() {

  local codeberg_rel_json
  codeberg_rel_json=$(mktemp /tmp/tools-codeberg-rel-XXXXXX) || return 73
-  trap 'rm -f "$codeberg_rel_json"' RETURN
+  trap 'rm -f "$codeberg_rel_json"; rm -rf "${tmpdir:-}" "${unpack_tmp:-}"' RETURN

  local attempt=0 success=false resp http_code

@@ -3563,32 +3656,16 @@ fetch_and_deploy_codeberg_release() {

    # Codeberg archive URL format
    local archive_url="https://codeberg.org/$repo/archive/${tag_name}.tar.gz"
-    if curl_download "$tmpdir/$filename" "$archive_url"; then
+    if _download_source_tarball "$archive_url" "$tmpdir/$filename"; then
      download_success=true
    fi

    if [[ "$download_success" != "true" ]]; then
      msg_error "Download failed for $app ($tag_name)"
-      rm -rf "$tmpdir"
      return 250
    fi

-    mkdir -p "$target"
-    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      rm -rf "${target:?}/"*
-    fi
-
-    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
-      msg_error "Failed to extract tarball"
-      rm -rf "$tmpdir"
-      return 251
-    }
-    local unpack_dir
-    unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
-
-    shopt -s dotglob nullglob
-    cp -r "$unpack_dir"/* "$target/"
-    shopt -u dotglob nullglob
+    _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 251

  ### Binary Mode ###
  elif [[ "$mode" == "binary" ]]; then
@@ -3636,14 +3713,12 @@ fetch_and_deploy_codeberg_release() {

    if [[ -z "$url_match" ]]; then
      msg_error "No suitable .deb asset found for $app"
-      rm -rf "$tmpdir"
      return 252
    fi

    filename="${url_match##*/}"
    curl_download "$tmpdir/$filename" "$url_match" || {
      msg_error "Download failed: $url_match"
-      rm -rf "$tmpdir"
      return 250
    }

@@ -3651,7 +3726,6 @@ fetch_and_deploy_codeberg_release() {
    $STD apt install -y "$tmpdir/$filename" || {
      $STD dpkg -i "$tmpdir/$filename" || {
        _diagnose_deb_failure "$tmpdir/$filename"
-        rm -rf "$tmpdir"
        return 100
      }
    }
@@ -3662,7 +3736,6 @@ fetch_and_deploy_codeberg_release() {
    pattern="${pattern#\"}"
    [[ -z "$pattern" ]] && {
      msg_error "Mode 'prebuild' requires 6th parameter (asset filename pattern)"
-      rm -rf "$tmpdir"
      return 65
    }

@@ -3679,77 +3752,18 @@ fetch_and_deploy_codeberg_release() {

    [[ -z "$asset_url" ]] && {
      msg_error "No asset matching '$pattern' found"
-      rm -rf "$tmpdir"
      return 252
    }

    filename="${asset_url##*/}"
    curl_download "$tmpdir/$filename" "$asset_url" || {
      msg_error "Download failed: $asset_url"
-      rm -rf "$tmpdir"
      return 250
    }

    local unpack_tmp
    unpack_tmp=$(mktemp -d)
-    mkdir -p "$target"
-    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      rm -rf "${target:?}/"*
-    fi
-
-    if [[ "$filename" == *.zip ]]; then
-      ensure_dependencies unzip
-      unzip -q "$tmpdir/$filename" -d "$unpack_tmp" || {
-        msg_error "Failed to extract ZIP archive"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 251
-      }
-    elif [[ "$filename" == *.tar.* || "$filename" == *.tgz ]]; then
-      tar --no-same-owner -xf "$tmpdir/$filename" -C "$unpack_tmp" || {
-        msg_error "Failed to extract TAR archive"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 251
-      }
-    else
-      msg_error "Unsupported archive format: $filename"
-      rm -rf "$tmpdir" "$unpack_tmp"
-      return 251
-    fi
-
-    local top_dirs
-    top_dirs=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1 -type d | wc -l)
-    local top_entries inner_dir
-    top_entries=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1)
-    if [[ "$(echo "$top_entries" | wc -l)" -eq 1 && -d "$top_entries" ]]; then
-      inner_dir="$top_entries"
-      shopt -s dotglob nullglob
-      if compgen -G "$inner_dir/*" >/dev/null; then
-        cp -r "$inner_dir"/* "$target/" || {
-          msg_error "Failed to copy contents from $inner_dir to $target"
-          rm -rf "$tmpdir" "$unpack_tmp"
-          return 252
-        }
-      else
-        msg_error "Inner directory is empty: $inner_dir"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 252
-      fi
-      shopt -u dotglob nullglob
-    else
-      shopt -s dotglob nullglob
-      if compgen -G "$unpack_tmp/*" >/dev/null; then
-        cp -r "$unpack_tmp"/* "$target/" || {
-          msg_error "Failed to copy contents to $target"
-          rm -rf "$tmpdir" "$unpack_tmp"
-          return 252
-        }
-      else
-        msg_error "Unpacked archive is empty"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 252
-      fi
-      shopt -u dotglob nullglob
-    fi
+    _deploy_unpacked_archive "$tmpdir/$filename" "$target" "$unpack_tmp" || return

  ### Singlefile Mode ###
  elif [[ "$mode" == "singlefile" ]]; then
@@ -3757,7 +3771,6 @@ fetch_and_deploy_codeberg_release() {
    pattern="${pattern#\"}"
    [[ -z "$pattern" ]] && {
      msg_error "Mode 'singlefile' requires 6th parameter (asset filename pattern)"
-      rm -rf "$tmpdir"
      return 65
    }

@@ -3774,7 +3787,6 @@ fetch_and_deploy_codeberg_release() {

    [[ -z "$asset_url" ]] && {
      msg_error "No asset matching '$pattern' found"
-      rm -rf "$tmpdir"
      return 252
    }

@@ -3787,7 +3799,6 @@ fetch_and_deploy_codeberg_release() {

    curl_download "$target/$target_file" "$asset_url" || {
      msg_error "Download failed: $asset_url"
-      rm -rf "$tmpdir"
      return 250
    }

@@ -3797,13 +3808,11 @@ fetch_and_deploy_codeberg_release() {

  else
    msg_error "Unknown mode: $mode"
-    rm -rf "$tmpdir"
    return 65
  fi

  echo "$version" >"$version_file"
  msg_ok "Deployed: $app ($version)"
-  rm -rf "$tmpdir"
 }

 # ------------------------------------------------------------------------------
@@ -4090,6 +4099,7 @@ fetch_and_deploy_gh_release() {

  local tmpdir
  tmpdir=$(mktemp -d) || return 1
+  trap 'rm -rf "$tmpdir" "${unpack_tmp:-}"' RETURN
  local filename="" url=""

  msg_info "Fetching GitHub release: $app ($version)"
@@ -4104,28 +4114,12 @@ fetch_and_deploy_gh_release() {
    local direct_tarball_url="https://github.com/$repo/archive/refs/tags/$tag_name.tar.gz"
    filename="${app_lc}-${version_safe}.tar.gz"

-    curl_download "$tmpdir/$filename" "$direct_tarball_url" || {
+    _download_source_tarball "$direct_tarball_url" "$tmpdir/$filename" || {
      msg_error "Download failed: $direct_tarball_url"
-      rm -rf "$tmpdir"
      return 250
    }

-    mkdir -p "$target"
-    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      rm -rf "${target:?}/"*
-    fi
-
-    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
-      msg_error "Failed to extract tarball"
-      rm -rf "$tmpdir"
-      return 251
-    }
-    local unpack_dir
-    unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
-
-    shopt -s dotglob nullglob
-    cp -r "$unpack_dir"/* "$target/"
-    shopt -u dotglob nullglob
+    _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 251

    ### Binary Mode ###
  elif [[ "$mode" == "binary" ]]; then
@@ -4210,14 +4204,12 @@ fetch_and_deploy_gh_release() {

    if [[ -z "$url_match" ]]; then
      msg_error "No suitable .deb asset found for $app"
-      rm -rf "$tmpdir"
      return 252
    fi

    filename="${url_match##*/}"
    curl_download "$tmpdir/$filename" "$url_match" || {
      msg_error "Download failed: $url_match"
-      rm -rf "$tmpdir"
      return 250
    }

@@ -4230,7 +4222,6 @@ fetch_and_deploy_gh_release() {
    DEBIAN_FRONTEND=noninteractive SYSTEMD_OFFLINE=1 $STD apt install -y $dpkg_opts "$tmpdir/$filename" || {
      SYSTEMD_OFFLINE=1 $STD dpkg -i "$tmpdir/$filename" || {
        _diagnose_deb_failure "$tmpdir/$filename"
-        rm -rf "$tmpdir"
        return 100
      }
    }
@@ -4241,7 +4232,6 @@ fetch_and_deploy_gh_release() {
    pattern="${pattern#\"}"
    [[ -z "$pattern" ]] && {
      msg_error "Mode 'prebuild' requires 6th parameter (asset filename pattern)"
-      rm -rf "$tmpdir"
      return 65
    }

@@ -4277,79 +4267,18 @@ fetch_and_deploy_gh_release() {

    [[ -z "$asset_url" ]] && {
      msg_error "No asset matching '$pattern' found"
-      rm -rf "$tmpdir"
      return 252
    }

    filename="${asset_url##*/}"
    curl_download "$tmpdir/$filename" "$asset_url" || {
      msg_error "Download failed: $asset_url"
-      rm -rf "$tmpdir"
      return 250
    }

    local unpack_tmp
    unpack_tmp=$(mktemp -d)
-    mkdir -p "$target"
-    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      rm -rf "${target:?}/"*
-    fi
-
-    if [[ "$filename" == *.zip ]]; then
-      ensure_dependencies unzip
-      unzip -q "$tmpdir/$filename" -d "$unpack_tmp" || {
-        msg_error "Failed to extract ZIP archive"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 251
-      }
-    elif [[ "$filename" == *.tar.* || "$filename" == *.tgz || "$filename" == *.txz ]]; then
-      tar --no-same-owner -xf "$tmpdir/$filename" -C "$unpack_tmp" || {
-        msg_error "Failed to extract TAR archive"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 251
-      }
-    else
-      msg_error "Unsupported archive format: $filename"
-      rm -rf "$tmpdir" "$unpack_tmp"
-      return 65
-    fi
-
-    local top_dirs
-    top_dirs=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1 -type d | wc -l)
-    local top_entries inner_dir
-    top_entries=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1)
-    if [[ "$(echo "$top_entries" | wc -l)" -eq 1 && -d "$top_entries" ]]; then
-      # Strip leading folder
-      inner_dir="$top_entries"
-      shopt -s dotglob nullglob
-      if compgen -G "$inner_dir/*" >/dev/null; then
-        cp -r "$inner_dir"/* "$target/" || {
-          msg_error "Failed to copy contents from $inner_dir to $target"
-          rm -rf "$tmpdir" "$unpack_tmp"
-          return 252
-        }
-      else
-        msg_error "Inner directory is empty: $inner_dir"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 252
-      fi
-      shopt -u dotglob nullglob
-    else
-      # Copy all contents
-      shopt -s dotglob nullglob
-      if compgen -G "$unpack_tmp/*" >/dev/null; then
-        cp -r "$unpack_tmp"/* "$target/" || {
-          msg_error "Failed to copy contents to $target"
-          rm -rf "$tmpdir" "$unpack_tmp"
-          return 252
-        }
-      else
-        msg_error "Unpacked archive is empty"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 252
-      fi
-      shopt -u dotglob nullglob
-    fi
+    _deploy_unpacked_archive "$tmpdir/$filename" "$target" "$unpack_tmp" || return

    ### Singlefile Mode ###
  elif [[ "$mode" == "singlefile" ]]; then
@@ -4357,7 +4286,6 @@ fetch_and_deploy_gh_release() {
    pattern="${pattern#\"}"
    [[ -z "$pattern" ]] && {
      msg_error "Mode 'singlefile' requires 6th parameter (asset filename pattern)"
-      rm -rf "$tmpdir"
      return 65
    }

@@ -4392,7 +4320,6 @@ fetch_and_deploy_gh_release() {
    fi
    [[ -z "$asset_url" ]] && {
      msg_error "No asset matching '$pattern' found"
-      rm -rf "$tmpdir"
      return 252
    }

@@ -4405,7 +4332,6 @@ fetch_and_deploy_gh_release() {

    curl_download "$target/$target_file" "$asset_url" || {
      msg_error "Download failed: $asset_url"
-      rm -rf "$tmpdir"
      return 250
    }

@@ -4415,13 +4341,11 @@ fetch_and_deploy_gh_release() {

  else
    msg_error "Unknown mode: $mode"
-    rm -rf "$tmpdir"
    return 65
  fi

  echo "$version" >"$version_file"
  msg_ok "Deployed: $app ($version)"
-  rm -rf "$tmpdir"
 }

 # ------------------------------------------------------------------------------
@@ -7157,7 +7081,7 @@ setup_meilisearch() {
        MEILI_DB_PATH="${MEILI_DB_PATH:-/var/lib/meilisearch/data}"

        msg_info "Removing old MeiliSearch database for migration"
-        rm -rf "${MEILI_DB_PATH:?}"/*
+        find "${MEILI_DB_PATH:?}" -mindepth 1 -delete

        # Import dump using CLI flag (this is the supported method)
        local DUMP_FILE="${MEILI_DUMP_DIR}/${DUMP_UID}.dump"
@@ -8713,6 +8637,11 @@ setup_ruby() {
  local BASHRC_FILE="$HOME/.bashrc"
  local TMP_DIR=$(mktemp -d)

+  # Ensure HOME exists: callers may pass a not-yet-created home (e.g. a service
+  # user that is created later in the install), so the profile writes below do
+  # not fail on a missing directory.
+  mkdir -p "$HOME"
+
  if ! grep -q 'rbenv init' "$PROFILE_FILE" 2>/dev/null; then
    cat <<'EOF' >>"$PROFILE_FILE"
 export PATH="$HOME/.rbenv/bin:$PATH"
@@ -9131,6 +9060,16 @@ setup_uv() {
      msg_ok "uvx wrapper installed"
    fi

+    # Install specific Python version if requested (even when uv is already up to date)
+    if [[ -n "${PYTHON_VERSION:-}" ]]; then
+      msg_info "Installing Python $PYTHON_VERSION via uv"
+      $STD uv python install "$PYTHON_VERSION" || {
+        msg_error "Failed to install Python $PYTHON_VERSION"
+        return 150
+      }
+      msg_ok "Python $PYTHON_VERSION installed"
+    fi
+
    return 0
  fi

@@ -9333,10 +9272,10 @@ fetch_and_deploy_from_url() {
    msg_error "Failed to create temporary directory"
    return 252
  }
+  trap 'rm -rf "$tmpdir" "${unpack_tmp:-}"' RETURN

  curl -fsSL -o "$tmpdir/$filename" "$url" || {
    msg_error "Download failed: $url"
-    rm -rf "$tmpdir"
    return 250
  }

@@ -9356,7 +9295,6 @@ fetch_and_deploy_from_url() {
    archive_type="tar"
  else
    msg_error "Unsupported or unknown archive type: $file_desc"
-    rm -rf "$tmpdir"
    return 65
  fi

@@ -9369,19 +9307,16 @@ fetch_and_deploy_from_url() {
    $STD apt install -y "$tmpdir/$filename" || {
      $STD dpkg -i "$tmpdir/$filename" || {
        _diagnose_deb_failure "$tmpdir/$filename"
-        rm -rf "$tmpdir"
        return 100
      }
    }

-    rm -rf "$tmpdir"
    msg_ok "Successfully installed .deb package"
    return 0
  fi

  if [[ -z "$directory" ]]; then
    msg_error "Directory parameter is required for archive extraction"
-    rm -rf "$tmpdir"
    return 65
  fi

@@ -9390,7 +9325,7 @@ fetch_and_deploy_from_url() {
  mkdir -p "$directory"

  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    rm -rf "${directory:?}/"*
+    find "${directory:?}" -mindepth 1 -delete
  fi

  local unpack_tmp
@@ -9400,13 +9335,11 @@ fetch_and_deploy_from_url() {
    ensure_dependencies unzip
    unzip -q "$tmpdir/$filename" -d "$unpack_tmp" || {
      msg_error "Failed to extract ZIP archive"
-      rm -rf "$tmpdir" "$unpack_tmp"
      return 251
    }
  elif [[ "$archive_type" == "tar" ]]; then
    tar --no-same-owner -xf "$tmpdir/$filename" -C "$unpack_tmp" || {
      msg_error "Failed to extract TAR archive"
-      rm -rf "$tmpdir" "$unpack_tmp"
      return 251
    }
  fi
@@ -9420,12 +9353,12 @@ fetch_and_deploy_from_url() {
    if compgen -G "$inner_dir/*" >/dev/null; then
      cp -r "$inner_dir"/* "$directory/" || {
        msg_error "Failed to copy contents from $inner_dir to $directory"
-        rm -rf "$tmpdir" "$unpack_tmp"
+        shopt -u dotglob nullglob
        return 252
      }
    else
      msg_error "Inner directory is empty: $inner_dir"
-      rm -rf "$tmpdir" "$unpack_tmp"
+      shopt -u dotglob nullglob
      return 252
    fi
    shopt -u dotglob nullglob
@@ -9434,18 +9367,17 @@ fetch_and_deploy_from_url() {
    if compgen -G "$unpack_tmp/*" >/dev/null; then
      cp -r "$unpack_tmp"/* "$directory/" || {
        msg_error "Failed to copy contents to $directory"
-        rm -rf "$tmpdir" "$unpack_tmp"
+        shopt -u dotglob nullglob
        return 252
      }
    else
      msg_error "Unpacked archive is empty"
-      rm -rf "$tmpdir" "$unpack_tmp"
+      shopt -u dotglob nullglob
      return 252
    fi
    shopt -u dotglob nullglob
  fi

-  rm -rf "$tmpdir" "$unpack_tmp"
  msg_ok "Successfully deployed archive to $directory"
  return 0
 }
@@ -9846,7 +9778,7 @@ fetch_and_deploy_gl_release() {

  local gl_rel_json
  gl_rel_json=$(mktemp /tmp/tools-gl-rel-XXXXXX) || return 73
-  trap 'rm -f "$gl_rel_json"' RETURN
+  trap 'rm -f "$gl_rel_json"; rm -rf "${tmpdir:-}" "${unpack_tmp:-}"' RETURN

  local repo_encoded
  repo_encoded=$(printf '%s' "$repo" | sed 's|/|%2F|g')
@@ -9958,28 +9890,12 @@ fetch_and_deploy_gl_release() {
    local direct_tarball_url="https://gitlab.com/$repo/-/archive/$tag_name/${app_lc}-${version_safe}.tar.gz"
    filename="${app_lc}-${version_safe}.tar.gz"

-    curl $download_timeout -fsSL "${header[@]}" -o "$tmpdir/$filename" "$direct_tarball_url" || {
+    _download_source_tarball "$direct_tarball_url" "$tmpdir/$filename" "${header[@]}" || {
      msg_error "Download failed: $direct_tarball_url"
-      rm -rf "$tmpdir"
      return 1
    }

-    mkdir -p "$target"
-    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      rm -rf "${target:?}/"*
-    fi
-
-    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
-      msg_error "Failed to extract tarball"
-      rm -rf "$tmpdir"
-      return 1
-    }
-    local unpack_dir
-    unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
-
-    shopt -s dotglob nullglob
-    cp -r "$unpack_dir"/* "$target/"
-    shopt -u dotglob nullglob
+    _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 1

  ### Binary Mode ###
  elif [[ "$mode" == "binary" ]]; then
@@ -10049,14 +9965,12 @@ fetch_and_deploy_gl_release() {

    if [[ -z "$url_match" ]]; then
      msg_error "No suitable .deb asset found for $app"
-      rm -rf "$tmpdir"
      return 1
    fi

    filename="${url_match##*/}"
    curl $download_timeout -fsSL "${header[@]}" -o "$tmpdir/$filename" "$url_match" || {
      msg_error "Download failed: $url_match"
-      rm -rf "$tmpdir"
      return 1
    }

@@ -10067,7 +9981,6 @@ fetch_and_deploy_gl_release() {
    DEBIAN_FRONTEND=noninteractive SYSTEMD_OFFLINE=1 $STD apt install -y $dpkg_opts "$tmpdir/$filename" || {
      SYSTEMD_OFFLINE=1 $STD dpkg -i "$tmpdir/$filename" || {
        _diagnose_deb_failure "$tmpdir/$filename"
-        rm -rf "$tmpdir"
        return 1
      }
    }
@@ -10078,7 +9991,6 @@ fetch_and_deploy_gl_release() {
    pattern="${pattern#\"}"
    [[ -z "$pattern" ]] && {
      msg_error "Mode 'prebuild' requires 6th parameter (asset filename pattern)"
-      rm -rf "$tmpdir"
      return 1
    }

@@ -10113,75 +10025,18 @@ fetch_and_deploy_gl_release() {

    [[ -z "$asset_url" ]] && {
      msg_error "No asset matching '$pattern' found"
-      rm -rf "$tmpdir"
      return 1
    }

    filename="${asset_url##*/}"
    curl $download_timeout -fsSL "${header[@]}" -o "$tmpdir/$filename" "$asset_url" || {
      msg_error "Download failed: $asset_url"
-      rm -rf "$tmpdir"
      return 1
    }

    local unpack_tmp
    unpack_tmp=$(mktemp -d)
-    mkdir -p "$target"
-    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      rm -rf "${target:?}/"*
-    fi
-
-    if [[ "$filename" == *.zip ]]; then
-      ensure_dependencies unzip
-      unzip -q "$tmpdir/$filename" -d "$unpack_tmp" || {
-        msg_error "Failed to extract ZIP archive"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 1
-      }
-    elif [[ "$filename" == *.tar.* || "$filename" == *.tgz || "$filename" == *.txz ]]; then
-      tar --no-same-owner -xf "$tmpdir/$filename" -C "$unpack_tmp" || {
-        msg_error "Failed to extract TAR archive"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 1
-      }
-    else
-      msg_error "Unsupported archive format: $filename"
-      rm -rf "$tmpdir" "$unpack_tmp"
-      return 1
-    fi
-
-    local top_entries inner_dir
-    top_entries=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1)
-    if [[ "$(echo "$top_entries" | wc -l)" -eq 1 && -d "$top_entries" ]]; then
-      inner_dir="$top_entries"
-      shopt -s dotglob nullglob
-      if compgen -G "$inner_dir/*" >/dev/null; then
-        cp -r "$inner_dir"/* "$target/" || {
-          msg_error "Failed to copy contents from $inner_dir to $target"
-          rm -rf "$tmpdir" "$unpack_tmp"
-          return 1
-        }
-      else
-        msg_error "Inner directory is empty: $inner_dir"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 1
-      fi
-      shopt -u dotglob nullglob
-    else
-      shopt -s dotglob nullglob
-      if compgen -G "$unpack_tmp/*" >/dev/null; then
-        cp -r "$unpack_tmp"/* "$target/" || {
-          msg_error "Failed to copy contents to $target"
-          rm -rf "$tmpdir" "$unpack_tmp"
-          return 1
-        }
-      else
-        msg_error "Unpacked archive is empty"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 1
-      fi
-      shopt -u dotglob nullglob
-    fi
+    _deploy_unpacked_archive "$tmpdir/$filename" "$target" "$unpack_tmp" || return

  ### Singlefile Mode ###
  elif [[ "$mode" == "singlefile" ]]; then
@@ -10189,7 +10044,6 @@ fetch_and_deploy_gl_release() {
    pattern="${pattern#\"}"
    [[ -z "$pattern" ]] && {
      msg_error "Mode 'singlefile' requires 6th parameter (asset filename pattern)"
-      rm -rf "$tmpdir"
      return 1
    }

@@ -10224,7 +10078,6 @@ fetch_and_deploy_gl_release() {

    [[ -z "$asset_url" ]] && {
      msg_error "No asset matching '$pattern' found"
-      rm -rf "$tmpdir"
      return 1
    }

@@ -10237,7 +10090,6 @@ fetch_and_deploy_gl_release() {

    curl $download_timeout -fsSL "${header[@]}" -o "$target/$target_file" "$asset_url" || {
      msg_error "Download failed: $asset_url"
-      rm -rf "$tmpdir"
      return 1
    }

@@ -10247,13 +10099,11 @@ fetch_and_deploy_gl_release() {

  else
    msg_error "Unknown mode: $mode"
-    rm -rf "$tmpdir"
    return 1
  fi

  echo "$version" >"$version_file"
  msg_ok "Deployed: $app ($version)"
-  rm -rf "$tmpdir"
 }

 # ------------------------------------------------------------------------------
--- a/tools/pve/cron-update-lxcs.sh
+++ b/tools/pve/cron-update-lxcs.sh
@@ -116,6 +116,9 @@ add() {
 # Add container IDs to exclude from updates (comma-separated):
 # EXCLUDE=100,101,102
 EXCLUDE=
+
+# Healthchecks.io Ping URL (optional)
+# PING_URL=
 CONF
    ok "Created config ${CONF_FILE}"
  fi
@@ -235,9 +238,11 @@ view_cron_config() {
  fi
  if [[ -f "$CONF_FILE" ]]; then
    echo -e " \e[36mConfig file:\e[0m ${CONF_FILE}"
-    local excludes
+    local excludes ping_url
    excludes=$(grep -oP '^\s*EXCLUDE\s*=\s*\K.*' "$CONF_FILE" 2>/dev/null || true)
+    ping_url=$(grep -oP '^\s*PING_URL\s*=\s*\K.*' "$CONF_FILE" 2>/dev/null | tr -d '"' | tr -d "'" || true)
    echo -e " \e[36mExcluded:\e[0m    ${excludes:-(none)}"
+    echo -e " \e[36mPing URL:\e[0m    ${ping_url:-(none)}"
    echo ""
    echo -e " \e[90m--- ${CONF_FILE} ---\e[0m"
    cat "$CONF_FILE"
@@ -284,9 +289,11 @@ show_status() {
  fi

  if [[ -f "$CONF_FILE" ]]; then
-    local excludes
+    local excludes ping_url
    excludes=$(grep -oP '^\s*EXCLUDE\s*=\s*\K.*' "$CONF_FILE" 2>/dev/null || echo "(none)")
+    ping_url=$(grep -oP '^\s*PING_URL\s*=\s*\K.*' "$CONF_FILE" 2>/dev/null | tr -d '"' | tr -d "'" || echo "(none)")
    echo -e "   \e[36mExcluded:\e[0m  ${excludes:-"(none)"}"
+    echo -e "   \e[36mPing URL:\e[0m  ${ping_url:-"(none)"}"
  fi

  if [[ -f "$LOG_FILE" ]]; then
--- a/tools/pve/update-lxcs-cron.sh
+++ b/tools/pve/update-lxcs-cron.sh
@@ -11,14 +11,15 @@
 export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

 CONF_FILE="/etc/update-lxcs.conf"
-
-echo -e "\n $(date)"
+LOG_FILE="/var/log/update-lxcs-cron.log"
+PING_URL=""

 # Collect excluded containers from arguments
 excluded_containers=("$@")

-# Merge exclusions from config file if it exists
+# Merge exclusions and healthchecks URL from config file if it exists
 if [[ -f "$CONF_FILE" ]]; then
+  PING_URL=$(grep -oP '^\s*PING_URL\s*=\s*\K.+' "$CONF_FILE" 2>/dev/null | tr -d '"' | tr -d "'" || true)
  conf_exclude=$(grep -oP '^\s*EXCLUDE\s*=\s*\K[0-9,]+' "$CONF_FILE" 2>/dev/null || true)
  IFS=',' read -ra conf_ids <<<"$conf_exclude"
  for id in "${conf_ids[@]}"; do
@@ -27,6 +28,17 @@ if [[ -f "$CONF_FILE" ]]; then
  done
 fi

+# Overwrite logfile on each run when healthchecks is used
+if [[ -n "$PING_URL" ]]; then
+  true > "$LOG_FILE"
+fi
+
+if [[ -n "$PING_URL" ]]; then
+  curl -fsS -m 10 --retry 5 "${PING_URL}/start" -o /dev/null 2>/dev/null || true
+fi
+
+echo -e "\n $(date)"
+
 function update_container() {
  local container=$1
  local name
@@ -38,12 +50,36 @@ function update_container() {
  alpine) pct exec "$container" -- ash -c "apk -U upgrade" ;;
  archlinux) pct exec "$container" -- bash -c "pacman -Syyu --noconfirm" ;;
  fedora | rocky | centos | alma) pct exec "$container" -- bash -c "dnf -y update && dnf -y upgrade" ;;
-  ubuntu | debian | devuan) pct exec "$container" -- bash -c "apt-get update && DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::='--force-confold' dist-upgrade -y; rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED" ;;
+  ubuntu | debian | devuan) pct exec "$container" -- bash -c "apt-get update; DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::='--force-confold' dist-upgrade -y; status=\$?; rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED || true; exit \$status" ;;
  opensuse) pct exec "$container" -- bash -c "zypper ref && zypper --non-interactive dup" ;;
  *) echo " [Warn] Unknown OS type '$os' for container $container, skipping" ;;
  esac
 }

+update_status=0
+
+# Define exit handler to send healthchecks.io status (with logfile on failure/success)
+function exit_handler() {
+  local exit_code=$?
+  if [[ -n "$PING_URL" ]]; then
+    sync
+    if [[ $exit_code -ne 0 || $update_status -ne 0 ]]; then
+      if [[ -f "$LOG_FILE" ]]; then
+        curl -fsS -m 10 --retry 5 --data-binary @"$LOG_FILE" "${PING_URL}/fail" -o /dev/null 2>/dev/null || true
+      else
+        curl -fsS -m 10 --retry 5 "${PING_URL}/fail" -o /dev/null 2>/dev/null || true
+      fi
+    else
+      if [[ -f "$LOG_FILE" ]]; then
+        curl -fsS -m 10 --retry 5 --data-binary @"$LOG_FILE" "$PING_URL" -o /dev/null 2>/dev/null || true
+      else
+        curl -fsS -m 10 --retry 5 "$PING_URL" -o /dev/null 2>/dev/null || true
+      fi
+    fi
+  fi
+}
+trap exit_handler EXIT
+
 for container in $(pct list | awk '{if(NR>1) print $1}'); do
  excluded=false
  for excluded_container in "${excluded_containers[@]}"; do
@@ -65,7 +101,7 @@ for container in $(pct list | awk '{if(NR>1) print $1}'); do
      echo -e "[Info] Starting $container"
      pct start "$container"
      sleep 5
-      update_container "$container" || echo " [Error] Update failed for $container"
+      update_container "$container" || { echo " [Error] Update failed for $container"; update_status=1; }
      # check if patchmon agent is present in container and run a report if found
      if pct exec "$container" -- [ -e "/usr/local/bin/patchmon-agent" ]; then
        echo -e "${BL}[Info]${GN} patchmon-agent found in ${BL} $container ${CL}, triggering report. \n"
@@ -74,7 +110,7 @@ for container in $(pct list | awk '{if(NR>1) print $1}'); do
      echo -e "[Info] Shutting down $container"
      pct shutdown "$container" --timeout 60 &
    elif [ "$status" == "status: running" ]; then
-      update_container "$container" || echo " [Error] Update failed for $container"
+      update_container "$container" || { echo " [Error] Update failed for $container"; update_status=1; }
      # check if patchmon agent is present in container and run a report if found
      if pct exec "$container" -- [ -e "/usr/local/bin/patchmon-agent" ]; then
        echo -e "${BL}[Info]${GN} patchmon-agent found in ${BL} $container ${CL}, triggering report. \n"
--- a/vm/opnsense-vm.sh
+++ b/vm/opnsense-vm.sh
@@ -24,7 +24,7 @@ RANDOM_UUID="$(cat /proc/sys/kernel/random/uuid)"
 METHOD=""
 NSAPP="opnsense-vm"
 var_os="opnsense"
-var_version="26.1"
+var_version="26.7"
 #
 GEN_MAC=02:$(openssl rand -hex 5 | awk '{print toupper($0)}' | sed 's/\(..\)/\1:/g; s/.$//')
 GEN_MAC_LAN=02:$(openssl rand -hex 5 | awk '{print toupper($0)}' | sed 's/\(..\)/\1:/g; s/.$//')
@@ -814,7 +814,7 @@ if [ -n "$WAN_BRG" ]; then
  msg_ok "WAN interface added"
  sleep 5 # Brief pause after adding network interface
 fi
-send_line_to_vm "sh ./opnsense-bootstrap.sh.in -y -f -r 26.1"
+send_line_to_vm "sh ./opnsense-bootstrap.sh.in -y -f -r 26.7"
 msg_ok "OPNsense VM is being installed, do not close the terminal, or the installation will fail."
 #We need to wait for the OPNsense build proccess to finish, this takes a few minutes
 sleep 1000
Author	SHA1	Message	Date
MickLesk	681d4f6255	Bind Elasticsearch to 127.0.0.1 in Zammad install Explicitly bind Elasticsearch to 127.0.0.1 instead of relying on localhost resolution. Updates elasticsearch.yml, health check curl, and Zammad ES URL setting to use 127.0.0.1 for consistency and to avoid potential IPv6 resolution issues.	2026-07-20 08:53:51 +02:00
community-scripts-pr-app[bot]	026fd25e7a	Update CHANGELOG.md (#15904 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 17:02:04 +00:00
TowyTowy	e1ce55b547	fix(build.func): expand glob in SSH key "Scan Folder/Glob" so it can find keys (#15873 ) Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Sam Heinz <sam@samheinz.com>	2026-07-19 19:01:41 +02:00
community-scripts-pr-app[bot]	d81c9f3ed2	Update CHANGELOG.md (#15900 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 12:54:11 +00:00
CanbiZ (MickLesk)	b098501a37	tools.func: centralize deploy tail + trap-based tmpdir cleanup (#15872 ) * tools.func: replace rm -rf with find for safer directory cleanup * tools.func: replace rm -rf with find for safer directory cleanup * refactor(tools.func): centralize deploy tail + trap-based tmpdir cleanup Extract the duplicated post-download logic of the fetch_and_deploy_* helpers into two shared functions and switch per-branch cleanup to a single RETURN trap. - _deploy_source_tarball: shared source-tarball tail (6 call sites) - _deploy_unpacked_archive: shared prebuild-archive tail (3 call sites) - RETURN trap per function guarantees tmpdir/unpack_tmp cleanup on every return path, replacing ~40 manual `rm -rf "$tmpdir"` lines - CLEAN_INSTALL now lives in the helpers instead of 12 copies Behavior-preserving except: codeberg prebuild gains .txz support and uses helper return codes; from_url resets shopt on error paths. * Add _download_source_tarball with retry/validation Introduce `_download_source_tarball` helper that validates gzip integrity after download and retries up to 3 times. This guards against truncated-but-valid-HTTP responses from GitHub/GitLab/Codeberg on-the-fly archive generation. Replace ad-hoc curl/curl_download calls in fetch_and_deploy_* functions with the new helper. Also remove redundant tmpdir cleanup before early returns (tmpdir is cleaned up at function exit). * Fix Manyfold Ruby setup home initialization Create the `manyfold` service user before calling `setup_ruby` so `/home/manyfold` exists when rbenv profile snippets are written. Also harden `setup_ruby` by creating `$HOME` if missing, preventing profile-write failures for installers that pass a home directory before creating the user. * Update install/manyfold-install.sh --------- Co-authored-by: Sam Heinz <sam@samheinz.com>	2026-07-19 22:53:46 +10:00
community-scripts-pr-app[bot]	a1058256be	Update CHANGELOG.md (#15899 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 12:53:02 +00:00
tdn131	e425d9c02c	Update OPNsense from 26.1 to 26.7 (#15895 )	2026-07-19 22:52:42 +10:00
community-scripts-pr-app[bot]	0dbea508d3	Update CHANGELOG.md (#15898 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 12:03:22 +00:00
Sam Heinz	787e27a4ac	change trek repo to liketrek/TREK (#15893 )	2026-07-19 14:02:56 +02:00
community-scripts-pr-app[bot]	8f0083850e	Update CHANGELOG.md (#15896 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 11:21:43 +00:00
thieneret	8f9c4eb13b	update authentik to 2026.5.5 (#15855 )	2026-07-19 13:21:14 +02:00
community-scripts-pr-app[bot]	beacf9e43a	Update CHANGELOG.md (#15892 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 09:17:11 +00:00
Chris	b2898debce	[FIX] BookOrbit: add missing `restore_backup` during update (#15881 ) - Otherwise the `.env` file is not restored and the sed command fails	2026-07-19 19:16:44 +10:00
community-scripts-pr-app[bot]	8c7da1e036	Update CHANGELOG.md (#15887 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 07:42:15 +00:00
CanbiZ (MickLesk)	bbd5a3f522	Revert "add configurable host CA inheritance for LXC bootstrap (#15840 )" (#15886 ) This reverts commit `eb5a5b2cb7`.	2026-07-19 09:41:52 +02:00
community-scripts-pr-app[bot]	c07dc4a4c3	Update CHANGELOG.md (#15884 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 00:17:46 +00:00
community-scripts-pr-app[bot]	e7f6a6d4cd	Archive old changelog entries (#15883 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 00:17:24 +00:00
community-scripts-pr-app[bot]	3242b9a2d1	Update CHANGELOG.md (#15879 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-18 22:10:27 +00:00
CanbiZ (MickLesk)	38ed344e0a	tools.func: Safe Delete Directorys & Update PYTHON_VERSION with setup_uv (#15870 )	2026-07-19 00:10:06 +02:00
community-scripts-pr-app[bot]	658aad229a	Update CHANGELOG.md (#15878 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-18 21:21:41 +00:00
Michel Roegl-Brunner	eb5a5b2cb7	add configurable host CA inheritance for LXC bootstrap (#15840 ) Introduce host CA certificate propagation in the shared LXC build flow so containers can trust enterprise/private PKI roots during early package bootstrap. Add an advanced-install toggle with default auto behavior so unattended installs remain seamless while interactive users can explicitly opt out. Co-authored-by: Michel Roegl-Brunner <michel.roegl-brunner@example.com>	2026-07-18 23:21:19 +02:00
community-scripts-pr-app[bot]	09c85021fc	Update CHANGELOG.md (#15877 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-18 20:19:59 +00:00
Sir106	7f1b0ead93	[tools.update-lxcs] feat: optional reporting success/failures to heathchecks.io (or others) (#15701 ) * feat: add task monitoring option via e.g. healthchecks.io. To be configured via PING variable in config file. * attach logfile on failure to healthcheck.io message * fixed error status when updating lxc even if finished successful --------- Co-authored-by: Sir106 <sir106@id-e.de>	2026-07-18 22:19:31 +02:00