Update CHANGELOG.md (#5049 )

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Update versions.json (#5048 )
2025-07-01 03:27:38 +00:00 · 2025-06-08 01:16:43 +01:00 · 2025-06-08 02:16:07 +02:00 · 2025-06-07 23:32:38 +02:00 · 2025-06-07 23:32:22 +02:00 · 2025-06-07 19:58:31 +01:00
85 changed files with 4919 additions and 3443 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -14,8 +14,148 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 All LXC instances created using this repository come pre-installed with Midnight Commander, which is a command-line tool (`mc`) that offers a user-friendly file and directory management interface for the terminal environment.


+## 2025-06-08
+
+## 2025-06-07
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - alpine-it-tools fix update [@CrazyWolf13](https://github.com/CrazyWolf13) ([#5039](https://github.com/community-scripts/ProxmoxVE/pull/5039))
+
+### 🧰 Maintenance
+
+  - #### 💾 Core
+
+    - Fix typo in build.func [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#5041](https://github.com/community-scripts/ProxmoxVE/pull/5041))
+
+## 2025-06-06
+
+### 🆕 New Scripts
+
+  - Zot-Registry ([#5016](https://github.com/community-scripts/ProxmoxVE/pull/5016))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - zipline: fix old upload copy from v3 to v4 [@MickLesk](https://github.com/MickLesk) ([#5015](https://github.com/community-scripts/ProxmoxVE/pull/5015))
+
+## 2025-06-05
+
+### 🆕 New Scripts
+
+  - Lyrion Music Server ([#4992](https://github.com/community-scripts/ProxmoxVE/pull/4992))
+- gitea-mirror ([#4967](https://github.com/community-scripts/ProxmoxVE/pull/4967))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Zipline: Fix PostgreSQL install [@tremor021](https://github.com/tremor021) ([#4989](https://github.com/community-scripts/ProxmoxVE/pull/4989))
+    - Homarr: add nodejs upgrade [@CrazyWolf13](https://github.com/CrazyWolf13) ([#4974](https://github.com/community-scripts/ProxmoxVE/pull/4974))
+    - add FUSE to rclone [@Frankmaaan](https://github.com/Frankmaaan) ([#4972](https://github.com/community-scripts/ProxmoxVE/pull/4972))
+
+  - #### ✨ New Features
+
+    - Zitadel: Upgrade Install to PSQL 17 [@MickLesk](https://github.com/MickLesk) ([#5000](https://github.com/community-scripts/ProxmoxVE/pull/5000))
+
+### 🌐 Website
+
+  - #### 📝 Script Information
+
+    - Fix clean-lxcs.sh type categorization [@bitspill](https://github.com/bitspill) ([#4980](https://github.com/community-scripts/ProxmoxVE/pull/4980))
+
+## 2025-06-04
+
+### 🚀 Updated Scripts
+
+  - Pulse: add polkit for sudoless web updates [@rcourtman](https://github.com/rcourtman) ([#4970](https://github.com/community-scripts/ProxmoxVE/pull/4970))
+- Pulse: add correct Port for URL output  [@rcourtman](https://github.com/rcourtman) ([#4951](https://github.com/community-scripts/ProxmoxVE/pull/4951))
+
+  - #### 🐞 Bug Fixes
+
+    - [refactor] Seelf [@tremor021](https://github.com/tremor021) ([#4954](https://github.com/community-scripts/ProxmoxVE/pull/4954))
+
+## 2025-06-03
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Kasm: Swap fix [@omiinaya](https://github.com/omiinaya) ([#4937](https://github.com/community-scripts/ProxmoxVE/pull/4937))
+
+### 🌐 Website
+
+  - #### 📝 Script Information
+
+    - netbox: correct website URL  [@theincrediblenoone](https://github.com/theincrediblenoone) ([#4952](https://github.com/community-scripts/ProxmoxVE/pull/4952))
+
+## 2025-06-02
+
+### 🆕 New Scripts
+
+  - PVE-Privilege-Converter [@MickLesk](https://github.com/MickLesk) ([#4906](https://github.com/community-scripts/ProxmoxVE/pull/4906))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(wastebin): use tar asset [@dbeg](https://github.com/dbeg) ([#4934](https://github.com/community-scripts/ProxmoxVE/pull/4934))
+    - MySQL/MariaDB: fix create user with password [@MickLesk](https://github.com/MickLesk) ([#4918](https://github.com/community-scripts/ProxmoxVE/pull/4918))
+    - Fix alpine-tinyauth env configuration parsing logic [@gokussjx](https://github.com/gokussjx) ([#4901](https://github.com/community-scripts/ProxmoxVE/pull/4901))
+
+  - #### 💥 Breaking Changes
+
+    - make Pulse installation non-interactive [@rcourtman](https://github.com/rcourtman) ([#4848](https://github.com/community-scripts/ProxmoxVE/pull/4848))
+
+### 🧰 Maintenance
+
+  - #### 💾 Core
+
+    - [core] add hw-accelerated for immich, openwebui / remove scrypted [@MickLesk](https://github.com/MickLesk) ([#4927](https://github.com/community-scripts/ProxmoxVE/pull/4927))
+    - [core] tools.func: Bugfix old gpg key for mysql & little improvements [@MickLesk](https://github.com/MickLesk) ([#4916](https://github.com/community-scripts/ProxmoxVE/pull/4916))
+    - [core] Varius fixes to Config file feature [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#4924](https://github.com/community-scripts/ProxmoxVE/pull/4924))
+
+### 🌐 Website
+
+  - #### 🐞 Bug Fixes
+
+    - Display default password even if there isn't a default username [@0risc](https://github.com/0risc) ([#4900](https://github.com/community-scripts/ProxmoxVE/pull/4900))
+
+## 2025-06-01
+
+### 🆕 New Scripts
+
+  - immich ([#4886](https://github.com/community-scripts/ProxmoxVE/pull/4886))
+
+### 🌐 Website
+
+  - #### 📝 Script Information
+
+    - AdventureLog: add login credentials info [@tremor021](https://github.com/tremor021) ([#4887](https://github.com/community-scripts/ProxmoxVE/pull/4887))
+
 ## 2025-05-31

+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Silverbullet: Fix Installation (wrong path) [@MickLesk](https://github.com/MickLesk) ([#4873](https://github.com/community-scripts/ProxmoxVE/pull/4873))
+    - ActualBudget: fix update check (file instead of folder check) [@MickLesk](https://github.com/MickLesk) ([#4874](https://github.com/community-scripts/ProxmoxVE/pull/4874))
+    - Omada Controller: Fix libssl url [@tremor021](https://github.com/tremor021) ([#4868](https://github.com/community-scripts/ProxmoxVE/pull/4868))
+
+### 🌐 Website
+
+  - #### 🐞 Bug Fixes
+
+    - Revert "Update package dependencies in package.json and package-lock.json (#4845) [@BramSuurdje](https://github.com/BramSuurdje) ([#4869](https://github.com/community-scripts/ProxmoxVE/pull/4869))
+
+### 💥 Breaking Changes
+
+  - Remove Authentik script [@tremor021](https://github.com/tremor021) ([#4867](https://github.com/community-scripts/ProxmoxVE/pull/4867))
+
 ## 2025-05-30

 ### 🚀 Updated Scripts
--- a/ct/actualbudget.sh
+++ b/ct/actualbudget.sh
@ -24,7 +24,7 @@ function update_script() {
  check_container_storage
  check_container_resources

-  if [[ ! -d /opt/actualbudget ]]; then
+  if [[ ! -f /opt/actualbudget_version.txt ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
--- a/ct/alpine-it-tools.sh
+++ b/ct/alpine-it-tools.sh
@ -21,8 +21,6 @@ catch_errors

 function update_script() {
  header_info
-  check_container_storage
-  check_container_resources

  if [ ! -d /usr/share/nginx/html ]; then
    msg_error "No ${APP} Installation Found!"
--- a/ct/alpine-rclone.sh
+++ b/ct/alpine-rclone.sh
@ -13,6 +13,7 @@ var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
 var_version="${var_version:-3.21}"
 var_unprivileged="${var_unprivileged:-1}"
+var_fuse="${var_fuse:-yes}"

 header_info "$APP"
 variables
@ -21,9 +22,6 @@ catch_errors

 function update_script() {
  header_info
-  check_container_storage
-  check_container_resources
-
  if [ ! -d /opt/rclone ]; then
    msg_error "No ${APP} Installation Found!"
    exit 1
--- a/ct/authentik.sh
+++ b/ct/authentik.sh
@ -1,91 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2025 community-scripts ORG
-# Author: remz1337
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://goauthentik.io/
-
-APP="Authentik"
-var_tags="${var_tags:-identity-provider}"
-var_disk="${var_disk:-12}"
-var_cpu="${var_cpu:-6}"
-var_ram="${var_ram:-10240}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-12}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-  if [[ ! -f /etc/systemd/system/authentik-server.service ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-  RELEASE=$(curl -fsSL https://api.github.com/repos/goauthentik/authentik/releases/latest | grep "tarball_url" | awk '{print substr($2, 2, length($2)-3)}')
-  if [[ "${RELEASE}" != "$(cat /opt/${APP}_version.txt)" ]] || [[ ! -f /opt/${APP}_version.txt ]]; then
-    NODE_VERSION="22"
-    PG_VERSION="16"
-    setup_uv
-    install_postgresql
-    install_node_and_modules
-    install_go
-
-    msg_info "Stopping ${APP}"
-    systemctl stop authentik-server
-    systemctl stop authentik-worker
-    msg_ok "Stopped ${APP}"
-
-    msg_info "Building ${APP} website"
-    mkdir -p /opt/authentik
-    curl -fsSL "${RELEASE}" -o "authentik.tar.gz"
-    tar -xzf authentik.tar.gz -C /opt/authentik --strip-components 1 --overwrite
-    rm -rf authentik.tar.gz
-    cd /opt/authentik/website
-    $STD npm install
-    $STD npm run build-bundled
-    cd /opt/authentik/web
-    $STD npm install
-    $STD npm run build
-    msg_ok "Built ${APP} website"
-
-    msg_info "Building ${APP} server"
-    cd /opt/authentik
-    go mod download
-    go build -o /go/authentik ./cmd/server
-    go build -o /opt/authentik/authentik-server /opt/authentik/cmd/server/
-    msg_ok "Built ${APP} server"
-
-    msg_info "Building Authentik"
-    cd /opt/authentik
-    $STD uv sync --frozen --no-install-project --no-dev
-    uv run python -m lifecycle.migrate
-    ln -s /opt/authentik/.venv/bin/gunicorn /usr/local/bin/gunicorn
-    ln -s /opt/authentik/.venv/bin/celery /usr/local/bin/celery
-    msg_ok "Authentik built"
-
-    echo "${RELEASE}" >/opt/${APP}_version.txt
-    msg_ok "Updated ${APP} to v${RELEASE}"
-
-    msg_info "Starting ${APP}"
-    systemctl start authentik-server
-    systemctl start authentik-worker
-    msg_ok "Started ${APP}"
-  else
-    msg_ok "No update required. ${APP} is already at v${RELEASE}"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:9000/if/flow/initial-setup/${CL}"
--- a/ct/gitea-mirror.sh
+++ b/ct/gitea-mirror.sh
@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: CrazyWolf13
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/arunavo4/gitea-mirror
+
+APP="gitea-mirror"
+var_tags="${var_tags:-mirror;gitea}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-5}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-12}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -d /opt/gitea-mirror ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  RELEASE=$(curl -fsSL https://api.github.com/repos/arunavo4/gitea-mirror/releases/latest | grep "tag_name" | awk '{print substr($2, 3, length($2)-4) }')
+  if [[ ! -f /opt/${APP}_version.txt ]] || [[ "${RELEASE}" != "$(cat /opt/${APP}_version.txt)" ]]; then
+
+    msg_info "Stopping Services"
+    systemctl stop gitea-mirror
+    msg_ok "Services Stopped"
+
+    msg_info "Backup Data"
+    mkdir -p /opt/gitea-mirror-backup/data
+    cp /opt/gitea-mirror/data/* /opt/gitea-mirror-backup/data/
+    msg_ok "Backup Data"
+
+    msg_info "Installing Bun"
+    export BUN_INSTALL=/opt/bun
+    curl -fsSL https://bun.sh/install | $STD bash
+    ln -sf /opt/bun/bin/bun /usr/local/bin/bun
+    ln -sf /opt/bun/bin/bun /usr/local/bin/bunx
+    msg_ok "Installed Bun"
+
+    rm -rf /opt/gitea-mirror
+    fetch_and_deploy_gh_release "arunavo4/gitea-mirror"
+    
+    msg_info "Updating and rebuilding ${APP} to v${RELEASE}"  
+    cd /opt/gitea-mirror
+    $STD bun run setup
+    $STD bun run build
+    APP_VERSION=$(grep -o '"version": *"[^"]*"' package.json | cut -d'"' -f4)
+    sudo sed -i.bak "s|^Environment=npm_package_version=.*|Environment=npm_package_version=${APP_VERSION}|" /etc/systemd/system/gitea-mirror.service
+    msg_ok "Updated and rebuilt ${APP} to v${RELEASE}"  
+
+    msg_info "Restoring Data"
+    cp /opt/gitea-mirror-backup/data/* /opt/gitea-mirror/data
+    echo "${RELEASE}" >/opt/${APP}_version.txt
+    msg_ok "Restored Data"
+
+    msg_info "Starting Service"
+    systemctl daemon-reload
+    systemctl start gitea-mirror
+    msg_ok "Service Started"
+  else
+    msg_ok "No update required. ${APP} is already at v${RELEASE}"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:4321${CL}"
--- a/ct/headers/authentik
+++ b/ct/headers/authentik
@ -1,6 +0,0 @@
-    ___         __  __               __  _ __  
-   /   | __  __/ /_/ /_  ___  ____  / /_(_) /__
-  / /| |/ / / / __/ __ \/ _ \/ __ \/ __/ / //_/
- / ___ / /_/ / /_/ / / /  __/ / / / /_/ / ,<   
-/_/  |_\__,_/\__/_/ /_/\___/_/ /_/\__/_/_/|_|  
-                                               
--- a/ct/headers/gitea-mirror
+++ b/ct/headers/gitea-mirror
@ -0,0 +1,6 @@
+          _ __                             _                     
+   ____ _(_) /____  ____ _      ____ ___  (_)_____________  _____
+  / __ `/ / __/ _ \/ __ `/_____/ __ `__ \/ / ___/ ___/ __ \/ ___/
+ / /_/ / / /_/  __/ /_/ /_____/ / / / / / / /  / /  / /_/ / /    
+ \__, /_/\__/\___/\__,_/     /_/ /_/ /_/_/_/  /_/   \____/_/     
+/____/                                                           
--- a/ct/headers/immich
+++ b/ct/headers/immich
@ -0,0 +1,6 @@
+    _                     _      __  
+   (_)___ ___  ____ ___  (_)____/ /_ 
+  / / __ `__ \/ __ `__ \/ / ___/ __ \
+ / / / / / / / / / / / / / /__/ / / /
+/_/_/ /_/ /_/_/ /_/ /_/_/\___/_/ /_/ 
+                                     
--- a/ct/headers/lyrionmusicserver
+++ b/ct/headers/lyrionmusicserver
@ -0,0 +1,6 @@
+    __               _                __  ___           _         _____                          
+   / /   __  _______(_)___  ____     /  |/  /_  _______(_)____   / ___/___  ______   _____  _____
+  / /   / / / / ___/ / __ \/ __ \   / /|_/ / / / / ___/ / ___/   \__ \/ _ \/ ___/ | / / _ \/ ___/
+ / /___/ /_/ / /  / / /_/ / / / /  / /  / / /_/ (__  ) / /__    ___/ /  __/ /   | |/ /  __/ /    
+/_____/\__, /_/  /_/\____/_/ /_/  /_/  /_/\__,_/____/_/\___/   /____/\___/_/    |___/\___/_/     
+      /____/                                                                                     
--- a/ct/headers/zot-registry
+++ b/ct/headers/zot-registry
@ -0,0 +1,6 @@
+ _____         __        ____             _      __            
+/__  /  ____  / /_      / __ \___  ____ _(_)____/ /________  __
+  / /  / __ \/ __/_____/ /_/ / _ \/ __ `/ / ___/ __/ ___/ / / /
+ / /__/ /_/ / /_/_____/ _, _/  __/ /_/ / (__  ) /_/ /  / /_/ / 
+/____/\____/\__/     /_/ |_|\___/\__, /_/____/\__/_/   \__, /  
+                                /____/                /____/   
--- a/ct/homarr.sh
+++ b/ct/homarr.sh
@ -92,6 +92,19 @@ EOF
    cp /opt/homarr/.env /opt/homarr-data-backup/.env
    msg_ok "Backup Data"

+    msg_info "Updating Nodejs"
+    $STD apt update
+    $STD apt upgrade nodejs -y
+    msg_ok "Updated Nodejs"
+
+    $STD command -v jq || $STD apt-get update && $STD apt-get install -y jq
+    NODE_VERSION=$(curl -s https://raw.githubusercontent.com/homarr-labs/homarr/dev/package.json | jq -r '.engines.node | split(">=")[1] | split(".")[0]')
+    NODE_MODULE="pnpm@$(curl -s https://raw.githubusercontent.com/homarr-labs/homarr/dev/package.json | jq -r '.packageManager | split("@")[1]')"
+    install_node_and_modules
+    
+    rm -rf /opt/homarr
+    fetch_and_deploy_gh_release "homarr-labs/homarr"
+
    msg_info "Updating and rebuilding ${APP} to v${RELEASE} (Patience)"
    rm /opt/run_homarr.sh
    cat <<'EOF' >/opt/run_homarr.sh
@ -117,12 +130,6 @@ node apps/nextjs/server.js & PID=$!
 wait $PID
 EOF
    chmod +x /opt/run_homarr.sh
-    $STD command -v jq || $STD apt-get update && $STD apt-get install -y jq
-    NODE_VERSION=$(curl -s https://raw.githubusercontent.com/homarr-labs/homarr/dev/package.json | jq -r '.engines.node | split(">=")[1] | split(".")[0]')
-    NODE_MODULE="pnpm@$(curl -s https://raw.githubusercontent.com/homarr-labs/homarr/dev/package.json | jq -r '.packageManager | split("@")[1]')"
-    install_node_and_modules
-    rm -rf /opt/homarr
-    fetch_and_deploy_gh_release "homarr-labs/homarr"
    mv /opt/homarr-data-backup/.env /opt/homarr/.env
    cd /opt/homarr
    $STD pnpm install --recursive --frozen-lockfile --shamefully-hoist
--- a/ct/immich.sh
+++ b/ct/immich.sh
@ -0,0 +1,319 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: vhsdream
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://immich.app
+
+APP="immich"
+var_tags="${var_tags:-photos}"
+var_disk="${var_disk:-20}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-4096}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-12}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -d /opt/immich ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  STAGING_DIR=/opt/staging
+  BASE_DIR=${STAGING_DIR}/base-images
+  SOURCE_DIR=${STAGING_DIR}/image-source
+  if [[ -f ~/.intel_version ]]; then
+    curl -fsSLO https://raw.githubusercontent.com/immich-app/immich/refs/heads/main/machine-learning/Dockerfile
+    readarray -t INTEL_URLS < <(sed -n "/intel/p" ./Dockerfile | awk '{print $3}')
+    INTEL_RELEASE="$(grep "intel-opencl-icd" ./Dockerfile | awk -F '_' '{print $2}')"
+    if [[ "$INTEL_RELEASE" != "$(cat ~/.intel_version)" ]]; then
+      msg_info "Updating Intel iGPU dependencies"
+      for url in "${INTEL_URLS[@]}"; do
+        curl -fsSLO "$url"
+      done
+      $STD dpkg -i ./*.deb
+      rm ./*.deb
+      msg_ok "Intel iGPU dependencies updated"
+    fi
+    rm ~/Dockerfile
+  fi
+  if [[ -f ~/.immich_library_revisions ]]; then
+    libraries=("libjxl" "libheif" "libraw" "imagemagick" "libvips")
+    readarray -d '' NEW_REVISIONS < <(for library in "${libraries[@]}"; do
+      echo "$library: $(curl -fsSL https://raw.githubusercontent.com/immich-app/base-images/refs/heads/main/server/sources/"$library".json | jq -cr '.revision' -)"
+    done)
+    UPDATED_REVISIONS="$(comm -13 <(sort ~/.immich_library_revisions) <(echo -n "${NEW_REVISIONS[@]}" | sort))"
+    if [[ "$UPDATED_REVISIONS" ]]; then
+      readarray -t NAMES < <(echo "$UPDATED_REVISIONS" | awk -F ':' '{print $1}')
+      rm -rf "$SOURCE_DIR"
+      mkdir -p "$SOURCE_DIR"
+      cd "$BASE_DIR"
+      $STD git pull
+      cd "$STAGING_DIR"
+      for name in "${NAMES[@]}"; do
+        if [[ "$name" == "libjxl" ]]; then
+          msg_info "Recompiling libjxl"
+          SOURCE=${SOURCE_DIR}/libjxl
+          JPEGLI_LIBJPEG_LIBRARY_SOVERSION="62"
+          JPEGLI_LIBJPEG_LIBRARY_VERSION="62.3.0"
+          : "${LIBJXL_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libjxl.json)}"
+          $STD git clone https://github.com/libjxl/libjxl.git "$SOURCE"
+          cd "$SOURCE"
+          $STD git reset --hard "$LIBJXL_REVISION"
+          $STD git submodule update --init --recursive --depth 1 --recommend-shallow
+          $STD git apply "$BASE_DIR"/server/sources/libjxl-patches/jpegli-empty-dht-marker.patch
+          $STD git apply "$BASE_DIR"/server/sources/libjxl-patches/jpegli-icc-warning.patch
+          mkdir build
+          cd build
+          $STD cmake \
+            -DCMAKE_BUILD_TYPE=Release \
+            -DBUILD_TESTING=OFF \
+            -DJPEGXL_ENABLE_DOXYGEN=OFF \
+            -DJPEGXL_ENABLE_MANPAGES=OFF \
+            -DJPEGXL_ENABLE_PLUGIN_GIMP210=OFF \
+            -DJPEGXL_ENABLE_BENCHMARK=OFF \
+            -DJPEGXL_ENABLE_EXAMPLES=OFF \
+            -DJPEGXL_FORCE_SYSTEM_BROTLI=ON \
+            -DJPEGXL_FORCE_SYSTEM_HWY=ON \
+            -DJPEGXL_ENABLE_JPEGLI=ON \
+            -DJPEGXL_ENABLE_JPEGLI_LIBJPEG=ON \
+            -DJPEGXL_INSTALL_JPEGLI_LIBJPEG=ON \
+            -DJPEGXL_ENABLE_PLUGINS=ON \
+            -DJPEGLI_LIBJPEG_LIBRARY_SOVERSION="$JPEGLI_LIBJPEG_LIBRARY_SOVERSION" \
+            -DJPEGLI_LIBJPEG_LIBRARY_VERSION="$JPEGLI_LIBJPEG_LIBRARY_VERSION" \
+            -DLIBJPEG_TURBO_VERSION_NUMBER=2001005 \
+            ..
+          $STD cmake --build . -- -j"$(nproc)"
+          $STD cmake --install .
+          ldconfig /usr/local/lib
+          $STD make clean
+          cd "$STAGING_DIR"
+          rm -rf "$SOURCE"/{build,third_party}
+          msg_ok "Recompiled libjxl"
+        fi
+        if [[ "$name" == "libheif" ]]; then
+          msg_info "Recompiling libheif"
+          SOURCE=${SOURCE_DIR}/libheif
+          : "${LIBHEIF_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libheif.json)}"
+          $STD git clone https://github.com/strukturag/libheif.git "$SOURCE"
+          cd "$SOURCE"
+          $STD git reset --hard "$LIBHEIF_REVISION"
+          mkdir build
+          cd build
+          $STD cmake --preset=release-noplugins \
+            -DWITH_DAV1D=ON \
+            -DENABLE_PARALLEL_TILE_DECODING=ON \
+            -DWITH_LIBSHARPYUV=ON \
+            -DWITH_LIBDE265=ON \
+            -DWITH_AOM_DECODER=OFF \
+            -DWITH_AOM_ENCODER=OFF \
+            -DWITH_X265=OFF \
+            -DWITH_EXAMPLES=OFF \
+            ..
+          $STD make install -j "$(nproc)"
+          ldconfig /usr/local/lib
+          $STD make clean
+          cd "$STAGING_DIR"
+          rm -rf "$SOURCE"/build
+          msg_ok "Recompiled libheif"
+        fi
+        if [[ "$name" == "libraw" ]]; then
+          msg_info "Recompiling libraw"
+          SOURCE=${SOURCE_DIR}/libraw
+          : "${LIBRAW_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libraw.json)}"
+          $STD git clone https://github.com/libraw/libraw.git "$SOURCE"
+          cd "$SOURCE"
+          $STD git reset --hard "$LIBRAW_REVISION"
+          $STD autoreconf --install
+          $STD ./configure
+          $STD make -j"$(nproc)"
+          $STD make install
+          ldconfig /usr/local/lib
+          $STD make clean
+          cd "$STAGING_DIR"
+          msg_ok "Recompiled libraw"
+        fi
+        if [[ "$name" == "imagemagick" ]]; then
+          msg_info "Recompiling ImageMagick"
+          SOURCE=$SOURCE_DIR/imagemagick
+          : "${IMAGEMAGICK_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/imagemagick.json)}"
+          $STD git clone https://github.com/ImageMagick/ImageMagick.git "$SOURCE"
+          cd "$SOURCE"
+          $STD git reset --hard "$IMAGEMAGICK_REVISION"
+          $STD ./configure --with-modules
+          $STD make -j"$(nproc)"
+          $STD make install
+          ldconfig /usr/local/lib
+          $STD make clean
+          cd "$STAGING_DIR"
+          msg_ok "Recompiled ImageMagick"
+        fi
+        if [[ "$name" == "libvips" ]]; then
+          msg_info "Recompiling libvips"
+          SOURCE=$SOURCE_DIR/libvips
+          : "${LIBVIPS_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libvips.json)}"
+          $STD git clone https://github.com/libvips/libvips.git "$SOURCE"
+          cd "$SOURCE"
+          $STD git reset --hard "$LIBVIPS_REVISION"
+          $STD meson setup build --buildtype=release --libdir=lib -Dintrospection=disabled -Dtiff=disabled
+          cd build
+          $STD ninja install
+          ldconfig /usr/local/lib
+          cd "$STAGING_DIR"
+          rm -rf "$SOURCE"/build
+          msg_ok "Recompiled libvips"
+        fi
+      done
+      echo -n "${NEW_REVISIONS[@]}" >~/.immich_library_revisions
+      msg_ok "Image-processing libraries compiled"
+    fi
+  fi
+  RELEASE=$(curl -s https://api.github.com/repos/immich-app/immich/releases?per_page=1 | grep "tag_name" | awk '{print substr($2, 3, length($2)-4) }')
+  if [[ "${RELEASE}" != "$(cat /opt/${APP}_version.txt)" ]] || [[ ! -f /opt/${APP}_version.txt ]]; then
+    msg_info "Stopping ${APP} services"
+    systemctl stop immich-web
+    systemctl stop immich-ml
+    msg_ok "Stopped ${APP}"
+    if [[ "$(cat /opt/${APP}_version.txt)" < "1.133.0" ]]; then
+      msg_info "Upgrading to the VectorChord PostgreSQL extension"
+      NUMBER="$(
+        sed -n '2p' <(
+          sudo -u postgres psql -A -d immich <<EOF
+        SELECT atttypmod as dimsize
+          FROM pg_attribute f
+          JOIN pg_class c ON c.oid = f.attrelid
+          WHERE c.relkind = 'r'::char
+          AND f.attnum > 0
+          AND c.relname = 'smart_search'::text
+          AND f.attname = 'embedding'::text;
+EOF
+        )
+      )"
+      $STD sudo -u postgres psql -d immich <<EOF
+      DROP INDEX IF EXISTS clip_index;
+      DROP INDEX IF EXISTS face_index;
+      ALTER TABLE smart_search ALTER COLUMN embedding SET DATA TYPE real[];
+      ALTER TABLE face_search ALTER COLUMN embedding SET DATA TYPE real[];
+EOF
+      $STD apt-get update
+      $STD apt-get install postgresql-16-pgvector -y
+      curl -fsSL https://github.com/tensorchord/VectorChord/releases/download/0.3.0/postgresql-16-vchord_0.3.0-1_amd64.deb -o vchord.deb
+      $STD dpkg -i vchord.deb
+      rm vchord.deb
+      sed -i "s|vectors.so|vchord.so|" /etc/postgresql/16/main/postgresql.conf
+      systemctl restart postgresql.service
+      $STD sudo -u postgres psql -d immich <<EOF
+      CREATE EXTENSION IF NOT EXISTS vchord CASCADE;
+      ALTER TABLE smart_search ALTER COLUMN embedding SET DATA TYPE vector($NUMBER);
+      ALTER TABLE face_search ALTER COLUMN embedding SET DATA TYPE vector(512);
+EOF
+      $STD apt purge vectors-pg16 -y
+      msg_ok "Database upgrade complete"
+    fi
+    INSTALL_DIR="/opt/${APP}"
+    UPLOAD_DIR="$(sed -n '/^IMMICH_MEDIA_LOCATION/s/[^=]*=//p' /opt/immich/.env)"
+    SRC_DIR="${INSTALL_DIR}/source"
+    APP_DIR="${INSTALL_DIR}/app"
+    ML_DIR="${APP_DIR}/machine-learning"
+    GEO_DIR="${INSTALL_DIR}/geodata"
+    cp "$ML_DIR"/ml_start.sh "$INSTALL_DIR"
+    rm -rf "${APP_DIR:?}"/*
+    rm -rf "$SRC_DIR"
+    immich_zip=$(mktemp)
+    curl -fsSL "https://github.com/immich-app/immich/archive/refs/tags/v${RELEASE}.zip" -o "$immich_zip"
+    msg_info "Updating ${APP} web and microservices"
+    unzip -q "$immich_zip"
+    mv "$APP-$RELEASE"/ "$SRC_DIR"
+    mkdir -p "$ML_DIR"
+    cd "$SRC_DIR"/server
+    $STD npm install -g node-gyp node-pre-gyp
+    $STD npm ci
+    $STD npm run build
+    $STD npm prune --omit=dev --omit=optional
+    cd "$SRC_DIR"/open-api/typescript-sdk
+    $STD npm ci
+    $STD npm run build
+    cd "$SRC_DIR"/web
+    $STD npm ci
+    $STD npm run build
+    cd "$SRC_DIR"
+    cp -a server/{node_modules,dist,bin,resources,package.json,package-lock.json,start*.sh} "$APP_DIR"/
+    cp -a web/build "$APP_DIR"/www
+    cp LICENSE "$APP_DIR"
+    msg_ok "Updated ${APP} web and microservices"
+
+    cd "$SRC_DIR"/machine-learning
+    $STD python3 -m venv "$ML_DIR"/ml-venv
+    if [[ -f ~/.openvino ]]; then
+      msg_info "Updating HW-accelerated machine-learning"
+      (
+        source "$ML_DIR"/ml-venv/bin/activate
+        $STD pip3 install -U uv
+        uv -q sync --extra openvino --no-cache --active
+      )
+      patchelf --clear-execstack "$ML_DIR"/ml-venv/lib/python3.11/site-packages/onnxruntime/capi/onnxruntime_pybind11_state.cpython-311-x86_64-linux-gnu.so
+      msg_ok "Updated HW-accelerated machine-learning"
+    else
+      msg_info "Updating machine-learning"
+      (
+        source "$ML_DIR"/ml-venv/bin/activate
+        $STD pip3 install -U uv
+        uv -q sync --extra cpu --no-cache --active
+      )
+      msg_ok "Updated machine-learning"
+    fi
+    cd "$SRC_DIR"
+    cp -a machine-learning/{ann,immich_ml} "$ML_DIR"
+    cp "$INSTALL_DIR"/ml_start.sh "$ML_DIR"
+    if [[ -f ~/.openvino ]]; then
+      sed -i "/intra_op/s/int = 0/int = os.cpu_count() or 0/" "$ML_DIR"/immich_ml/config.py
+    fi
+    ln -sf "$APP_DIR"/resources "$INSTALL_DIR"
+    cd "$APP_DIR"
+    grep -Rl /usr/src | xargs -n1 sed -i "s|\/usr/src|$INSTALL_DIR|g"
+    grep -RlE "'/build'" | xargs -n1 sed -i "s|'/build'|'$APP_DIR'|g"
+    sed -i "s@\"/cache\"@\"$INSTALL_DIR/cache\"@g" "$ML_DIR"/immich_ml/config.py
+    ln -s "${UPLOAD_DIR:-/opt/immich/upload}" "$APP_DIR"/upload
+    ln -s "${UPLOAD_DIR:-/opt/immich/upload}" "$ML_DIR"/upload
+    ln -s "$GEO_DIR" "$APP_DIR"
+
+    msg_info "Updating Immich CLI"
+    $STD npm install --build-from-source sharp
+    rm -rf "$APP_DIR"/node_modules/@img/sharp-{libvips*,linuxmusl-x64}
+    $STD npm i -g @immich/cli
+    msg_ok "Updated Immich CLI"
+
+    sed -i "s|pgvecto.rs|vectorchord|" /opt/"${APP}"/.env
+
+    chown -R immich:immich "$INSTALL_DIR"
+    echo "$RELEASE" >/opt/"${APP}"_version.txt
+    msg_ok "Updated ${APP} to v${RELEASE}"
+
+    msg_info "Cleaning up"
+    rm -f "$immich_zip"
+    $STD apt-get -y autoremove
+    $STD apt-get -y autoclean
+    msg_ok "Cleaned"
+  else
+    msg_ok "${APP} is already at v${RELEASE}"
+  fi
+  systemctl restart immich-ml immich-web
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:2283${CL}"
--- a/ct/kasm.sh
+++ b/ct/kasm.sh
@ -12,7 +12,7 @@ var_ram="${var_ram:-4192}"
 var_disk="${var_disk:-30}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-12}"
-var_unprivileged="${var_unprivileged:-1}"
+var_unprivileged="${var_unprivileged:-0}"
 var_fuse="${var_fuse:-yes}"
 var_tun="${var_tun:-yes}"

--- a/ct/lyrionmusicserver.sh
+++ b/ct/lyrionmusicserver.sh
@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: Omar Minaya
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://lyrion.org/getting-started/
+
+APP="Lyrion Music Server"
+var_tags="${var_tags:-media}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-3}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-12}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /lib/systemd/system/lyrionmusicserver.service ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  DEB_URL=$(curl -s 'https://lyrion.org/getting-started/' | grep -oP '<a\s[^>]*href="\K[^"]*amd64\.deb(?="[^>]*>)' | head -n 1)
+  RELEASE=$(echo "$DEB_URL" | grep -oP 'lyrionmusicserver_\K[0-9.]+(?=_amd64\.deb)')
+  DEB_FILE="/tmp/lyrionmusicserver_${RELEASE}_amd64.deb"
+  if [[ ! -f /opt/lyrion_version.txt ]] || [[ "${RELEASE}" != "$(cat /opt/lyrion_version.txt)" ]]; then
+    msg_info "Updating $APP to ${RELEASE}"
+    curl -fsSL -o "$DEB_FILE" "$DEB_URL"
+    $STD apt install "$DEB_FILE" -y
+    systemctl restart lyrion
+    echo "${RELEASE}" >/opt/${APP}_version.txt
+    msg_ok "Updated $APP to ${RELEASE}"
+
+    msg_info "Cleaning up"
+    $STD rm -f "$DEB_FILE"
+    $STD apt-get -y autoremove
+    $STD apt-get -y autoclean
+    msg_ok "Cleaned"
+  else
+    msg_ok "$APP is already up to date (${RELEASE})"
+  fi
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access the web interface at:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:9000${CL}"
--- a/ct/pulse.sh
+++ b/ct/pulse.sh
@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-source <(curl -s https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2025 community-scripts ORG
 # Author: rcourtman
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
@ -23,40 +23,37 @@ function update_script() {
  header_info
  check_container_storage
  check_container_resources
-  if [[ ! -d /opt/pulse-proxmox ]]; then
+  if [[ -d /opt/pulse-monitor ]]; then
+  msg_error "An old installation was detected. Please recreate the LXC from scratch (https://github.com/community-scripts/ProxmoxVE/pull/4848)"
+  exit 1
+  fi
+  if [[ ! -d /opt/pulse ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
  RELEASE=$(curl -fsSL https://api.github.com/repos/rcourtman/Pulse/releases/latest | grep "tag_name" | awk '{print substr($2, 3, length($2)-4) }')
  if [[ ! -f /opt/${APP}_version.txt ]] || [[ "${RELEASE}" != "$(cat /opt/${APP}_version.txt)" ]]; then
    msg_info "Stopping ${APP}"
-    systemctl stop pulse-monitor
+    systemctl stop pulse
    msg_ok "Stopped ${APP}"

    msg_info "Updating Pulse"
-    if [[ -f /opt/pulse-proxmox/.env ]]; then
-      cp /opt/pulse-proxmox/.env /tmp/.env.backup.pulse
-    fi
    temp_file=$(mktemp)
-    mkdir -p /opt/pulse-proxmox
-    rm -rf /opt/pulse-proxmox/*
+    mkdir -p /opt/pulse
+    rm -rf /opt/pulse/*
    curl -fsSL "https://github.com/rcourtman/Pulse/releases/download/v${RELEASE}/pulse-v${RELEASE}.tar.gz" -o "$temp_file"
-    tar zxf "$temp_file" --strip-components=1 -C /opt/pulse-proxmox
-    if [[ -f /tmp/.env.backup.pulse ]]; then
-      mv /tmp/.env.backup.pulse /opt/pulse-proxmox/.env
-    fi
+    tar zxf "$temp_file" --strip-components=1 -C /opt/pulse
    echo "${RELEASE}" >/opt/${APP}_version.txt
    msg_ok "Updated Pulse to ${RELEASE}"

-    msg_info "Setting permissions for /opt/pulse-proxmox..."
-    chown -R pulse:pulse "/opt/pulse-proxmox"
-    find "/opt/pulse-proxmox" -type d -exec chmod 755 {} \;
-    find "/opt/pulse-proxmox" -type f -exec chmod 644 {} \;
-    chmod 600 /opt/pulse-proxmox/.env
+    msg_info "Setting permissions for /opt/pulse..."
+    chown -R pulse:pulse "/opt/pulse"
+    find "/opt/pulse" -type d -exec chmod 755 {} \;
+    find "/opt/pulse" -type f -exec chmod 644 {} \;
    msg_ok "Set permissions."

    msg_info "Starting ${APP}"
-    systemctl start pulse-monitor
+    systemctl start pulse
    msg_ok "Started ${APP}"
  else
    msg_ok "No update required. ${APP} is already at ${RELEASE}."
@ -70,4 +67,4 @@ description
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}(:your_port)${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:7655${CL}"
--- a/ct/rclone.sh
+++ b/ct/rclone.sh
@ -13,6 +13,7 @@ var_disk="${var_disk:-2}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-12}"
 var_unprivileged="${var_unprivileged:-1}"
+var_fuse="${var_fuse:-yes}"

 header_info "$APP"
 variables
--- a/ct/seelf.sh
+++ b/ct/seelf.sh
@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2025 community-scripts ORG
-# Author: tremor021
+# Author: Slaviša Arežina (tremor021)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/YuukanOO/seelf

@ -20,49 +20,31 @@ color
 catch_errors

 function update_script() {
-    header_info
-    check_container_storage
-    check_container_resources
+  header_info
+  check_container_storage
+  check_container_resources

-    if [[ ! -d /opt/seelf ]]; then
-        msg_error "No ${APP} Installation Found!"
-        exit
-    fi
-
-    RELEASE=$(curl -fsSL https://api.github.com/repos/YuukanOO/seelf/releases/latest | grep "tag_name" | awk '{print substr($2, 3, length($2)-4) }')
-    if [[ "${RELEASE}" != "$(cat /opt/${APP}_version.txt)" ]] || [[ ! -f /opt/${APP}_version.txt ]]; then
-        msg_info "Updating $APP"
-
-        msg_info "Stopping $APP"
-        systemctl stop seelf
-        msg_ok "Stopped $APP"
-
-        msg_info "Updating $APP to v${RELEASE}. Patience"
-        export PATH=$PATH:/usr/local/go/bin
-        source ~/.bashrc
-        curl -fsSL "https://github.com/YuukanOO/seelf/archive/refs/tags/v${RELEASE}.tar.gz" -o $(basename "https://github.com/YuukanOO/seelf/archive/refs/tags/v${RELEASE}.tar.gz")
-        tar -xzf v${RELEASE}.tar.gz
-        cp -r seelf-${RELEASE}/ /opt/seelf
-        cd /opt/seelf
-        $STD make build
-        msg_ok "Updated $APP to v${RELEASE}"
-
-        msg_info "Starting $APP"
-        systemctl start seelf
-        msg_ok "Started $APP"
-
-        # Cleaning up
-        msg_info "Cleaning Up"
-        rm -f ~/*.tar.gz
-        rm -rf ~/seelf-${RELEASE}
-        msg_ok "Cleanup Completed"
-
-        echo "${RELEASE}" >/opt/${APP}_version.txt
-        msg_ok "Update Successful"
-    else
-        msg_ok "No update required. ${APP} is already at v${RELEASE}"
-    fi
+  if [[ ! -d /opt/seelf ]]; then
+    msg_error "No ${APP} Installation Found!"
    exit
+  fi
+  if fetch_and_deploy_gh_release "YuukanOO/seelf"; then
+    msg_ok "$APP already at the latest version. No update required."
+  else
+    msg_info "Stopping $APP"
+    systemctl stop seelf
+    msg_ok "Stopped $APP"
+
+    msg_info "Updating $APP"
+    cd /opt/seelf
+    $STD make build
+    msg_ok "Updated $APP"
+
+    msg_info "Starting $APP"
+    systemctl start seelf
+    msg_ok "Started $APP"
+  fi
+  exit
 }

 start
--- a/ct/tianji.sh
+++ b/ct/tianji.sh
@ -26,6 +26,9 @@ function update_script() {
    msg_error "No ${APP} Installation Found!"
    exit
  fi
+  if ! command -v jq &>/dev/null; then
+    $STD apt-get install -y jq
+  fi
  if ! command -v node >/dev/null || [[ "$(/usr/bin/env node -v | grep -oP '^v\K[0-9]+')" != "22" ]]; then
    msg_info "Installing Node.js 22"
    $STD apt-get purge -y nodejs
--- a/ct/wastebin.sh
+++ b/ct/wastebin.sh
@ -64,8 +64,8 @@ EOF

    msg_info "Updating Wastebin"
    temp_file=$(mktemp)
-    curl -fsSL "https://github.com/matze/wastebin/releases/download/${RELEASE}/wastebin_${RELEASE}_x86_64-unknown-linux-musl.zip" -o "$temp_file"
-    $STD unzip -o $temp_file
+    curl -fsSL "https://github.com/matze/wastebin/releases/download/${RELEASE}/wastebin_${RELEASE}_x86_64-unknown-linux-musl.tar.zst" -o "$temp_file"
+    tar -xf $temp_file
    cp -f wastebin /opt/wastebin/
    chmod +x /opt/wastebin/wastebin
    echo "${RELEASE}" >/opt/${APP}_version.txt
--- a/ct/zipline.sh
+++ b/ct/zipline.sh
@ -41,7 +41,9 @@ function update_script() {
    msg_info "Updating ${APP} to ${RELEASE}"
    cp /opt/zipline/.env /opt/
    mkdir -p /opt/zipline-upload
-    cp -R /opt/zipline/upload/* /opt/zipline-upload/
+    if [ -d /opt/zipline/upload ] && [ "$(ls -A /opt/zipline/upload)" ]; then
+      cp -R /opt/zipline/upload/* /opt/zipline-upload/
+    fi
    curl -fsSL "https://github.com/diced/zipline/archive/refs/tags/v${RELEASE}.zip" -o $(basename "https://github.com/diced/zipline/archive/refs/tags/v${RELEASE}.zip")
    $STD unzip v"${RELEASE}".zip
    rm -R /opt/zipline
--- a/ct/zot-registry.sh
+++ b/ct/zot-registry.sh
@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://zotregistry.dev/
+
+APP="Zot-Registry"
+var_tags="${var_tags:-registry;oci}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-5}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-12}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /usr/bin/zot ]]; then
+    msg_error "No ${APP} installation found!"
+    exit
+  fi
+
+  RELEASE=$(curl -fsSL https://api.github.com/repos/project-zot/zot/releases/latest | grep "tag_name" | awk '{print substr($2, 2, length($2)-3)}')
+  if [[ ! -f ~/.${APP} ]] || [[ "${RELEASE}" != "$(cat ~/.${APP})" ]]; then
+    msg_info "Stopping Zot service"
+    systemctl stop zot
+    msg_ok "Stopped Zot service"
+
+    msg_info "Updating Zot to ${RELEASE}"
+    curl -fsSL "https://github.com/project-zot/zot/releases/download/${RELEASE}/zot-linux-amd64" -o /usr/bin/zot
+    chmod +x /usr/bin/zot
+    chown root:root /usr/bin/zot
+    echo "${RELEASE}" >~/.${APP}
+    systemctl restart zot
+    msg_ok "Updated Zot to ${RELEASE}"
+  else
+    msg_ok "Zot is already up to date (${RELEASE})"
+  fi
+
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8080${CL}"
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
--- a/frontend/package.json
+++ b/frontend/package.json
@ -45,7 +45,7 @@
    "lucide-react": "^0.453.0",
    "mini-svg-data-uri": "^1.4.4",
    "next": "15.2.4",
-    "next-themes": "^0.4.6",
+    "next-themes": "^0.3.0",
    "nuqs": "^2.4.1",
    "pocketbase": "^0.21.5",
    "prettier-plugin-organize-imports": "^4.1.0",
@ -53,7 +53,7 @@
    "react-chartjs-2": "^5.3.0",
    "react-code-blocks": "^0.1.6",
    "react-datepicker": "^7.6.0",
-    "react-day-picker": "^9.7.0",
+    "react-day-picker": "8.10.1",
    "react-dom": "19.0.0",
    "react-icons": "^5.5.0",
    "react-simple-typewriter": "^5.0.1",
--- a/frontend/public/json/adventurelog.json
+++ b/frontend/public/json/adventurelog.json
@ -35,6 +35,10 @@
    {
      "text": "AdventureLog uses an initial local IP, if you change your LXC-IP, you need to change the IP here: `/opt/adventurelog/backend/server/.env` and here: `/opt/adventurelog/frontend/.env`",
      "type": "warning"
+    },
+    {
+      "text": "Use `cat ~/adventurelog.creds` to see login credentials.",
+      "type": "info"
    }
  ]
 }
--- a/frontend/public/json/authentik.json
+++ b/frontend/public/json/authentik.json
@ -1,44 +0,0 @@
-{
-    "name": "authentik",
-    "slug": "authentik",
-    "categories": [
-        6
-    ],
-    "date_created": "2024-12-27",
-    "type": "ct",
-    "updateable": true,
-    "privileged": false,
-    "interface_port": 9000,
-    "documentation": "https://docs.goauthentik.io/docs/",
-    "website": "https://goauthentik.io/",
-    "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons/webp/authentik.webp",
-    "config_path": "/etc/authentik/config.yml",
-    "description": "authentik is an IdP (Identity Provider) and SSO (single sign on) that is built with security at the forefront of every piece of code, every feature, with an emphasis on flexibility and versatility.",
-    "install_methods": [
-        {
-            "type": "default",
-            "script": "ct/authentik.sh",
-            "resources": {
-                "cpu": 6,
-                "ram": 10240,
-                "hdd": 12,
-                "os": "debian",
-                "version": "12"
-            }
-        }
-    ],
-    "default_credentials": {
-        "username": null,
-        "password": null
-    },
-    "notes": [
-        {
-            "text": "Authentik is very resource-heavy, it is recommended to use at least 10GB RAM anytime!",
-            "type": "warning"
-        },
-        {
-            "text": "Some updates don't work due to massive dependency errors, it's recommended to do a backup before updating or a pg_dump and a new LXC.",
-            "type": "warning"
-        }
-    ]
-}
--- a/frontend/public/json/clean-lxcs.json
+++ b/frontend/public/json/clean-lxcs.json
@ -5,7 +5,7 @@
    1
  ],
  "date_created": "2024-04-29",
-  "type": "addon",
+  "type": "pve",
  "updateable": false,
  "privileged": false,
  "interface_port": null,
--- a/frontend/public/json/cron-update-lxcs.json
+++ b/frontend/public/json/cron-update-lxcs.json
@ -37,7 +37,7 @@
      "type": "info"
    },
    {
-      "text": "To exclude LXCs from updating, edit the crontab using `crontab -e` and add CTID as shown in the example below:\n\n\n\n`0 0 * * 0 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /bin/bash -c '$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/update-lxcs-cron.sh)' -s 103 111 >>/var/log/update-lxcs-cron.log 2>/dev/null`",
+      "text": "To exclude LXCs from updating, edit the crontab using `crontab -e` and add CTID as shown in the example below:\n\n\n\n`0 0 * * 0 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /bin/bash -c \"$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/update-lxcs-cron.sh)\" -s 103 111 >>/var/log/update-lxcs-cron.log 2>/dev/null`",
      "type": "info"
    }
  ]
--- a/frontend/public/json/emby.json
+++ b/frontend/public/json/emby.json
@ -6,7 +6,7 @@
  ],
  "date_created": "2024-05-02",
  "type": "ct",
-  "updateable": false,
+  "updateable": true,
  "privileged": false,
  "interface_port": 8096,
  "documentation": "https://emby.media/support/articles/Home.html",
--- a/frontend/public/json/gitea-mirror.json
+++ b/frontend/public/json/gitea-mirror.json
@ -0,0 +1,35 @@
+{
+  "name": "Gitea-Mirror",
+  "slug": "gitea-mirror",
+  "categories": [
+    7
+  ],
+  "date_created": "2025-06-05",
+  "type": "ct",
+  "updateable": true,
+  "privileged": false,
+  "interface_port": 4321,
+  "documentation": "https://github.com/arunavo4/gitea-mirror/",
+  "config_path": "/etc/systemd/system/gitea-mirror.service",
+  "website": "https://github.com/arunavo4/gitea-mirror/",
+  "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons/webp/gitea-mirror.webp",
+  "description": "Gitea Mirror auto-syncs GitHub repos to your self-hosted Gitea, with a sleek Web UI and easy Docker deployment. ",
+  "install_methods": [
+    {
+      "type": "default",
+      "script": "ct/gitea-mirror.sh",
+      "resources": {
+        "cpu": 1,
+        "ram": 1024,
+        "hdd": 5,
+        "os": "Debian",
+        "version": "12"
+      }
+    }
+  ],
+  "default_credentials": {
+    "username": null,
+    "password": null
+  },
+  "notes": []
+}
--- a/frontend/public/json/immich.json
+++ b/frontend/public/json/immich.json
@ -0,0 +1,48 @@
+{
+  "name": "Immich",
+  "slug": "immich",
+  "categories": [
+    13
+  ],
+  "date_created": "2025-06-01",
+  "type": "ct",
+  "updateable": true,
+  "privileged": false,
+  "interface_port": 2283,
+  "documentation": "https://immich.app/docs/overview/introduction",
+  "website": "https://immich.app",
+  "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons/webp/immich.webp",
+  "config_path": "/opt/immich/.env",
+  "description": "High performance self-hosted photo and video management solution.",
+  "install_methods": [
+    {
+      "type": "default",
+      "script": "ct/immich.sh",
+      "resources": {
+        "cpu": 4,
+        "ram": 4096,
+        "hdd": 20,
+        "os": "Debian",
+        "version": "12"
+      }
+    }
+  ],
+  "default_credentials": {
+    "username": null,
+    "password": null
+  },
+  "notes": [
+    {
+      "text": "During installation, HW-accelerated machine-learning (with OpenVINO) is an available option. This also allows for HW-accelerated transcoding, but it must be enabled in Video Transcoding Settings",
+      "type": "info"
+    },
+    {
+      "text": "If using OpenVINO HW machine-learning, increase RAM because OpenVINO is memory-intensive",
+      "type": "info"
+    },
+    {
+      "text": "To change upload location, edit 'IMMICH_MEDIA_LOCATION' in `/opt/immich/.env`",
+      "type": "info"
+    }
+  ]
+}
--- a/frontend/public/json/lyrionmusicserver.json
+++ b/frontend/public/json/lyrionmusicserver.json
@ -0,0 +1,35 @@
+{
+  "name": "Lyrion Music Server",
+  "slug": "lyrionmusicserver",
+  "categories": [
+    13
+  ],
+  "date_created": "2025-06-05",
+  "type": "ct",
+  "updateable": true,
+  "privileged": false,
+  "config_path": "/etc/default/lyrionmusicserver",
+  "interface_port": 9000,
+  "documentation": "https://lyrion.org/",
+  "website": "https://lyrion.org/",
+  "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons/webp/lyrion-media-server.webp",
+  "description": "Lyrion Music Server is an open-source server software to stream local music collections, internet radio, and music services to Squeezebox and compatible audio players.",
+  "install_methods": [
+    {
+      "type": "default",
+      "script": "ct/lyrionmusicserver.sh",
+      "resources": {
+        "cpu": 1,
+        "ram": 1024,
+        "hdd": 3,
+        "os": "Debian",
+        "version": "12"
+      }
+    }
+  ],
+  "default_credentials": {
+    "username": null,
+    "password": null
+  },
+  "notes": []
+}
--- a/frontend/public/json/metube.json.bak
+++ b/frontend/public/json/metube.json.bak
--- a/frontend/public/json/netbox.json
+++ b/frontend/public/json/netbox.json
@ -10,7 +10,7 @@
  "privileged": false,
  "interface_port": 443,
  "documentation": "https://netboxlabs.com/docs/netbox/en/stable/",
-  "website": "https://netboxlabs.com/",
+  "website": "https://netboxlabs.com/products/netbox/",
  "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons/webp/netbox.webp",
  "config_path": "/opt/netbox/netbox/netbox/configuration.py",
  "description": "NetBox is the source of truth for everything on your network, from physical components like power systems and cabling to virtual assets like IP addresses and VLANs. Network automation and observability tools depend on NetBox’s authoritative data to roll out configurations, monitor changes, and accelerate operations across the enterprise",
--- a/frontend/public/json/pingvin.json
+++ b/frontend/public/json/pingvin.json
@ -6,7 +6,7 @@
  ],
  "date_created": "2024-05-02",
  "type": "ct",
-  "updateable": false,
+  "updateable": true,
  "privileged": false,
  "interface_port": 3000,
  "documentation": "https://stonith404.github.io/pingvin-share/introduction",
--- a/frontend/public/json/pulse.json
+++ b/frontend/public/json/pulse.json
@ -12,7 +12,7 @@
  "documentation": null,
  "website": "https://github.com/rcourtman/Pulse",
  "logo": "https://raw.githubusercontent.com/rcourtman/Pulse/main/src/public/logos/pulse-logo-256x256.png",
-  "config_path": "/opt/pulse-proxmox/.env",
+  "config_path": "/opt/pulse/.env",
  "description": "A lightweight monitoring application for Proxmox VE that displays real-time status for VMs and containers via a simple web interface.",
  "install_methods": [
    {
@ -35,6 +35,10 @@
    {
      "text": "Create Proxmox-API-Token first: `https://github.com/rcourtman/Pulse?tab=readme-ov-file#creating-a-proxmox-api-token`",
      "type": "Info"
+    },
+    {
+      "text": "After installation, access the web interface to configure your Proxmox connection details through the built-in setup wizard",
+      "type": "Info"
    }
  ]
 }
--- a/frontend/public/json/pve-privilege-converter.json
+++ b/frontend/public/json/pve-privilege-converter.json
@ -0,0 +1,48 @@
+{
+  "name": "PVE Privilege Converter",
+  "slug": "pve-privilege-converter",
+  "categories": [
+    1
+  ],
+  "date_created": "2025-06-02",
+  "type": "pve",
+  "updateable": false,
+  "privileged": false,
+  "interface_port": null,
+  "documentation": "https://github.com/onethree7/proxmox-lxc-privilege-converter",
+  "website": null,
+  "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons/webp/proxmox.webp",
+  "config_path": "",
+  "description": "This script allows converting Proxmox LXC containers between privileged and unprivileged modes using vzdump backup and restore. It guides you through container selection, backup storage, ID assignment, and privilege flipping via automated restore. Useful for applying changes that require different LXC modes.",
+  "install_methods": [
+    {
+      "type": "default",
+      "script": "tools/pve/pve-privilege-converter.sh",
+      "resources": {
+        "cpu": null,
+        "ram": null,
+        "hdd": null,
+        "os": null,
+        "version": null
+      }
+    }
+  ],
+  "default_credentials": {
+    "username": null,
+    "password": null
+  },
+  "notes": [
+    {
+      "text": "Execute this script inside the Proxmox shell as root.",
+      "type": "info"
+    },
+    {
+      "text": "Ensure that the backup and target storage have enough space.",
+      "type": "warning"
+    },
+    {
+      "text": "The container will be recreated with a new ID and desired privilege setting.",
+      "type": "info"
+    }
+  ]
+}
--- a/frontend/public/json/versions.json
+++ b/frontend/public/json/versions.json
--- a/frontend/public/json/wavelog.json
+++ b/frontend/public/json/wavelog.json
@ -33,7 +33,7 @@
  },
  "notes": [
    {
-      "text": "Database credentials: `cat wavelog.creds`",
+      "text": "Database credentials: `cat ~/wavelog.creds`",
      "type": "info"
    }
  ]
--- a/frontend/public/json/zot-registry.json
+++ b/frontend/public/json/zot-registry.json
@ -0,0 +1,35 @@
+{
+  "name": "Zot Registry",
+  "slug": "zot",
+  "categories": [
+    13
+  ],
+  "date_created": "2025-06-06",
+  "type": "ct",
+  "updateable": true,
+  "privileged": false,
+  "interface_port": 8080,
+  "documentation": "https://zotregistry.dev/docs/intro/",
+  "website": "https://zotregistry.dev/",
+  "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons/webp/zot-registry.webp",
+  "config_path": "/etc/zot/config.json",
+  "description": "Zot is a cloud-native OCI image registry focused on extensibility, maintainability, and performance. It supports advanced features such as Web UI, security scanning, authentication via htpasswd and OIDC, and more.",
+  "install_methods": [
+    {
+      "type": "default",
+      "script": "ct/zot-registry.sh",
+      "resources": {
+        "cpu": 1,
+        "ram": 2048,
+        "hdd": 5,
+        "os": "Debian",
+        "version": "12"
+      }
+    }
+  ],
+  "default_credentials": {
+    "username": null,
+    "password": null
+  },
+  "notes": []
+}
--- a/frontend/src/app/scripts/_components/ScriptItems/DefaultPassword.tsx
+++ b/frontend/src/app/scripts/_components/ScriptItems/DefaultPassword.tsx
@ -5,7 +5,7 @@ import { Script } from "@/lib/types";

 export default function DefaultPassword({ item }: { item: Script }) {
  const { username, password } = item.default_credentials;
-  const hasDefaultLogin = username && password;
+  const hasDefaultLogin = username || password;

  if (!hasDefaultLogin) return null;

@ -23,14 +23,17 @@ export default function DefaultPassword({ item }: { item: Script }) {
        <p className="mb-2 text-sm">
          You can use the following credentials to login to the {item.name} {item.type}.
        </p>
-        {["username", "password"].map((type) => (
-          <div key={type} className="text-sm">
-            {type.charAt(0).toUpperCase() + type.slice(1)}:{" "}
-            <Button variant="secondary" size="null" onClick={() => copyCredential(type as "username" | "password")}>
-              {item.default_credentials[type as "username" | "password"]}
-            </Button>
-          </div>
-        ))}
+        {["username", "password"].map((type) => {
+          const value = item.default_credentials[type as "username" | "password"];
+          return value && value.trim() !== "" ? (
+            <div key={type} className="text-sm">
+              {type.charAt(0).toUpperCase() + type.slice(1)}:{" "}
+              <Button variant="secondary" size="null" onClick={() => copyCredential(type as "username" | "password")}>
+                {value}
+              </Button>
+            </div>
+          ) : null;
+        })}
      </div>
    </div>
  );
--- a/install/2fauth-install.sh
+++ b/install/2fauth-install.sh
@ -33,7 +33,7 @@ DB_NAME=2fauth_db
 DB_USER=2fauth
 DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
 $STD mariadb -u root -e "CREATE DATABASE $DB_NAME;"
-$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED WITH mysql_native_password AS PASSWORD('$DB_PASS');"
+$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
 $STD mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
 {
  echo "2FAuth Credentials"
--- a/install/alpine-nextcloud-install.sh
+++ b/install/alpine-nextcloud-install.sh
@ -48,7 +48,7 @@ $STD apk add nextcloud-mysql mariadb mariadb-client
 $STD mariadb-install-db --user=mysql --datadir=/var/lib/mysql
 $STD service mariadb start
 $STD rc-update add mariadb
-mariadb -uroot -p"$ADMIN_PASS" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY '$ADMIN_PASS' WITH GRANT OPTION; DELETE FROM mysql.user WHERE User=''; DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1'); DROP DATABASE test; DELETE FROM mysql.db WHERE Db='test' OR Db='test\_%'; CREATE DATABASE $DB_NAME; GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS'; GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost.localdomain' IDENTIFIED BY '$DB_PASS'; FLUSH PRIVILEGES;"
+$STD mariadb -uroot -p"$ADMIN_PASS" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY '$ADMIN_PASS' WITH GRANT OPTION; DELETE FROM mysql.user WHERE User=''; DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1'); DROP DATABASE test; DELETE FROM mysql.db WHERE Db='test' OR Db='test\_%'; CREATE DATABASE $DB_NAME; GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS'; GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost.localdomain' IDENTIFIED BY '$DB_PASS'; FLUSH PRIVILEGES;"
 $STD apk del mariadb-client
 msg_ok "Installed MySQL Database"

--- a/install/alpine-rclone-install.sh
+++ b/install/alpine-rclone-install.sh
@ -15,7 +15,7 @@ update_os

 msg_info "Installing dependencies"
 $STD apk add --no-cache \
-  apache2-utils
+  apache2-utils fuse3
 msg_ok "Installed dependencies"

 msg_info "Installing rclone"
--- a/install/alpine-tinyauth-install.sh
+++ b/install/alpine-tinyauth-install.sh
@ -61,7 +61,15 @@ pidfile="/var/run/tinyauth.pid"

 start_pre() {
    if [ -f "/opt/tinyauth/.env" ]; then
-        export \$(grep -v '^#' /opt/tinyauth/.env | xargs)
+        while IFS= read -r line || [ -n "$line" ]; do
+            [ -z "$line" ] && continue
+            case "$line" in
+                '#'*)
+                    continue
+                    ;;
+            esac
+            export "$line"
+        done < "/opt/tinyauth/.env"
    fi
 }

--- a/install/apache-guacamole-install.sh
+++ b/install/apache-guacamole-install.sh
@ -76,9 +76,9 @@ msg_info "Setup Database"
 DB_NAME=guacamole_db
 DB_USER=guacamole_user
 DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
-mariadb -u root -e "CREATE DATABASE $DB_NAME;"
-mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED WITH mysql_native_password AS PASSWORD('$DB_PASS');"
-mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
+$STD mariadb -u root -e "CREATE DATABASE $DB_NAME;"
+$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
+$STD mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
 {
  echo "Guacamole-Credentials"
  echo "Database User: $DB_USER"
--- a/install/authentik-install.sh
+++ b/install/authentik-install.sh
@ -1,198 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2025 community-scripts ORG
-# Author: remz1337
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://goauthentik.io/
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies (Patience)"
-$STD apt-get install -y \
-  pkg-config \
-  libffi-dev \
-  build-essential \
-  libpq-dev \
-  libkrb5-dev \
-  libssl-dev \
-  libsqlite3-dev \
-  tk-dev \
-  libgdbm-dev \
-  libc6-dev \
-  libbz2-dev \
-  zlib1g-dev \
-  libxmlsec1 \
-  libxmlsec1-dev \
-  libxmlsec1-openssl \
-  libmaxminddb0 \
-  python3-pip \
-  redis-server \
-  git
-msg_ok "Installed Dependencies"
-
-setup_uv
-PG_VERSION="16" PG_MODULES="contrib" install_postgresql
-NODE_VERSION="22" install_node_and_modules
-install_go
-
-msg_info "Installing yq"
-cd /tmp
-YQ_LATEST="$(curl -fsSL https://api.github.com/repos/mikefarah/yq/releases/latest | grep -Po '"tag_name": "\K.*?(?=")')"
-curl -fsSL "https://github.com/mikefarah/yq/releases/download/${YQ_LATEST}/yq_linux_amd64" -o /usr/bin/yq
-chmod +x /usr/bin/yq
-msg_ok "Installed yq"
-
-msg_info "Installing GeoIP"
-cd /tmp
-GEOIP_RELEASE=$(curl -fsSL https://api.github.com/repos/maxmind/geoipupdate/releases/latest | grep "tag_name" | awk '{print substr($2, 3, length($2)-4) }')
-curl -fsSL "https://github.com/maxmind/geoipupdate/releases/download/v${GEOIP_RELEASE}/geoipupdate_${GEOIP_RELEASE}_linux_amd64.deb" -o "geoipupdate.deb"
-$STD dpkg -i geoipupdate.deb
-cat <<EOF >/etc/GeoIP.conf
-#GEOIPUPDATE_EDITION_IDS="GeoLite2-City GeoLite2-ASN"
-#GEOIPUPDATE_VERBOSE="1"
-#GEOIPUPDATE_ACCOUNT_ID_FILE="/run/secrets/GEOIPUPDATE_ACCOUNT_ID"
-#GEOIPUPDATE_LICENSE_KEY_FILE="/run/secrets/GEOIPUPDATE_LICENSE_KEY"
-EOF
-msg_ok "Installed GeoIP"
-
-msg_info "Setup PostgreSQL Database"
-DB_NAME="authentik"
-DB_USER="authentik"
-DB_PASS="$(openssl rand -base64 18 | cut -c1-13)"
-$STD sudo -u postgres psql -c "CREATE DATABASE $DB_NAME;"
-$STD sudo -u postgres psql -c "CREATE USER $DB_USER WITH PASSWORD '$DB_PASS';"
-$STD sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE $DB_NAME TO $DB_USER;"
-$STD sudo -u postgres psql -c "ALTER DATABASE $DB_NAME OWNER TO $DB_USER;"
-$STD sudo -u postgres psql -c "ALTER USER $DB_USER WITH SUPERUSER;"
-msg_ok "Installed PostgreSQL"
-
-msg_info "Installing authentik"
-RELEASE=$(curl -fsSL https://api.github.com/repos/goauthentik/authentik/releases/latest | grep "tarball_url" | awk '{print substr($2, 2, length($2)-3)}')
-mkdir -p /opt/authentik
-curl -fsSL "${RELEASE}" -o "authentik.tar.gz"
-tar -xzf authentik.tar.gz -C /opt/authentik --strip-components 1 --overwrite
-export NODE_OPTIONS="--max-old-space-size=4096"
-cd /opt/authentik/website
-$STD npm install
-$STD npm run build-bundled
-
-cd /opt/authentik/web
-$STD npm install
-$STD npm run build
-
-cd /opt/authentik
-$STD go mod download
-$STD go build -o /go/authentik ./cmd/server
-$STD go build -o /opt/authentik/authentik-server /opt/authentik/cmd/server/
-$STD uv sync --frozen --no-install-project --no-dev
-#$STD pip3 install --no-cache-dir --upgrade pip
-#$STD pip3 install --upgrade pip
-#$STD pip3 install poetry poetry-plugin-export
-
-#ln -s /usr/local/bin/poetry /usr/bin/poetry
-#$STD poetry install --only=main --no-ansi --no-interaction --no-root
-#$STD poetry export --without-hashes --without-urls -f requirements.txt --output requirements.txt
-#$STD pip install --no-cache-dir -r requirements.txt
-#$STD pip install .
-mkdir -p /etc/authentik
-mv /opt/authentik/authentik/lib/default.yml /etc/authentik/config.yml
-$STD yq -i ".secret_key = \"$(openssl rand -hex 32)\"" /etc/authentik/config.yml
-$STD yq -i ".postgresql.password = \"${DB_PASS}\"" /etc/authentik/config.yml
-$STD yq -i ".geoip = \"/opt/authentik/tests/GeoLite2-City-Test.mmdb\"" /etc/authentik/config.yml
-cp -r /opt/authentik/authentik/blueprints /opt/authentik/blueprints
-$STD yq -i ".blueprints_dir = \"/opt/authentik/blueprints\"" /etc/authentik/config.yml
-#ln -s /usr/bin/python3 /usr/bin/python
-#ln -s /usr/local/bin/gunicorn /usr/bin/gunicorn
-#ln -s /usr/local/bin/celery /usr/bin/celery
-#$STD bash /opt/authentik/lifecycle/ak migrate
-cd /opt/authentik
-uv run python -m lifecycle.migrate
-ln -s /opt/authentik/.venv/bin/gunicorn /usr/local/bin/gunicorn
-ln -s /opt/authentik/.venv/bin/celery /usr/local/bin/celery
-echo "${RELEASE}" >/opt/${APPLICATION}_version.txt
-msg_ok "Installed authentik"
-
-msg_info "Creating Services"
-cat <<EOF >/etc/systemd/system/authentik-server.service
-[Unit]
-Description=authentik Go Server (API Gateway)
-After=network.target
-Wants=redis.service postgresql.service
-
-[Service]
-WorkingDirectory=/opt/authentik/
-ExecStart=/opt/authentik/authentik-server
-Restart=always
-RestartSec=5
-Environment=DJANGO_SETTINGS_MODULE=authentik.root.settings
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-cat <<EOF >/etc/systemd/system/authentik-worker.service
-[Unit]
-Description=authentik Celery Worker
-After=network.target redis.service postgresql.service
-Requires=redis.service
-
-[Service]
-Type=simple
-WorkingDirectory=/opt/authentik
-ExecStart=/opt/authentik/.venv/bin/celery \
-  -A authentik.root.celery worker \
-  -Ofair \
-  --max-tasks-per-child=1 \
-  --autoscale 3,1 \
-  -Q authentik,authentik_scheduled,authentik_events \
-  -E
-Restart=always
-RestartSec=5
-Environment=DJANGO_SETTINGS_MODULE=authentik.root.settings
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-cat <<EOF >/etc/systemd/system/authentik-celery-beat.service
-[Unit]
-Description=authentik Celery Beat Scheduler
-After=network.target
-
-[Service]
-Type=simple
-WorkingDirectory=/opt/authentik
-ExecStart=/opt/authentik/.venv/bin/celery \
-  -A authentik.root.celery beat \
-  -s /tmp/celerybeat-schedule
-Restart=always
-RestartSec=5
-#User=authentik
-Environment=DJANGO_SETTINGS_MODULE=authentik.root.settings
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-systemctl enable -q --now authentik-server authentik-worker authentik-celery-beat
-msg_ok "Created Services"
-
-motd_ssh
-customize
-
-msg_info "Cleaning up"
-rm -rf /tmp/Python-3.12.1
-rm -rf /tmp/Python.tgz
-rm -rf go/
-rm -rf /tmp/geoipupdate.deb
-rm -rf authentik.tar.gz
-$STD apt-get -y remove yq
-$STD apt-get -y autoremove
-$STD apt-get -y autoclean
-msg_ok "Cleaned"
--- a/install/bookstack-install.sh
+++ b/install/bookstack-install.sh
@ -28,9 +28,9 @@ msg_info "Setting up Database"
 DB_NAME=bookstack
 DB_USER=bookstack
 DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
-$STD sudo mariadb -u root -e "CREATE DATABASE $DB_NAME;"
-$STD sudo mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED WITH mysql_native_password AS PASSWORD('$DB_PASS');"
-$STD sudo mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
+$STD mariadb -u root -e "CREATE DATABASE $DB_NAME;"
+$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
+$STD mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
 {
  echo "Bookstack-Credentials"
  echo "Bookstack Database User: $DB_USER"
--- a/install/dolibarr-install.sh
+++ b/install/dolibarr-install.sh
@ -23,7 +23,7 @@ install_mariadb

 msg_info "Setting up Database"
 ROOT_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
-$STD sudo mariadb -u root -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password AS PASSWORD('$ROOT_PASS'); flush privileges;"
+$STD mariadb -u root -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '$ROOT_PASS'); flush privileges;"
 {
  echo "Dolibarr DB Credentials"
  echo "MariaDB Root Password: $ROOT_PASS"
--- a/install/firefly-install.sh
+++ b/install/firefly-install.sh
@ -31,9 +31,9 @@ DB_NAME=firefly
 DB_USER=firefly
 DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
 MYSQL_VERSION=$(mariadb --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
-mysql -u root -e "CREATE DATABASE $DB_NAME;"
-mysql -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED WITH mysql_native_password AS PASSWORD('$DB_PASS');"
-mysql -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
+$STD mariadb -u root -e "CREATE DATABASE $DB_NAME;"
+$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
+mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
 {
  echo "Firefly-Credentials"
  echo "Firefly Database User: $DB_USER"
--- a/install/ghost-install.sh
+++ b/install/ghost-install.sh
@ -25,9 +25,9 @@ msg_info "Configuring Database"
 DB_NAME=ghost
 DB_USER=ghostuser
 DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
-mariadb -u root -e "CREATE DATABASE $DB_NAME;"
-mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
-mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
+$STD mariadb -u root -e "CREATE DATABASE $DB_NAME;"
+$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
+$STD mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"

 {
  echo "Ghost-Credentials"
--- a/install/gitea-mirror-install.sh
+++ b/install/gitea-mirror-install.sh
@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: CrazyWolf13
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/arunavo4/gitea-mirror
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing dependencies"
+$STD apt-get install -y \
+  build-essential \
+  openssl \
+  sqlite3 \
+  unzip
+msg_ok "Installed Dependencies"
+
+msg_info "Installing Bun"
+export BUN_INSTALL=/opt/bun
+curl -fsSL https://bun.sh/install | $STD bash
+ln -sf /opt/bun/bin/bun /usr/local/bin/bun
+ln -sf /opt/bun/bin/bun /usr/local/bin/bunx
+msg_ok "Installed Bun"
+
+fetch_and_deploy_gh_release "arunavo4/gitea-mirror"
+
+msg_info "Installing gitea-mirror"
+cd /opt/gitea-mirror
+$STD bun run setup
+$STD bun run build
+msg_ok "Installed gitea-mirror"
+
+msg_info "Creating Services"
+JWT_SECRET=$(openssl rand -hex 32)
+APP_VERSION=$(grep -o '"version": *"[^"]*"' package.json | cut -d'"' -f4)
+cat <<EOF >/etc/systemd/system/gitea-mirror.service
+[Unit]
+Description=Gitea Mirror
+After=network.target
+[Service]
+Type=simple
+WorkingDirectory=/opt/gitea-mirror
+ExecStart=/usr/local/bin/bun dist/server/entry.mjs
+Restart=on-failure
+RestartSec=10
+Environment=NODE_ENV=production
+Environment=HOST=0.0.0.0
+Environment=PORT=4321
+Environment=DATABASE_URL=file:/opt/gitea-mirror/data/gitea-mirror.db
+Environment=JWT_SECRET=${JWT_SECRET}
+Environment=npm_package_version=${APP_VERSION}
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now gitea-mirror
+msg_ok "Created Service"
+
+motd_ssh
+customize
+
+msg_info "Cleaning up"
+$STD apt-get -y autoremove
+$STD apt-get -y autoclean
+msg_ok "Cleaned"
--- a/install/glpi-install.sh
+++ b/install/glpi-install.sh
@ -29,10 +29,10 @@ DB_NAME=glpi_db
 DB_USER=glpi
 DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
 mysql_tzinfo_to_sql /usr/share/zoneinfo | mysql mysql
-mariadb -u root -e "CREATE DATABASE $DB_NAME;"
-mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
-mariadb -u root -e "GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'localhost';"
-mariadb -u root -e "GRANT SELECT ON \`mysql\`.\`time_zone_name\` TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
+$STD mariadb -u root -e "CREATE DATABASE $DB_NAME;"
+$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
+$STD mariadb -u root -e "GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'localhost';"
+$STD mariadb -u root -e "GRANT SELECT ON \`mysql\`.\`time_zone_name\` TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
 {
  echo "GLPI Database Credentials"
  echo "Database: $DB_NAME"
--- a/install/immich-install.sh
+++ b/install/immich-install.sh
@ -0,0 +1,459 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: vhsdream
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://immich.app
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Configuring apt and installing dependencies"
+echo "deb http://deb.debian.org/debian testing main contrib" >/etc/apt/sources.list.d/immich.list
+cat <<EOF >/etc/apt/preferences.d/immich
+Package: *
+Pin: release a=testing
+Pin-Priority: -10
+EOF
+
+$STD apt-get update
+$STD apt-get install --no-install-recommends -y \
+  git \
+  redis \
+  autoconf \
+  build-essential \
+  python3-venv \
+  python3-dev \
+  cmake \
+  jq \
+  libbrotli-dev \
+  libde265-dev \
+  libexif-dev \
+  libexpat1-dev \
+  libglib2.0-dev \
+  libgsf-1-dev \
+  libjpeg62-turbo-dev \
+  librsvg2-dev \
+  libspng-dev \
+  meson \
+  ninja-build \
+  pkg-config \
+  cpanminus \
+  libde265-0 \
+  libexif12 \
+  libexpat1 \
+  libgcc-s1 \
+  libglib2.0-0 \
+  libgomp1 \
+  libgsf-1-114 \
+  liblcms2-dev \
+  liblqr-1-0 \
+  libltdl7 \
+  libmimalloc2.0 \
+  libopenexr-dev \
+  libgif-dev \
+  libopenjp2-7 \
+  librsvg2-2 \
+  libspng0 \
+  mesa-utils \
+  mesa-va-drivers \
+  mesa-vulkan-drivers \
+  tini \
+  zlib1g
+$STD apt-get install -y \
+  libgdk-pixbuf-2.0-dev librsvg2-dev libtool
+curl -fsSL https://repo.jellyfin.org/jellyfin_team.gpg.key | gpg --dearmor -o /etc/apt/keyrings/jellyfin.gpg
+DPKG_ARCHITECTURE="$(dpkg --print-architecture)"
+export DPKG_ARCHITECTURE
+cat <<EOF >/etc/apt/sources.list.d/jellyfin.sources
+Types: deb
+URIs: https://repo.jellyfin.org/debian
+Suites: bookworm
+Components: main
+Architectures: ${DPKG_ARCHITECTURE}
+Signed-By: /etc/apt/keyrings/jellyfin.gpg
+EOF
+$STD apt-get update
+$STD apt-get install -y jellyfin-ffmpeg7
+ln -s /usr/lib/jellyfin-ffmpeg/ffmpeg /usr/bin/ffmpeg
+ln -s /usr/lib/jellyfin-ffmpeg/ffprobe /usr/bin/ffprobe
+msg_ok "Dependencies Installed"
+
+NODE_VERSION="22" install_node_and_modules
+PG_VERSION="16" install_postgresql
+
+read -r -p "${TAB3}Install OpenVINO dependencies for Intel HW-accelerated machine-learning? " prompt
+if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
+  msg_info "Installing OpenVINO dependencies"
+  touch ~/.openvino
+  $STD apt-get -y install --no-install-recommends ocl-icd-libopencl1
+  tmp_dir=$(mktemp -d)
+  $STD pushd "$tmp_dir"
+  curl -fsSL https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17384.11/intel-igc-core_1.0.17384.11_amd64.deb -O
+  curl -fsSL https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17384.11/intel-igc-opencl_1.0.17384.11_amd64.deb -O
+  curl -fsSL https://github.com/intel/compute-runtime/releases/download/24.31.30508.7/intel-opencl-icd_24.31.30508.7_amd64.deb -O
+  curl -fsSL https://github.com/intel/compute-runtime/releases/download/24.31.30508.7/libigdgmm12_22.4.1_amd64.deb -O
+  $STD dpkg -i ./*.deb
+  $STD popd
+  rm -rf "$tmp_dir"
+  dpkg -l | grep "intel-opencl-icd" | awk '{print $3}' >~/.intel_version
+  if [[ "$CTTYPE" == "0" ]]; then
+    chgrp video /dev/dri
+    chmod 755 /dev/dri
+    chmod 660 /dev/dri/*
+    $STD adduser "$(id -u -n)" video
+    $STD adduser "$(id -u -n)" render
+  fi
+  msg_ok "Installed OpenVINO dependencies"
+fi
+
+msg_info "Setting up Postgresql Database"
+$STD apt-get install postgresql-16-pgvector
+curl -fsSL https://github.com/tensorchord/VectorChord/releases/download/0.3.0/postgresql-16-vchord_0.3.0-1_amd64.deb -o vchord.deb
+$STD dpkg -i vchord.deb
+rm vchord.deb
+DB_NAME="immich"
+DB_USER="immich"
+DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c18)
+sed -i -e "/^#shared_preload/s/^#//;/^shared_preload/s/''/'vchord.so'/" /etc/postgresql/16/main/postgresql.conf
+systemctl restart postgresql.service
+$STD sudo -u postgres psql -c "CREATE USER $DB_USER WITH ENCRYPTED PASSWORD '$DB_PASS';"
+$STD sudo -u postgres psql -c "CREATE DATABASE $DB_NAME WITH OWNER $DB_USER ENCODING 'UTF8' TEMPLATE template0;"
+$STD sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE $DB_NAME to $DB_USER;"
+$STD sudo -u postgres psql -c "ALTER USER $DB_USER WITH SUPERUSER;"
+{
+  echo "${APPLICATION} DB Credentials"
+  echo "Database User: $DB_USER"
+  echo "Database Password: $DB_PASS"
+  echo "Database Name: $DB_NAME"
+} >>~/"$APPLICATION".creds
+msg_ok "Set up Postgresql Database"
+
+msg_info "Installing Packages from Testing Repo"
+export APT_LISTCHANGES_FRONTEND=none
+export DEBIAN_FRONTEND=noninteractive
+$STD apt-get install -t testing --no-install-recommends -y \
+  libio-compress-brotli-perl \
+  libwebp7 \
+  libwebpdemux2 \
+  libwebpmux3 \
+  libhwy1t64 \
+  libdav1d-dev \
+  libhwy-dev \
+  libwebp-dev
+if [[ -f ~/.openvino ]]; then
+  $STD apt-get install -t testing -y patchelf
+fi
+msg_ok "Packages from Testing Repo Installed"
+
+# Fix default DB collation issue after libc update
+$STD sudo -u postgres psql -c "ALTER DATABASE postgres REFRESH COLLATION VERSION;"
+$STD sudo -u postgres psql -c "ALTER DATABASE $DB_NAME REFRESH COLLATION VERSION;"
+
+msg_info "Compiling Custom Photo-processing Library (extreme patience)"
+LD_LIBRARY_PATH=/usr/local/lib
+export LD_RUN_PATH=/usr/local/lib
+STAGING_DIR=/opt/staging
+BASE_REPO="https://github.com/immich-app/base-images"
+BASE_DIR=${STAGING_DIR}/base-images
+SOURCE_DIR=${STAGING_DIR}/image-source
+$STD git clone -b main "$BASE_REPO" "$BASE_DIR"
+mkdir -p "$SOURCE_DIR"
+
+cd "$STAGING_DIR"
+SOURCE=${SOURCE_DIR}/libjxl
+JPEGLI_LIBJPEG_LIBRARY_SOVERSION="62"
+JPEGLI_LIBJPEG_LIBRARY_VERSION="62.3.0"
+: "${LIBJXL_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libjxl.json)}"
+$STD git clone https://github.com/libjxl/libjxl.git "$SOURCE"
+cd "$SOURCE"
+$STD git reset --hard "$LIBJXL_REVISION"
+$STD git submodule update --init --recursive --depth 1 --recommend-shallow
+$STD git apply "$BASE_DIR"/server/sources/libjxl-patches/jpegli-empty-dht-marker.patch
+$STD git apply "$BASE_DIR"/server/sources/libjxl-patches/jpegli-icc-warning.patch
+mkdir build
+cd build
+$STD cmake \
+  -DCMAKE_BUILD_TYPE=Release \
+  -DBUILD_TESTING=OFF \
+  -DJPEGXL_ENABLE_DOXYGEN=OFF \
+  -DJPEGXL_ENABLE_MANPAGES=OFF \
+  -DJPEGXL_ENABLE_PLUGIN_GIMP210=OFF \
+  -DJPEGXL_ENABLE_BENCHMARK=OFF \
+  -DJPEGXL_ENABLE_EXAMPLES=OFF \
+  -DJPEGXL_FORCE_SYSTEM_BROTLI=ON \
+  -DJPEGXL_FORCE_SYSTEM_HWY=ON \
+  -DJPEGXL_ENABLE_JPEGLI=ON \
+  -DJPEGXL_ENABLE_JPEGLI_LIBJPEG=ON \
+  -DJPEGXL_INSTALL_JPEGLI_LIBJPEG=ON \
+  -DJPEGXL_ENABLE_PLUGINS=ON \
+  -DJPEGLI_LIBJPEG_LIBRARY_SOVERSION="$JPEGLI_LIBJPEG_LIBRARY_SOVERSION" \
+  -DJPEGLI_LIBJPEG_LIBRARY_VERSION="$JPEGLI_LIBJPEG_LIBRARY_VERSION" \
+  -DLIBJPEG_TURBO_VERSION_NUMBER=2001005 \
+  ..
+$STD cmake --build . -- -j"$(nproc)"
+$STD cmake --install .
+ldconfig /usr/local/lib
+$STD make clean
+cd "$STAGING_DIR"
+rm -rf "$SOURCE"/{build,third_party}
+
+SOURCE=${SOURCE_DIR}/libheif
+: "${LIBHEIF_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libheif.json)}"
+$STD git clone https://github.com/strukturag/libheif.git "$SOURCE"
+cd "$SOURCE"
+$STD git reset --hard "$LIBHEIF_REVISION"
+mkdir build
+cd build
+$STD cmake --preset=release-noplugins \
+  -DWITH_DAV1D=ON \
+  -DENABLE_PARALLEL_TILE_DECODING=ON \
+  -DWITH_LIBSHARPYUV=ON \
+  -DWITH_LIBDE265=ON \
+  -DWITH_AOM_DECODER=OFF \
+  -DWITH_AOM_ENCODER=OFF \
+  -DWITH_X265=OFF \
+  -DWITH_EXAMPLES=OFF \
+  ..
+$STD make install -j "$(nproc)"
+ldconfig /usr/local/lib
+$STD make clean
+cd "$STAGING_DIR"
+rm -rf "$SOURCE"/build
+
+SOURCE=${SOURCE_DIR}/libraw
+: "${LIBRAW_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libraw.json)}"
+$STD git clone https://github.com/libraw/libraw.git "$SOURCE"
+cd "$SOURCE"
+$STD git reset --hard "$LIBRAW_REVISION"
+$STD autoreconf --install
+$STD ./configure
+$STD make -j"$(nproc)"
+$STD make install
+ldconfig /usr/local/lib
+$STD make clean
+cd "$STAGING_DIR"
+
+SOURCE=$SOURCE_DIR/imagemagick
+: "${IMAGEMAGICK_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/imagemagick.json)}"
+$STD git clone https://github.com/ImageMagick/ImageMagick.git "$SOURCE"
+cd "$SOURCE"
+$STD git reset --hard "$IMAGEMAGICK_REVISION"
+$STD ./configure --with-modules
+$STD make -j"$(nproc)"
+$STD make install
+ldconfig /usr/local/lib
+$STD make clean
+cd "$STAGING_DIR"
+
+SOURCE=$SOURCE_DIR/libvips
+: "${LIBVIPS_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libvips.json)}"
+$STD git clone https://github.com/libvips/libvips.git "$SOURCE"
+cd "$SOURCE"
+$STD git reset --hard "$LIBVIPS_REVISION"
+$STD meson setup build --buildtype=release --libdir=lib -Dintrospection=disabled -Dtiff=disabled
+cd build
+$STD ninja install
+ldconfig /usr/local/lib
+cd "$STAGING_DIR"
+rm -rf "$SOURCE"/build
+{
+  echo "imagemagick: $IMAGEMAGICK_REVISION"
+  echo "libheif: $LIBHEIF_REVISION"
+  echo "libjxl: $LIBJXL_REVISION"
+  echo "libraw: $LIBRAW_REVISION"
+  echo "libvips: $LIBVIPS_REVISION"
+} >~/.immich_library_revisions
+msg_ok "Custom Photo-processing Library Compiled"
+
+msg_info "Installing ${APPLICATION} (more patience please)"
+tmp_file=$(mktemp)
+RELEASE=$(curl -s https://api.github.com/repos/immich-app/immich/releases?per_page=1 | grep "tag_name" | awk '{print substr($2, 3, length($2)-4) }')
+curl -fsSL "https://github.com/immich-app/immich/archive/refs/tags/v${RELEASE}.zip" -o "$tmp_file"
+unzip -q "$tmp_file"
+INSTALL_DIR="/opt/${APPLICATION}"
+UPLOAD_DIR="${INSTALL_DIR}/upload"
+SRC_DIR="${INSTALL_DIR}/source"
+APP_DIR="${INSTALL_DIR}/app"
+ML_DIR="${APP_DIR}/machine-learning"
+GEO_DIR="${INSTALL_DIR}/geodata"
+mkdir -p "$INSTALL_DIR"
+mv "$APPLICATION-$RELEASE"/ "$SRC_DIR"
+mkdir -p {"${APP_DIR}","${UPLOAD_DIR}","${GEO_DIR}","${ML_DIR}","${INSTALL_DIR}"/cache}
+
+cd "$SRC_DIR"/server
+$STD npm install -g node-gyp node-pre-gyp
+$STD npm ci
+$STD npm run build
+$STD npm prune --omit=dev --omit=optional
+cd "$SRC_DIR"/open-api/typescript-sdk
+$STD npm ci
+$STD npm run build
+cd "$SRC_DIR"/web
+$STD npm ci
+$STD npm run build
+cd "$SRC_DIR"
+cp -a server/{node_modules,dist,bin,resources,package.json,package-lock.json,start*.sh} "$APP_DIR"/
+cp -a web/build "$APP_DIR"/www
+cp LICENSE "$APP_DIR"
+msg_ok "Installed Immich Web Components"
+
+cd "$SRC_DIR"/machine-learning
+$STD python3 -m venv "$ML_DIR/ml-venv"
+if [[ -f ~/.openvino ]]; then
+  msg_info "Installing HW-accelerated machine-learning"
+  (
+    source "$ML_DIR"/ml-venv/bin/activate
+    $STD pip3 install uv
+    uv -q sync --extra openvino --no-cache --active
+  )
+  patchelf --clear-execstack "$ML_DIR"/ml-venv/lib/python3.11/site-packages/onnxruntime/capi/onnxruntime_pybind11_state.cpython-311-x86_64-linux-gnu.so
+  msg_ok "Installed HW-accelerated machine-learning"
+else
+  msg_info "Installing machine-learning"
+  (
+    source "$ML_DIR"/ml-venv/bin/activate
+    $STD pip3 install uv
+    uv -q sync --extra cpu --no-cache --active
+  )
+  msg_ok "Installed machine-learning"
+fi
+cd "$SRC_DIR"
+cp -a machine-learning/{ann,immich_ml} "$ML_DIR"
+if [[ -f ~/.openvino ]]; then
+  sed -i "/intra_op/s/int = 0/int = os.cpu_count() or 0/" "$ML_DIR"/immich_ml/config.py
+fi
+ln -sf "$APP_DIR"/resources "$INSTALL_DIR"
+
+cd "$APP_DIR"
+grep -Rl /usr/src | xargs -n1 sed -i "s|\/usr/src|$INSTALL_DIR|g"
+grep -RlE "'/build'" | xargs -n1 sed -i "s|'/build'|'$APP_DIR'|g"
+sed -i "s@\"/cache\"@\"$INSTALL_DIR/cache\"@g" "$ML_DIR"/immich_ml/config.py
+ln -s "$UPLOAD_DIR" "$APP_DIR"/upload
+ln -s "$UPLOAD_DIR" "$ML_DIR"/upload
+
+msg_info "Installing Immich CLI"
+$STD npm install --build-from-source sharp
+rm -rf "$APP_DIR"/node_modules/@img/sharp-{libvips*,linuxmusl-x64}
+$STD npm i -g @immich/cli
+msg_ok "Installed Immich CLI"
+
+msg_info "Installing GeoNames data"
+cd "$GEO_DIR"
+URL_LIST=(
+  https://download.geonames.org/export/dump/admin1CodesASCII.txt
+  https://download.geonames.org/export/dump/admin2Codes.txt
+  https://download.geonames.org/export/dump/cities500.zip
+  https://raw.githubusercontent.com/nvkelso/natural-earth-vector/v5.1.2/geojson/ne_10m_admin_0_countries.geojson
+)
+echo "${URL_LIST[@]}" | xargs -n1 -P 8 wget -q
+unzip -q cities500.zip
+date --iso-8601=seconds | tr -d "\n" >geodata-date.txt
+rm cities500.zip
+cd "$INSTALL_DIR"
+ln -s "$GEO_DIR" "$APP_DIR"
+msg_ok "Installed GeoNames data"
+
+mkdir -p /var/log/immich
+touch /var/log/immich/{web.log,ml.log}
+echo "$RELEASE" >/opt/"${APPLICATION}"_version.txt
+msg_ok "Installed ${APPLICATION}"
+
+msg_info "Creating user, env file, scripts & services"
+$STD useradd -U -s /usr/sbin/nologin -r -M -d "$INSTALL_DIR" immich
+if [[ -f ~/.openvino ]]; then
+  usermod -aG video,render immich
+fi
+cat <<EOF >"${INSTALL_DIR}"/.env
+TZ=$(cat /etc/timezone)
+IMMICH_VERSION=release
+NODE_ENV=production
+
+DB_HOSTNAME=127.0.0.1
+DB_USERNAME=${DB_USER}
+DB_PASSWORD=${DB_PASS}
+DB_DATABASE_NAME=${DB_NAME}
+DB_VECTOR_EXTENSION=vectorchord
+
+REDIS_HOSTNAME=127.0.0.1
+IMMICH_MACHINE_LEARNING_URL=http://127.0.0.1:3003
+MACHINE_LEARNING_CACHE_FOLDER=${INSTALL_DIR}/cache
+
+IMMICH_MEDIA_LOCATION=${UPLOAD_DIR}
+EOF
+cat <<EOF >"${ML_DIR}"/ml_start.sh
+#!/usr/bin/env bash
+
+cd ${ML_DIR}
+. ml-venv/bin/activate
+
+set -a
+. ${INSTALL_DIR}/.env
+set +a
+
+python -m immich_ml
+EOF
+chmod +x "$ML_DIR"/ml_start.sh
+cat <<EOF >/etc/systemd/system/"${APPLICATION}"-web.service
+[Unit]
+Description=${APPLICATION} Web Service
+After=network.target
+Requires=redis-server.service
+Requires=postgresql.service
+Requires=immich-ml.service
+
+[Service]
+Type=simple
+User=immich
+Group=immich
+UMask=0077
+WorkingDirectory=${APP_DIR}
+EnvironmentFile=${INSTALL_DIR}/.env
+ExecStart=/usr/bin/node ${APP_DIR}/dist/main
+Restart=on-failure
+SyslogIdentifier=immich-web
+StandardOutput=append:/var/log/immich/web.log
+StandardError=append:/var/log/immich/web.log
+
+[Install]
+WantedBy=multi-user.target
+EOF
+cat <<EOF >/etc/systemd/system/"${APPLICATION}"-ml.service
+[Unit]
+Description=${APPLICATION} Machine-Learning
+After=network.target
+
+[Service]
+Type=simple
+UMask=0077
+User=immich
+Group=immich
+WorkingDirectory=${APP_DIR}
+EnvironmentFile=${INSTALL_DIR}/.env
+ExecStart=${ML_DIR}/ml_start.sh
+Restart=on-failure
+SyslogIdentifier=immich-machine-learning
+StandardOutput=append:/var/log/immich/ml.log
+StandardError=append:/var/log/immich/ml.log
+
+[Install]
+WantedBy=multi-user.target
+EOF
+chown -R immich:immich "$INSTALL_DIR" /var/log/immich
+systemctl enable -q --now "$APPLICATION"-ml.service "$APPLICATION"-web.service
+msg_ok "Created user, env file, scripts and services"
+
+sed -i "$ a VERSION_ID=12" /etc/os-release # otherwise the motd_ssh function will fail
+motd_ssh
+customize
+
+msg_info "Cleaning up"
+rm -f "$tmp_file"
+$STD apt-get -y autoremove
+$STD apt-get -y autoclean
+msg_ok "Cleaned"
--- a/install/kasm-install.sh
+++ b/install/kasm-install.sh
@ -16,10 +16,9 @@ update_os
 msg_info "Installing Kasm Workspaces"
 KASM_VERSION=$(curl -fsSL 'https://www.kasmweb.com/downloads' | grep -o 'https://kasm-static-content.s3.amazonaws.com/kasm_release_[^"]*\.tar\.gz' | head -n 1 | sed -E 's/.*release_(.*)\.tar\.gz/\1/')
 curl -fsSL -o "/opt/kasm_release_${KASM_VERSION}.tar.gz" "https://kasm-static-content.s3.amazonaws.com/kasm_release_${KASM_VERSION}.tar.gz"
-cd /opt
-tar -xf "kasm_release_${KASM_VERSION}.tar.gz"
-chmod +x /opt/kasm_release/install.sh
-printf 'y\ny\ny\n4\n' | bash /opt/kasm_release/install.sh | tee ~/kasm-install.output
+tar -xf "/opt/kasm_release_${KASM_VERSION}.tar.gz" -C /opt
+printf 'y\ny\ny\n4\n' | bash /opt/kasm_release/install.sh
+touch ~/kasm-install.output
 sed -n '/Kasm UI Login Credentials/,$p' ~/kasm-install.output >~/kasm.creds
 msg_ok "Installed Kasm Workspaces"

@ -27,7 +26,7 @@ motd_ssh
 customize

 msg_info "Cleaning up"
-$STD rm -f /opt/kasm_release_${KASM_VERSION}.tar.gz
+$STD rm -f "/opt/kasm_release_${KASM_VERSION}.tar.gz"
 $STD apt-get -y autoremove
 $STD apt-get -y autoclean
 msg_ok "Cleaned"
--- a/install/kimai-install.sh
+++ b/install/kimai-install.sh
@ -23,7 +23,7 @@ $STD apt-get install -y \
  lsb-release
 msg_ok "Installed Dependencies"

-install_mariadb
+install_mysql

 msg_info "Adding PHP8.4 Repository"
 $STD curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb
@ -44,10 +44,10 @@ msg_info "Setting up database"
 DB_NAME=kimai_db
 DB_USER=kimai
 DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
-MYSQL_VERSION=$(mysql --version | grep -oP 'Distrib \K[0-9]+\.[0-9]+\.[0-9]+')
-mariadb -u root -e "CREATE DATABASE $DB_NAME;"
-mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED WITH mysql_native_password AS PASSWORD('$DB_PASS');"
-mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
+MYSQL_VERSION=$(mysql --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
+$STD mysql -u root -e "CREATE DATABASE $DB_NAME;"
+$STD mysql -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
+$STD mysql -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
 {
  echo "Kimai-Credentials"
  echo "Kimai Database User: $DB_USER"
--- a/install/lyrionmusicserver-install.sh
+++ b/install/lyrionmusicserver-install.sh
@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: Omar Minaya
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://lyrion.org/getting-started/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Setup Lyrion Music Server"
+DEB_URL=$(curl -fsSL 'https://lyrion.org/getting-started/' | grep -oP '<a\s[^>]*href="\K[^"]*amd64\.deb(?="[^>]*>)' | head -n 1)
+RELEASE=$(echo "$DEB_URL" | grep -oP 'lyrionmusicserver_\K[0-9.]+(?=_amd64\.deb)')
+DEB_FILE="/tmp/lyrionmusicserver_${RELEASE}_amd64.deb"
+curl -fsSL -o "$DEB_FILE" "$DEB_URL"
+$STD apt install "$DEB_FILE" -y
+echo "${RELEASE}" >"/opt/lyrion_version.txt"
+msg_ok "Setup Lyrion Music Server v${RELEASE}"
+
+motd_ssh
+customize
+
+msg_info "Cleaning up"
+$STD rm -f "$DEB_FILE"
+$STD apt-get -y autoremove
+$STD apt-get -y autoclean
+msg_ok "Cleaned"
--- a/install/mariadb-install.sh
+++ b/install/mariadb-install.sh
@ -33,9 +33,9 @@ if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
    php-json \
    php-curl

-  curl -fsSL "https://files.phpmyadmin.net/phpMyAdmin/5.2.1/phpMyAdmin-5.2.1-all-languages.tar.gz" -o "phpMyAdmin-5.2.1-all-languages.tar.gz"
+  curl -fsSL "https://files.phpmyadmin.net/phpMyAdmin/5.2.2/phpMyAdmin-5.2.2-all-languages.tar.gz" -o "phpMyAdmin-5.2.2-all-languages.tar.gz"
  mkdir -p /var/www/html/phpMyAdmin
-  tar xf phpMyAdmin-5.2.1-all-languages.tar.gz --strip-components=1 -C /var/www/html/phpMyAdmin
+  tar xf phpMyAdmin-5.2.2-all-languages.tar.gz --strip-components=1 -C /var/www/html/phpMyAdmin
  cp /var/www/html/phpMyAdmin/config.sample.inc.php /var/www/html/phpMyAdmin/config.inc.php
  SECRET=$(openssl rand -base64 24)
  sed -i "s#\$cfg\['blowfish_secret'\] = '';#\$cfg['blowfish_secret'] = '${SECRET}';#" /var/www/html/phpMyAdmin/config.inc.php
--- a/install/monica-install.sh
+++ b/install/monica-install.sh
@ -29,7 +29,7 @@ DB_NAME=monica
 DB_USER=monica
 DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
 $STD mariadb -u root -e "CREATE DATABASE $DB_NAME;"
-$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED WITH mysql_native_password AS PASSWORD('$DB_PASS');"
+$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
 $STD mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
 {
  echo "monica-Credentials"
--- a/install/mysql-install.sh
+++ b/install/mysql-install.sh
@ -62,9 +62,9 @@ if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
    php-json \
    php-curl

-  curl -fsSL "https://files.phpmyadmin.net/phpMyAdmin/5.2.1/phpMyAdmin-5.2.1-all-languages.tar.gz" -o "phpMyAdmin-5.2.1-all-languages.tar.gz"
+  curl -fsSL "https://files.phpmyadmin.net/phpMyAdmin/5.2.2/phpMyAdmin-5.2.2-all-languages.tar.gz" -o "phpMyAdmin-5.2.2-all-languages.tar.gz"
  mkdir -p /var/www/html/phpMyAdmin
-  tar xf phpMyAdmin-5.2.1-all-languages.tar.gz --strip-components=1 -C /var/www/html/phpMyAdmin
+  tar xf phpMyAdmin-5.2.2-all-languages.tar.gz --strip-components=1 -C /var/www/html/phpMyAdmin
  cp /var/www/html/phpMyAdmin/config.sample.inc.php /var/www/html/phpMyAdmin/config.inc.php
  SECRET=$(openssl rand -base64 24)
  sed -i "s#\$cfg\['blowfish_secret'\] = '';#\$cfg['blowfish_secret'] = '${SECRET}';#" /var/www/html/phpMyAdmin/config.inc.php
--- a/install/omada-install.sh
+++ b/install/omada-install.sh
@ -36,7 +36,7 @@ msg_ok "Installed Azul Zulu Java"

 msg_info "Installing libssl (if needed)"
 if ! dpkg -l | grep -q 'libssl1.1'; then
-  curl -fsSL "https://security.debian.org/debian-security/pool/updates/main/o/openssl/libssl1.1_1.1.1w-0+deb11u2_amd64.deb" -o "/tmp/libssl.deb"
+  curl -fsSL "https://security.debian.org/debian-security/pool/updates/main/o/openssl/libssl1.1_1.1.1w-0+deb11u3_amd64.deb" -o "/tmp/libssl.deb"
  $STD dpkg -i /tmp/libssl.deb
  rm -f /tmp/libssl.deb
  msg_ok "Installed libssl1.1"
--- a/install/paymenter-install.sh
+++ b/install/paymenter-install.sh
@ -58,9 +58,9 @@ DB_NAME=paymenter
 DB_USER=paymenter
 DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
 mysql_tzinfo_to_sql /usr/share/zoneinfo | mysql mysql
-mariadb -u root -e "CREATE DATABASE $DB_NAME;"
-mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
-mariadb -u root -e "GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'localhost' WITH GRANT OPTION;"
+$STD mariadb -u root -e "CREATE DATABASE $DB_NAME;"
+$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
+$STD mariadb -u root -e "GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'localhost' WITH GRANT OPTION;"
 {
  echo "Paymenter Database Credentials"
  echo "Database: $DB_NAME"
--- a/install/pelican-panel-install.sh
+++ b/install/pelican-panel-install.sh
@ -42,7 +42,7 @@ DB_NAME=panel
 DB_USER=pelican
 DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
 $STD mariadb -u root -e "CREATE DATABASE $DB_NAME;"
-$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED WITH mysql_native_password AS PASSWORD('$DB_PASS');"
+$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
 $STD mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
 {
  echo "Pelican Panel-Credentials"
--- a/install/phpipam-install.sh
+++ b/install/phpipam-install.sh
@ -28,7 +28,7 @@ DB_NAME=phpipam
 DB_USER=phpipam
 DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
 $STD mariadb -u root -e "CREATE DATABASE $DB_NAME;"
-$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED WITH mysql_native_password AS PASSWORD('$DB_PASS');"
+$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
 $STD mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
 {
  echo "phpIPAM-Credentials"
@ -43,7 +43,7 @@ RELEASE=$(curl -fsSL https://api.github.com/repos/phpipam/phpipam/releases/lates
 cd /opt
 curl -fsSL "https://github.com/phpipam/phpipam/releases/download/v${RELEASE}/phpipam-v${RELEASE}.zip" -o "phpipam-v${RELEASE}.zip"
 $STD unzip "phpipam-v${RELEASE}.zip"
-mariadb -u root "${DB_NAME}" </opt/phpipam/db/SCHEMA.sql
+$STD mariadb -u root "${DB_NAME}" </opt/phpipam/db/SCHEMA.sql
 cp /opt/phpipam/config.dist.php /opt/phpipam/config.php
 sed -i -e "s/\(\$disable_installer = \).*/\1true;/" \
  -e "s/\(\$db\['user'\] = \).*/\1'$DB_USER';/" \
--- a/install/plant-it-install.sh
+++ b/install/plant-it-install.sh
@ -38,7 +38,7 @@ DB_NAME=plantit
 DB_USER=plantit_usr
 DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
 $STD mariadb -u root -e "CREATE DATABASE $DB_NAME;"
-$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED WITH mysql_native_password AS PASSWORD('$DB_PASS');"
+$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
 $STD mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
 {
  echo "Plant-it Credentials"
--- a/install/projectsend-install.sh
+++ b/install/projectsend-install.sh
@ -27,7 +27,7 @@ DB_NAME=projectsend
 DB_USER=projectsend
 DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
 $STD mariadb -u root -e "CREATE DATABASE $DB_NAME;"
-$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED WITH mysql_native_password AS PASSWORD('$DB_PASS');"
+$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
 $STD mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
 {
  echo "projectsend-Credentials"
--- a/install/pterodactyl-panel-install.sh
+++ b/install/pterodactyl-panel-install.sh
@ -43,7 +43,7 @@ DB_NAME=panel
 DB_USER=pterodactyl
 DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
 $STD mariadb -u root -e "CREATE DATABASE $DB_NAME;"
-$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED WITH mysql_native_password AS PASSWORD('$DB_PASS');"
+$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
 $STD mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
 {
  echo "pterodactyl Panel-Credentials"
--- a/install/pulse-install.sh
+++ b/install/pulse-install.sh
@ -16,8 +16,9 @@ update_os

 msg_info "Installing Dependencies"
 $STD apt-get install -y \
-  diffutils
-msg_ok "Installed Core Dependencies"
+  diffutils \
+  policykit-1
+msg_ok "Installed Dependencies"

 msg_info "Creating dedicated user pulse..."
 if useradd -r -m -d /opt/pulse-home -s /bin/bash pulse; then
@ -32,36 +33,23 @@ NODE_VERSION="20" install_node_and_modules
 msg_info "Setup Pulse"
 RELEASE=$(curl -fsSL https://api.github.com/repos/rcourtman/Pulse/releases/latest | grep "tag_name" | awk '{print substr($2, 3, length($2)-4) }')
 temp_file=$(mktemp)
-mkdir -p /opt/pulse-proxmox
+mkdir -p /opt/pulse
 curl -fsSL "https://github.com/rcourtman/Pulse/releases/download/v${RELEASE}/pulse-v${RELEASE}.tar.gz" -o "$temp_file"
-tar zxf "$temp_file" --strip-components=1 -C /opt/pulse-proxmox
+tar zxf "$temp_file" --strip-components=1 -C /opt/pulse
+touch /opt/pulse/.env
+chown pulse:pulse /opt/pulse/.env
 echo "${RELEASE}" >/opt/${APPLICATION}_version.txt
 msg_ok "Installed Pulse"

-read -rp "${TAB3}Proxmox Host (z. B. https://proxmox.example.com:8006): " PROXMOX_HOST
-read -rp "${TAB3}Proxmox Token ID (z. B. user@pam!mytoken): " PROXMOX_TOKEN_ID
-read -rp "${TAB3}Proxmox Token Secret: " PROXMOX_TOKEN_SECRET
-read -rp "${TAB3}Port (default: 7655): " PORT
-PORT="${PORT:-7655}"

-msg_info "Creating .env file"
-cat <<EOF >/opt/pulse-proxmox/.env
-PROXMOX_HOST=${PROXMOX_HOST}
-PROXMOX_TOKEN_ID=${PROXMOX_TOKEN_ID}
-PROXMOX_TOKEN_SECRET=${PROXMOX_TOKEN_SECRET}
-PORT=${PORT}
-EOF
-msg_ok "Created .env file"
-
-msg_info "Setting permissions for /opt/pulse-proxmox..."
-chown -R pulse:pulse "/opt/pulse-proxmox"
-find "/opt/pulse-proxmox" -type d -exec chmod 755 {} \;
-find "/opt/pulse-proxmox" -type f -exec chmod 644 {} \;
-chmod 600 /opt/pulse-proxmox/.env
+msg_info "Setting permissions for /opt/pulse..."
+chown -R pulse:pulse "/opt/pulse"
+find "/opt/pulse" -type d -exec chmod 755 {} \;
+find "/opt/pulse" -type f -exec chmod 644 {} \;
 msg_ok "Set permissions."

 msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/pulse-monitor.service
+cat <<EOF >/etc/systemd/system/pulse.service
 [Unit]
 Description=Pulse Monitoring Application
 After=network.target
@ -70,8 +58,8 @@ After=network.target
 Type=simple
 User=pulse
 Group=pulse
-WorkingDirectory=/opt/pulse-proxmox
-EnvironmentFile=/opt/pulse-proxmox/.env
+WorkingDirectory=/opt/pulse
+EnvironmentFile=/opt/pulse/.env
 ExecStart=/usr/bin/npm run start
 Restart=on-failure
 RestartSec=5
@ -81,7 +69,7 @@ StandardError=journal
 [Install]
 WantedBy=multi-user.target
 EOF
-systemctl enable -q --now pulse-monitor
+systemctl enable -q --now pulse
 msg_ok "Created Service"

 motd_ssh
--- a/install/rclone-install.sh
+++ b/install/rclone-install.sh
@ -14,7 +14,7 @@ network_check
 update_os

 msg_info "Installing Dependencies"
-$STD apt-get install -y apache2-utils
+$STD apt-get install -y apache2-utils fuse3
 msg_ok "Installed Dependencies"

 msg_info "Installing rclone"
--- a/install/seelf-install.sh
+++ b/install/seelf-install.sh
@ -1,7 +1,7 @@
 #!/usr/bin/env bash

 # Copyright (c) 2021-2025 community-scripts ORG
-# Author: tremor021
+# Author: Slaviša Arežina (tremor021)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/YuukanOO/seelf

@ -21,21 +21,17 @@ msg_ok "Installed Dependencies"

 install_go
 NODE_VERSION="22" install_node_and_modules
+fetch_and_deploy_gh_release "YuukanOO/seelf"

 msg_info "Setting up seelf. Patience"
-RELEASE=$(curl -fsSL https://api.github.com/repos/YuukanOO/seelf/releases/latest | grep "tag_name" | awk '{print substr($2, 3, length($2)-4) }')
-curl -fsSL "https://github.com/YuukanOO/seelf/archive/refs/tags/v${RELEASE}.tar.gz" -o "v${RELEASE}.tar.gz"
-tar -xzf v"${RELEASE}".tar.gz
-mv seelf-"${RELEASE}"/ /opt/seelf
 cd /opt/seelf
 $STD make build
 PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+mkdir -p /opt/seelf/data
 {
  echo "ADMIN_EMAIL=admin@example.com"
  echo "ADMIN_PASSWORD=$PASS"
 } | tee .env ~/seelf.creds >/dev/null
-
-echo "${RELEASE}" >/opt/seelf_version.txt
 SEELF_ADMIN_EMAIL=admin@example.com SEELF_ADMIN_PASSWORD=$PASS ./seelf serve &>/dev/null &
 sleep 5
 kill $!
@ -51,8 +47,10 @@ After=network.target
 Type=simple
 User=root
 Group=root
+EnvironmentFile=/opt/seelf/.env
+Environment=DATA_PATH=/opt/seelf/data
 WorkingDirectory=/opt/seelf
-ExecStart=/opt/seelf/./seelf serve
+ExecStart=/opt/seelf/./seelf -c data/conf.yml serve
 Restart=always

 [Install]
@ -64,13 +62,7 @@ msg_ok "Created Service"
 motd_ssh
 customize

-# Cleanup
 msg_info "Cleaning up"
-rm -f ~/v"${RELEASE}".tar.gz
-rm -f "$temp_file"
 $STD apt-get -y autoremove
 $STD apt-get -y autoclean
 msg_ok "Cleaned"
-
-motd_ssh
-customize
--- a/install/shinobi-install.sh
+++ b/install/shinobi-install.sh
@ -43,7 +43,7 @@ sqlpass="root"
 echo "mariadb-server mariadb-server/root_password password $sqlpass" | debconf-set-selections
 echo "mariadb-server mariadb-server/root_password_again password $sqlpass" | debconf-set-selections
 service mysql start
-mariadb -u "$sqluser" -p"$sqlpass" -e "source sql/user.sql" || true
+$STD mariadb -u "$sqluser" -p"$sqlpass" -e "source sql/user.sql" || true
 msg_ok "Installed Database"

 msg_info "Installing Shinobi"
--- a/install/silverbullet-install.sh
+++ b/install/silverbullet-install.sh
@ -16,7 +16,8 @@ update_os
 msg_info "Installing Silverbullet"
 RELEASE=$(curl -fsSL https://api.github.com/repos/silverbulletmd/silverbullet/releases/latest | grep "tag_name" | awk '{print substr($2, 2, length($2)-3) }')
 mkdir -p /opt/silverbullet/bin /opt/silverbullet/space
-curl -fsSL "https://github.com/silverbulletmd/silverbullet/releases/download/${RELEASE}/silverbullet-server-linux-x86_64.zip" -o "/opt/silverbullet/bin/silverbullet-server-linux-x86_64.zip"
+cd /opt
+curl -fsSL "https://github.com/silverbulletmd/silverbullet/releases/download/${RELEASE}/silverbullet-server-linux-x86_64.zip" -o "silverbullet-server-linux-x86_64.zip"
 $STD unzip -o -d /opt/silverbullet/bin/ silverbullet-server-linux-x86_64.zip
 chmod +x /opt/silverbullet/bin/silverbullet
 echo "${RELEASE}" >/opt/${APPLICATION}_version.txt
@ -46,7 +47,7 @@ motd_ssh
 customize

 msg_info "Cleaning up"
-rm -rf silverbullet-server-linux-x86_64.zip
+rm -rf /opt/silverbullet-server-linux-x86_64.zip
 $STD apt-get -y autoremove
 $STD apt-get -y autoclean
 msg_ok "Cleaned"
--- a/install/snipeit-install.sh
+++ b/install/snipeit-install.sh
@ -27,9 +27,9 @@ msg_info "Setting up database"
 DB_NAME=snipeit_db
 DB_USER=snipeit
 DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
-mariadb -u root -e "CREATE DATABASE $DB_NAME;"
-mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED WITH mysql_native_password AS PASSWORD('$DB_PASS');"
-mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
+$STD mariadb -u root -e "CREATE DATABASE $DB_NAME;"
+$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
+$STD mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
 {
  echo "SnipeIT-Credentials"
  echo "SnipeIT Database User: $DB_USER"
--- a/install/tianji-install.sh
+++ b/install/tianji-install.sh
@ -22,7 +22,8 @@ $STD apt-get install -y \
  build-essential \
  git \
  make \
-  ca-certificates
+  ca-certificates \
+  jq
 msg_ok "Installed Dependencies"

 NODE_VERSION="22" NODE_MODULE="pnpm@$(curl -s https://raw.githubusercontent.com/msgbyte/tianji/master/package.json | jq -r '.packageManager | split("@")[1]')" install_node_and_modules
--- a/install/wastebin-install.sh
+++ b/install/wastebin-install.sh
@ -16,8 +16,8 @@ update_os
 msg_info "Installing Wastebin"
 temp_file=$(mktemp)
 RELEASE=$(curl -fsSL https://api.github.com/repos/matze/wastebin/releases/latest | grep "tag_name" | awk '{print substr($2, 2, length($2)-3) }')
-curl -fsSL "https://github.com/matze/wastebin/releases/download/${RELEASE}/wastebin_${RELEASE}_x86_64-unknown-linux-musl.zip" -o "$temp_file"
-$STD unzip $temp_file
+curl -fsSL "https://github.com/matze/wastebin/releases/download/${RELEASE}/wastebin_${RELEASE}_x86_64-unknown-linux-musl.tar.zst" -o "$temp_file"
+tar -xf $temp_file
 mkdir -p /opt/wastebin
 mv wastebin /opt/wastebin/
 chmod +x /opt/wastebin/wastebin
--- a/install/wavelog-install.sh
+++ b/install/wavelog-install.sh
@ -26,7 +26,7 @@ DB_NAME=wavelog
 DB_USER=waveloguser
 DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
 $STD mariadb -u root -e "CREATE DATABASE $DB_NAME;"
-$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED WITH mysql_native_password AS PASSWORD('$DB_PASS');"
+$STD mariadb -u root -e "CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';"
 $STD mariadb -u root -e "GRANT ALL ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;"
 {
  echo "Wavelog-Credentials"
--- a/install/zipline-install.sh
+++ b/install/zipline-install.sh
@ -14,11 +14,6 @@ setting_up_container
 network_check
 update_os

-msg_info "Installing Dependencies"
-$STD apt-get install -y \
-  postgresql
-msg_ok "Installed Dependencies"
-
 NODE_VERSION="22" NODE_MODULE="pnpm@latest" install_node_and_modules
 PG_VERSION="16" install_postgresql

@ -83,6 +78,7 @@ msg_ok "Created Service"
 motd_ssh
 customize
 msg_info "Cleaning up"
+rm -f /opt/v${RELEASE}.zip
 $STD apt-get -y autoremove
 $STD apt-get -y autoclean
 msg_ok "Cleaned"
--- a/install/zitadel-install.sh
+++ b/install/zitadel-install.sh
@ -17,8 +17,9 @@ msg_info "Installing Dependencies (Patience)"
 $STD apt-get install -y ca-certificates
 msg_ok "Installed Dependecies"

+PG_VERSION="17" PG_MODULES="common" install_postgresql
+
 msg_info "Installing Postgresql"
-$STD apt-get install -y postgresql postgresql-common
 DB_NAME="zitadel"
 DB_USER="zitadel"
 DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)
--- a/install/zot-registry-install.sh
+++ b/install/zot-registry-install.sh
@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://zotregistry.dev/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt-get install -y apache2-utils
+msg_ok "Installed Dependencies"
+
+msg_info "Installing Zot Registry"
+RELEASE=$(curl -fsSL https://api.github.com/repos/project-zot/zot/releases/latest | grep "tag_name" | awk '{print substr($2, 2, length($2)-3) }')
+curl -fsSL "https://github.com/project-zot/zot/releases/download/${RELEASE}/zot-linux-amd64" -o /usr/bin/zot
+chmod +x /usr/bin/zot
+chown root:root /usr/bin/zot
+mkdir -p /etc/zot
+curl -fsSL https://raw.githubusercontent.com/project-zot/zot/refs/heads/main/examples/config-ui.json -o /etc/zot/config.json
+ZOTPASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+$STD htpasswd -b -B -c /etc/zot/htpasswd admin "$ZOTPASSWORD"
+{
+  echo "Zot-Credentials"
+  echo "Zot User: admin"
+  echo "Zot Password: $ZOTPASSWORD"
+} >>~/zot.creds
+echo "${RELEASE}" >~/.${APP}
+msg_ok "Installed Zot Registry"
+
+msg_info "Setup Service"
+cat <<EOF >/etc/systemd/system/zot.service
+[Unit]
+Description=OCI Distribution Registry
+Documentation=https://zotregistry.dev/
+After=network.target auditd.service local-fs.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/zot serve /etc/zot/config.json
+Restart=on-failure
+User=root
+LimitNOFILE=500000
+MemoryHigh=2G
+MemoryMax=4G
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now zot
+msg_ok "Setup Service"
+
+motd_ssh
+customize
+
+msg_info "Cleaning up"
+$STD apt-get -y autoremove
+$STD apt-get -y autoclean
+msg_ok "Cleaned"
--- a/misc/build.func
+++ b/misc/build.func
@ -379,13 +379,13 @@ write_config() {

 CT_TYPE="${CT_TYPE}"
 DISK_SIZE="${DISK_SIZE}"
-CORE_COUNT="${DISK_SIZE}"
+CORE_COUNT="${CORE_COUNT}"
 RAM_SIZE="${RAM_SIZE}"
 HN="${HN}"
 BRG="${BRG}"
 APT_CACHER_IP="${APT_CACHER_IP:-none}"
 DISABLEIP6="${DISABLEIP6}"
-PW="${PW:-none}"
+PW='${PW:-none}'
 SSH="${SSH}"
 SSH_AUTHORIZED_KEY="${SSH_AUTHORIZED_KEY}"
 VERBOSE="${VERBOSE}"
@ -397,6 +397,7 @@ SD="${SD:-none}"
 MAC="${MAC:-none}"
 NS="${NS:-none}"
 NET="${NET}"
+FUSE="${ENABLE_FUSE}"

 EOF
      echo -e "${INFO}${BOLD}${GN}Writing configuration to ${FILEPATH}${CL}"
@ -410,13 +411,13 @@ EOF

 CT_TYPE="${CT_TYPE}"
 DISK_SIZE="${DISK_SIZE}"
-CORE_COUNT="${DISK_SIZE}"
+CORE_COUNT="${CORE_COUNT}"
 RAM_SIZE="${RAM_SIZE}"
 HN="${HN}"
 BRG="${BRG}"
 APT_CACHER_IP="${APT_CACHER_IP:-none}"
 DISABLEIP6="${DISABLEIP6}"
-PW="${PW:-none}"
+PW='${PW:-none}'
 SSH="${SSH}"
 SSH_AUTHORIZED_KEY="${SSH_AUTHORIZED_KEY}"
 VERBOSE="${VERBOSE}"
@ -428,6 +429,7 @@ SD="${SD:-none}"
 MAC="${MAC:-none}"
 NS="${NS:-none}"
 NET="${NET}"
+FUSE="${ENABLE_FUSE}"

 EOF
        echo -e "${INFO}${BOLD}${GN}Writing configuration to ${FILEPATH}${CL}"
@ -795,7 +797,7 @@ advanced_settings() {
    echo -e "${ROOTSSH}${BOLD}${DGN}Root SSH Access: ${BGN}$SSH${CL}"
  fi

-  if (whiptail --backtitle "[dev] Proxmox VE Helper Scripts" --defaultno --title "FUSE Support" --yesno "Enable FUSE support?\nRequired for tools like rclone, mergerfs, AppImage, etc." 10 58); then
+  if (whiptail --backtitle "Proxmox VE Helper Scripts" --defaultno --title "FUSE Support" --yesno "Enable FUSE support?\nRequired for tools like rclone, mergerfs, AppImage, etc." 10 58); then
    ENABLE_FUSE="yes"
  else
    ENABLE_FUSE="no"
@ -1139,7 +1141,7 @@ EOF
  fi

  if [ "$CT_TYPE" == "0" ]; then
-    if [[ "$APP" == "Channels" || "$APP" == "Emby" || "$APP" == "ErsatzTV" || "$APP" == "Frigate" || "$APP" == "Jellyfin" || "$APP" == "Plex" || "$APP" == "Scrypted" || "$APP" == "Tdarr" || "$APP" == "Unmanic" || "$APP" == "Ollama" || "$APP" == "FileFlows" ]]; then
+    if [[ "$APP" == "Channels" || "$APP" == "Emby" || "$APP" == "ErsatzTV" || "$APP" == "Frigate" || "$APP" == "Jellyfin" || "$APP" == "Plex" || "$APP" == "immich" || "$APP" == "Tdarr" || "$APP" == "Open WebUI" || "$APP" == "Unmanic" || "$APP" == "Ollama" || "$APP" == "FileFlows" ]]; then
      cat <<EOF >>"$LXC_CONFIG"
 # VAAPI hardware transcoding
 lxc.cgroup2.devices.allow: c 226:0 rwm
@ -1151,7 +1153,7 @@ lxc.mount.entry: /dev/dri/renderD128 dev/dri/renderD128 none bind,optional,creat
 EOF
    fi
  else
-    if [[ "$APP" == "Channels" || "$APP" == "Emby" || "$APP" == "ErsatzTV" || "$APP" == "Frigate" || "$APP" == "Jellyfin" || "$APP" == "Plex" || "$APP" == "Scrypted" || "$APP" == "Tdarr" || "$APP" == "Unmanic" || "$APP" == "Ollama" || "$APP" == "FileFlows" ]]; then
+    if [[ "$APP" == "Channels" || "$APP" == "Emby" || "$APP" == "ErsatzTV" || "$APP" == "Frigate" || "$APP" == "Jellyfin" || "$APP" == "Plex" || "$APP" == "immich" || "$APP" == "Tdarr" || "$APP" == "Open WebUI" || "$APP" == "Unmanic" || "$APP" == "Ollama" || "$APP" == "FileFlows" ]]; then
      if [[ -e "/dev/dri/renderD128" ]]; then
        if [[ -e "/dev/dri/card0" ]]; then
          cat <<EOF >>"$LXC_CONFIG"
--- a/misc/config-file.func
+++ b/misc/config-file.func
@ -618,6 +618,24 @@ config_file() {
    fi
  fi

+  if [[ -n "$ENABLE_FUSE" ]]; then
+    if [[ "$ENABLE_FUSE" == "yes" ]]; then
+      echo -e "${FUSE}${BOLD}${DGN}Enable FUSE: ${BGN}Yes${CL}"
+    elif [[ "$ENABLE_FUSE" == "no" ]]; then
+      echo -e "${FUSE}${BOLD}${DGN}Enable FUSE: ${BGN}No${CL}"
+    else
+      msg_error "Enable FUSE needs to be 'yes' or 'no', was ${ENABLE_FUSE}"
+      exit
+    fi
+  else
+    if (whiptail --backtitle "Proxmox VE Helper Scripts" --defaultno --title "FUSE" --yesno "Enable FUSE?" 10 58); then
+      ENABLE_FUSE="yes"
+    else
+      ENABLE_FUSE="no"
+    fi
+    echo -e "${FUSE}${BOLD}${DGN}Enable FUSE: ${BGN}$ENABLE_FUSE${CL}"
+  fi
+
  if [[ -n "${VERBOSE-}" ]]; then
    if [[ "$VERBOSE" == "yes" ]]; then
      echo -e "${SEARCH}${BOLD}${DGN}Verbose Mode: ${BGN}$VERBOSE${CL}"
--- a/misc/core.func
+++ b/misc/core.func
@ -0,0 +1,544 @@
+# Copyright (c) 2021-2025 community-scripts ORG
+# License: MIT | https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/LICENSE
+
+# if ! declare -f wait_for >/dev/null; then
+#   echo "[DEBUG] Undefined function 'wait_for' used from: ${BASH_SOURCE[*]}" >&2
+#   wait_for() {
+#     echo "[DEBUG] Fallback: wait_for called with: $*" >&2
+#     true
+#   }
+# fi
+
+trap 'on_error $? $LINENO' ERR
+trap 'on_exit' EXIT
+trap 'on_interrupt' INT
+trap 'on_terminate' TERM
+
+if ! declare -f wait_for >/dev/null; then
+  wait_for() {
+    true
+  }
+fi
+
+declare -A MSG_INFO_SHOWN=()
+SPINNER_PID=""
+SPINNER_ACTIVE=0
+SPINNER_MSG=""
+
+# ------------------------------------------------------------------------------
+# Loads core utility groups once (colors, formatting, icons, defaults).
+# ------------------------------------------------------------------------------
+
+[[ -n "${_CORE_FUNC_LOADED:-}" ]] && return
+_CORE_FUNC_LOADED=1
+
+load_functions() {
+  [[ -n "${__FUNCTIONS_LOADED:-}" ]] && return
+  __FUNCTIONS_LOADED=1
+  color
+  formatting
+  icons
+  default_vars
+  set_std_mode
+  # add more
+}
+
+on_error() {
+  local exit_code="$1"
+  local lineno="$2"
+  msg_error "Script failed at line $lineno with exit code $exit_code"
+  # Optionally log to your API or file here
+  exit "$exit_code"
+}
+
+on_exit() {
+  # Always called on script exit, success or failure
+  cleanup_temp_files || true
+  msg_info "Script exited"
+}
+
+on_interrupt() {
+  msg_error "Interrupted by user (CTRL+C)"
+  exit 130
+}
+
+on_terminate() {
+  msg_error "Terminated by signal (TERM)"
+  exit 143
+}
+
+setup_trap_abort_handling() {
+  trap '__handle_signal_abort SIGINT' SIGINT
+  trap '__handle_signal_abort SIGTERM' SIGTERM
+  trap '__handle_unexpected_error $?' ERR
+}
+
+__handle_signal_abort() {
+  local signal="$1"
+  echo
+  [ -n "${SPINNER_PID:-}" ] && kill "$SPINNER_PID" 2>/dev/null && wait "$SPINNER_PID" 2>/dev/null
+
+  case "$signal" in
+  SIGINT)
+    msg_error "Script aborted by user (CTRL+C)"
+    exit 130
+    ;;
+  SIGTERM)
+    msg_error "Script terminated (SIGTERM)"
+    exit 143
+    ;;
+  *)
+    msg_error "Script interrupted (unknown signal: $signal)"
+    exit 1
+    ;;
+  esac
+}
+
+__handle_unexpected_error() {
+  local exit_code="$1"
+  echo
+  [ -n "${SPINNER_PID:-}" ] && kill "$SPINNER_PID" 2>/dev/null && wait "$SPINNER_PID" 2>/dev/null
+
+  case "$exit_code" in
+  1)
+    msg_error "Generic error occurred (exit code 1)"
+    ;;
+  2)
+    msg_error "Misuse of shell builtins (exit code 2)"
+    ;;
+  126)
+    msg_error "Command invoked cannot execute (exit code 126)"
+    ;;
+  127)
+    msg_error "Command not found (exit code 127)"
+    ;;
+  128)
+    msg_error "Invalid exit argument (exit code 128)"
+    ;;
+  130)
+    msg_error "Script aborted by user (CTRL+C)"
+    ;;
+  143)
+    msg_error "Script terminated by SIGTERM"
+    ;;
+  *)
+    msg_error "Unexpected error occurred (exit code $exit_code)"
+    ;;
+  esac
+  exit "$exit_code"
+}
+
+# ------------------------------------------------------------------------------
+# Sets ANSI color codes used for styled terminal output.
+# ------------------------------------------------------------------------------
+color() {
+  YW=$(echo "\033[33m")
+  YWB=$'\e[93m'
+  BL=$(echo "\033[36m")
+  RD=$(echo "\033[01;31m")
+  BGN=$(echo "\033[4;92m")
+  GN=$(echo "\033[1;92m")
+  DGN=$(echo "\033[32m")
+  CL=$(echo "\033[m")
+}
+
+# ------------------------------------------------------------------------------
+# Defines formatting helpers like tab, bold, and line reset sequences.
+# ------------------------------------------------------------------------------
+formatting() {
+  BFR="\\r\\033[K"
+  BOLD=$(echo "\033[1m")
+  HOLD=" "
+  TAB="  "
+  TAB3="      "
+}
+
+# ------------------------------------------------------------------------------
+# Sets symbolic icons used throughout user feedback and prompts.
+# ------------------------------------------------------------------------------
+icons() {
+  CM="${TAB}✔️${TAB}"
+  CROSS="${TAB}✖️${TAB}"
+  DNSOK="✔️ "
+  DNSFAIL="${TAB}✖️${TAB}"
+  INFO="${TAB}💡${TAB}${CL}"
+  OS="${TAB}🖥️${TAB}${CL}"
+  OSVERSION="${TAB}🌟${TAB}${CL}"
+  CONTAINERTYPE="${TAB}📦${TAB}${CL}"
+  DISKSIZE="${TAB}💾${TAB}${CL}"
+  CPUCORE="${TAB}🧠${TAB}${CL}"
+  RAMSIZE="${TAB}🛠️${TAB}${CL}"
+  SEARCH="${TAB}🔍${TAB}${CL}"
+  VERBOSE_CROPPED="🔍${TAB}"
+  VERIFYPW="${TAB}🔐${TAB}${CL}"
+  CONTAINERID="${TAB}🆔${TAB}${CL}"
+  HOSTNAME="${TAB}🏠${TAB}${CL}"
+  BRIDGE="${TAB}🌉${TAB}${CL}"
+  NETWORK="${TAB}📡${TAB}${CL}"
+  GATEWAY="${TAB}🌐${TAB}${CL}"
+  DISABLEIPV6="${TAB}🚫${TAB}${CL}"
+  DEFAULT="${TAB}⚙️${TAB}${CL}"
+  MACADDRESS="${TAB}🔗${TAB}${CL}"
+  VLANTAG="${TAB}🏷️${TAB}${CL}"
+  ROOTSSH="${TAB}🔑${TAB}${CL}"
+  CREATING="${TAB}🚀${TAB}${CL}"
+  ADVANCED="${TAB}🧩${TAB}${CL}"
+  FUSE="${TAB}🗂️${TAB}${CL}"
+}
+
+# ------------------------------------------------------------------------------
+# Sets default retry and wait variables used for system actions.
+# ------------------------------------------------------------------------------
+default_vars() {
+  RETRY_NUM=10
+  RETRY_EVERY=3
+  i=$RETRY_NUM
+  #[[ "${VAR_OS:-}" == "unknown" ]]
+}
+
+# ------------------------------------------------------------------------------
+# Sets default verbose mode for script and os execution.
+# ------------------------------------------------------------------------------
+set_std_mode() {
+  if [ "${VERBOSE:-no}" = "yes" ]; then
+    STD=""
+  else
+    STD="silent"
+  fi
+}
+
+# Silent execution function
+silent() {
+  "$@" >/dev/null 2>&1
+}
+
+# Function to download & save header files
+get_header() {
+  local app_name=$(echo "${APP,,}" | tr -d ' ')
+  local app_type=${APP_TYPE:-ct} # Default 'ct'
+  local header_url="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/${app_type}/headers/${app_name}"
+  local local_header_path="/usr/local/community-scripts/headers/${app_type}/${app_name}"
+
+  mkdir -p "$(dirname "$local_header_path")"
+
+  if [ ! -s "$local_header_path" ]; then
+    if ! curl -fsSL "$header_url" -o "$local_header_path"; then
+      return 1
+    fi
+  fi
+
+  cat "$local_header_path" 2>/dev/null || true
+}
+
+header_info() {
+  local app_name=$(echo "${APP,,}" | tr -d ' ')
+  local header_content
+
+  header_content=$(get_header "$app_name") || header_content=""
+
+  clear
+  local term_width
+  term_width=$(tput cols 2>/dev/null || echo 120)
+
+  if [ -n "$header_content" ]; then
+    echo "$header_content"
+  fi
+}
+
+# ------------------------------------------------------------------------------
+# Performs a curl request with retry logic and inline feedback.
+# ------------------------------------------------------------------------------
+
+run_curl() {
+  if [ "$VERBOSE" = "no" ]; then
+    $STD curl "$@"
+  else
+    curl "$@"
+  fi
+}
+
+curl_handler() {
+  set +e
+  trap 'set -e' RETURN
+  local args=()
+  local url=""
+  local max_retries=3
+  local delay=2
+  local attempt=1
+  local exit_code
+  local has_output_file=false
+  local result=""
+
+  # Parse arguments
+  for arg in "$@"; do
+    if [[ "$arg" != -* && -z "$url" ]]; then
+      url="$arg"
+    fi
+    [[ "$arg" == "-o" || "$arg" == --output ]] && has_output_file=true
+    args+=("$arg")
+  done
+
+  if [[ -z "$url" ]]; then
+    msg_error "No valid URL or option entered for curl_handler"
+    return 1
+  fi
+
+  $STD msg_info "Fetching: $url"
+
+  while [[ $attempt -le $max_retries ]]; do
+    if $has_output_file; then
+      $STD run_curl "${args[@]}"
+      exit_code=$?
+    else
+      result=$(run_curl "${args[@]}")
+      exit_code=$?
+    fi
+
+    if [[ $exit_code -eq 0 ]]; then
+      $STD msg_ok "Fetched: $url"
+      $has_output_file || printf '%s' "$result"
+      return 0
+    fi
+
+    if ((attempt >= max_retries)); then
+      # Read error log if it exists
+      if [ -s /tmp/curl_error.log ]; then
+        local curl_stderr
+        curl_stderr=$(</tmp/curl_error.log)
+        rm -f /tmp/curl_error.log
+      fi
+      __curl_err_handler "$exit_code" "$url" "${curl_stderr:-}"
+      exit
+    fi
+
+    $STD printf "\r\033[K${INFO}${YW}Retry $attempt/$max_retries in ${delay}s...${CL}" >&2
+    sleep "$delay"
+    ((attempt++))
+  done
+  set -e
+}
+
+# ------------------------------------------------------------------------------
+# Handles specific curl error codes and displays descriptive messages.
+# ------------------------------------------------------------------------------
+__curl_err_handler() {
+  local exit_code="$1"
+  local target="$2"
+  local curl_msg="$3"
+
+  case $exit_code in
+  1) msg_error "Unsupported protocol: $target" ;;
+  2) msg_error "Curl init failed: $target" ;;
+  3) msg_error "Malformed URL: $target" ;;
+  5) msg_error "Proxy resolution failed: $target" ;;
+  6) msg_error "Host resolution failed: $target" ;;
+  7) msg_error "Connection failed: $target" ;;
+  9) msg_error "Access denied: $target" ;;
+  18) msg_error "Partial file transfer: $target" ;;
+  22) msg_error "HTTP error (e.g. 400/404): $target" ;;
+  23) msg_error "Write error on local system: $target" ;;
+  26) msg_error "Read error from local file: $target" ;;
+  28) msg_error "Timeout: $target" ;;
+  35) msg_error "SSL connect error: $target" ;;
+  47) msg_error "Too many redirects: $target" ;;
+  51) msg_error "SSL cert verify failed: $target" ;;
+  52) msg_error "Empty server response: $target" ;;
+  55) msg_error "Send error: $target" ;;
+  56) msg_error "Receive error: $target" ;;
+  60) msg_error "SSL CA not trusted: $target" ;;
+  67) msg_error "Login denied by server: $target" ;;
+  78) msg_error "Remote file not found (404): $target" ;;
+  *) msg_error "Curl failed with code $exit_code: $target" ;;
+  esac
+
+  [[ -n "$curl_msg" ]] && printf "%s\n" "$curl_msg" >&2
+  exit 1
+}
+
+fatal() {
+  msg_error "$1"
+  kill -INT $$
+}
+
+# Ensure POSIX compatibility across Alpine and Debian/Ubuntu
+# === Spinner Start ===
+# Trap cleanup on various signals
+trap 'cleanup_spinner' EXIT INT TERM HUP
+
+spinner_frames=('⠋' '⠙' '⠹' '⠸' '⠼' '⠴' '⠦' '⠧' '⠇' '⠏')
+
+# === Spinner Start ===
+start_spinner() {
+  local msg="$1"
+  local spin_i=0
+  local interval=0.1
+
+  stop_spinner
+  SPINNER_MSG="$msg"
+  SPINNER_ACTIVE=1
+
+  {
+    while [[ "$SPINNER_ACTIVE" -eq 1 ]]; do
+      if [[ -t 2 ]]; then
+        printf "\r\e[2K%s %b" "${TAB}${spinner_frames[spin_i]}${TAB}" "${YW}${SPINNER_MSG}${CL}" >&2
+      else
+        printf "%s...\n" "$SPINNER_MSG" >&2
+        break
+      fi
+      spin_i=$(((spin_i + 1) % ${#spinner_frames[@]}))
+      sleep "$interval"
+    done
+  } &
+
+  local pid=$!
+  if ps -p "$pid" >/dev/null 2>&1; then
+    SPINNER_PID="$pid"
+  else
+    SPINNER_ACTIVE=0
+    SPINNER_PID=""
+  fi
+}
+
+# === Spinner Stop ===
+stop_spinner() {
+  if [[ "$SPINNER_ACTIVE" -eq 1 && -n "$SPINNER_PID" ]]; then
+    SPINNER_ACTIVE=0
+
+    if kill -0 "$SPINNER_PID" 2>/dev/null; then
+      kill "$SPINNER_PID" 2>/dev/null || true
+      for _ in $(seq 1 10); do
+        sleep 0.05
+        kill -0 "$SPINNER_PID" 2>/dev/null || break
+      done
+    fi
+
+    if [[ "$SPINNER_PID" =~ ^[0-9]+$ ]]; then
+      ps -p "$SPINNER_PID" -o pid= >/dev/null 2>&1 && wait "$SPINNER_PID" 2>/dev/null || true
+    fi
+
+    printf "\r\e[2K" >&2
+    SPINNER_PID=""
+  fi
+}
+
+cleanup_spinner() {
+  stop_spinner
+}
+
+msg_info() {
+  local msg="$1"
+  [[ -z "$msg" || -n "${MSG_INFO_SHOWN["$msg"]+x}" ]] && return
+  MSG_INFO_SHOWN["$msg"]=1
+  stop_spinner
+  start_spinner "$msg"
+}
+
+msg_ok() {
+  local msg="$1"
+  [[ -z "$msg" ]] && return
+  stop_spinner
+  printf "\r\e[2K%s %b\n" "$CM" "${GN}${msg}${CL}" >&2
+  unset MSG_INFO_SHOWN["$msg"]
+}
+
+msg_error() {
+  local msg="$1"
+  [[ -z "$msg" ]] && return
+  stop_spinner
+  printf "\r\e[2K%s %b\n" "$CROSS" "${RD}${msg}${CL}" >&2
+}
+
+msg_warn() {
+  local msg="$1"
+  [[ -z "$msg" ]] && return
+  stop_spinner
+  printf "\r\e[2K%s %b\n" "$INFO" "${YWB}${msg}${CL}" >&2
+  unset MSG_INFO_SHOWN["$msg"]
+}
+
+msg_custom() {
+  local symbol="${1:-"[*]"}"
+  local color="${2:-"\e[36m"}" # Default: Cyan
+  local msg="${3:-}"
+
+  [[ -z "$msg" ]] && return
+  stop_spinner 2>/dev/null || true
+  printf "\r\e[2K%s %b\n" "$symbol" "${color}${msg}${CL:-\e[0m}" >&2
+}
+
+msg_progress() {
+  local current="$1"
+  local total="$2"
+  local label="$3"
+  local width=40
+  local filled percent bar empty
+  local fill_char="#"
+  local empty_char="-"
+
+  if ! [[ "$current" =~ ^[0-9]+$ ]] || ! [[ "$total" =~ ^[0-9]+$ ]] || [[ "$total" -eq 0 ]]; then
+    printf "\r\e[2K%s %b\n" "$CROSS" "${RD}Invalid progress input${CL}" >&2
+    return
+  fi
+
+  percent=$(((current * 100) / total))
+  filled=$(((current * width) / total))
+  empty=$((width - filled))
+
+  bar=$(printf "%${filled}s" | tr ' ' "$fill_char")
+  bar+=$(printf "%${empty}s" | tr ' ' "$empty_char")
+
+  printf "\r\e[2K%s [%s] %3d%% %s" "${TAB}" "$bar" "$percent" "$label" >&2
+
+  if [[ "$current" -eq "$total" ]]; then
+    printf "\n" >&2
+  fi
+}
+
+run_container_safe() {
+  local ct="$1"
+  shift
+  local cmd="$*"
+
+  lxc-attach -n "$ct" -- bash -euo pipefail -c "
+    trap 'echo Aborted in container; exit 130' SIGINT SIGTERM
+    $cmd
+  " || __handle_general_error "lxc-attach to CT $ct"
+}
+
+check_or_create_swap() {
+  msg_info "Checking for active swap"
+
+  if swapon --noheadings --show | grep -q 'swap'; then
+    msg_ok "Swap is active"
+    return 0
+  fi
+
+  msg_error "No active swap detected"
+
+  read -p "Do you want to create a swap file? [y/N]: " create_swap
+  create_swap="${create_swap,,}" # to lowercase
+
+  if [[ "$create_swap" != "y" && "$create_swap" != "yes" ]]; then
+    msg_info "Skipping swap file creation"
+    return 1
+  fi
+
+  read -p "Enter swap size in MB (e.g., 2048 for 2GB): " swap_size_mb
+  if ! [[ "$swap_size_mb" =~ ^[0-9]+$ ]]; then
+    msg_error "Invalid size input. Aborting."
+    return 1
+  fi
+
+  local swap_file="/swapfile"
+
+  msg_info "Creating ${swap_size_mb}MB swap file at $swap_file"
+  if dd if=/dev/zero of="$swap_file" bs=1M count="$swap_size_mb" status=progress &&
+    chmod 600 "$swap_file" &&
+    mkswap "$swap_file" &&
+    swapon "$swap_file"; then
+    msg_ok "Swap file created and activated successfully"
+  else
+    msg_error "Failed to create or activate swap"
+    return 1
+  fi
+}
--- a/misc/tools.func
+++ b/misc/tools.func
@ -302,28 +302,34 @@ install_mysql() {
      msg_info "MySQL $CURRENT_VERSION found, replacing with $MYSQL_VERSION"
      NEED_INSTALL=true
    else
-      msg_ok "MySQL $MYSQL_VERSION already installed"
+      # Check for patch-level updates
+      if apt list --upgradable 2>/dev/null | grep -q '^mysql-server/'; then
+        msg_info "MySQL $CURRENT_VERSION available for upgrade"
+        $STD apt-get update
+        $STD apt-get install --only-upgrade -y mysql-server
+        msg_ok "MySQL upgraded"
+      fi
+      return
    fi
  else
-    msg_info "MySQL not found, installing version $MYSQL_VERSION"
+    msg_info "Installing MySQL $MYSQL_VERSION"
    NEED_INSTALL=true
  fi

  if [[ "$NEED_INSTALL" == true ]]; then
-    msg_info "Removing conflicting MySQL packages"
    $STD systemctl stop mysql >/dev/null 2>&1 || true
-    $STD apt-get purge -y 'mysql*'
+    $STD apt-get purge -y "^mysql-server.*" "^mysql-client.*" "^mysql-common.*" || true
    rm -f /etc/apt/sources.list.d/mysql.list /etc/apt/trusted.gpg.d/mysql.gpg

-    msg_info "Setting up MySQL APT Repository"
+    local DISTRO_CODENAME
    DISTRO_CODENAME="$(awk -F= '/VERSION_CODENAME/ { print $2 }' /etc/os-release)"
-    curl -fsSL https://repo.mysql.com/RPM-GPG-KEY-mysql-2022 | gpg --dearmor -o /etc/apt/trusted.gpg.d/mysql.gpg
+    curl -fsSL https://repo.mysql.com/RPM-GPG-KEY-mysql-2023 | gpg --dearmor -o /etc/apt/trusted.gpg.d/mysql.gpg
    echo "deb [signed-by=/etc/apt/trusted.gpg.d/mysql.gpg] https://repo.mysql.com/apt/debian/ ${DISTRO_CODENAME} mysql-${MYSQL_VERSION}" \
      >/etc/apt/sources.list.d/mysql.list

+    export DEBIAN_FRONTEND=noninteractive
    $STD apt-get update
    $STD apt-get install -y mysql-server
-
    msg_ok "Installed MySQL $MYSQL_VERSION"
  fi
 }
--- a/tools/headers/pve-privilege-converter
+++ b/tools/headers/pve-privilege-converter
@ -0,0 +1,6 @@
+    ____ _    ________     ____       _       _ __                      ______                           __           
+   / __ \ |  / / ____/    / __ \_____(_)   __(_) /__  ____ ____        / ____/___  ____ _   _____  _____/ /____  _____
+  / /_/ / | / / __/______/ /_/ / ___/ / | / / / / _ \/ __ `/ _ \______/ /   / __ \/ __ \ | / / _ \/ ___/ __/ _ \/ ___/
+ / ____/| |/ / /__/_____/ ____/ /  / /| |/ / / /  __/ /_/ /  __/_____/ /___/ /_/ / / / / |/ /  __/ /  / /_/  __/ /    
+/_/     |___/_____/    /_/   /_/  /_/ |___/_/_/\___/\__, /\___/      \____/\____/_/ /_/|___/\___/_/   \__/\___/_/     
+                                                   /____/                                                             
--- a/tools/pve/pve-privilege-converter.sh
+++ b/tools/pve/pve-privilege-converter.sh
@ -0,0 +1,196 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: MickLesk
+# Adapted from onethree7 (https://github.com/onethree7/proxmox-lxc-privilege-converter)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+
+if ! command -v curl >/dev/null 2>&1; then
+  printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
+  apt-get update >/dev/null 2>&1
+  apt-get install -y curl >/dev/null 2>&1
+fi
+source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/core.func)
+load_functions
+
+set -euo pipefail
+shopt -s inherit_errexit nullglob
+
+APP="PVE-Privilege-Converter"
+APP_TYPE="tools"
+header_info "$APP"
+
+check_root() {
+  if [[ $EUID -ne 0 ]]; then
+    msg_error "Script must be run as root"
+    exit 1
+  fi
+}
+
+select_target_storage_and_container_id() {
+  echo -e "\nSelect target storage for restored container:\n"
+  mapfile -t target_storages < <(pvesm status --content images | awk 'NR > 1 {print $1}')
+  for i in "${!target_storages[@]}"; do
+    printf "%s) %s\n" "$((i + 1))" "${target_storages[$i]}"
+  done
+
+  while true; do
+    read -rp "Enter number of target storage: " choice
+    if [[ "$choice" =~ ^[0-9]+$ ]] && ((choice >= 1 && choice <= ${#target_storages[@]})); then
+      TARGET_STORAGE="${target_storages[$((choice - 1))]}"
+      break
+    else
+      echo "Invalid selection. Try again."
+    fi
+  done
+
+  next_free_id=$(pvesh get /cluster/nextid 2>/dev/null || echo 999)
+  [[ "$next_free_id" =~ ^[0-9]+$ ]] || next_free_id=999
+
+  echo ""
+  read -rp "Suggested next free container ID: $next_free_id. Enter new container ID [default: $next_free_id]: " NEW_CONTAINER_ID
+  NEW_CONTAINER_ID="${NEW_CONTAINER_ID:-$next_free_id}"
+}
+
+select_container() {
+  mapfile -t lxc_list_raw < <(pct list | awk 'NR > 1 {print $1, $3}')
+  lxc_list=()
+  for entry in "${lxc_list_raw[@]}"; do
+    [[ -n "$entry" ]] && lxc_list+=("$entry")
+  done
+
+  if [[ ${#lxc_list[@]} -eq 0 ]]; then
+    msg_error "No containers found"
+    exit 1
+  fi
+
+  PS3="Enter number of container to convert: "
+  select opt in "${lxc_list[@]}"; do
+    if [[ -n "$opt" ]]; then
+      read -r CONTAINER_ID CONTAINER_NAME <<<"$opt"
+      CONTAINER_NAME="${CONTAINER_NAME:-}"
+      break
+    else
+      echo "Invalid selection. Try again."
+    fi
+  done
+}
+
+select_backup_storage() {
+  echo -e "Select backup storage (temporary vzdump location):"
+  mapfile -t backup_storages < <(pvesm status --content backup | awk 'NR > 1 {print $1}')
+  local PS3="Enter number of backup storage: "
+
+  select opt in "${backup_storages[@]}"; do
+    if [[ -n "$opt" ]]; then
+      BACKUP_STORAGE="$opt"
+      break
+    else
+      echo "Invalid selection. Try again."
+    fi
+  done
+}
+
+backup_container() {
+  msg_custom "📦" "\e[36m" "Backing up container $CONTAINER_ID"
+  vzdump_output=$(mktemp)
+  vzdump "$CONTAINER_ID" --compress zstd --storage "$BACKUP_STORAGE" --mode snapshot | tee "$vzdump_output"
+  BACKUP_PATH=$(awk '/tar.zst/ {print $NF}' "$vzdump_output" | tr -d "'")
+  if [ -z "$BACKUP_PATH" ] || ! grep -q "Backup job finished successfully" "$vzdump_output"; then
+    rm "$vzdump_output"
+    msg_error "Backup failed"
+    exit 1
+  fi
+  rm "$vzdump_output"
+  msg_ok "Backup complete: $BACKUP_PATH"
+}
+
+perform_conversion() {
+  if pct config "$CONTAINER_ID" | grep -q 'unprivileged: 1'; then
+    UNPRIVILEGED=true
+  else
+    UNPRIVILEGED=false
+  fi
+
+  msg_custom "🛠️" "\e[36m" "Restoring as $(if $UNPRIVILEGED; then echo privileged; else echo unprivileged; fi) container"
+  restore_opts=("$NEW_CONTAINER_ID" "$BACKUP_PATH" --storage "$TARGET_STORAGE")
+  if $UNPRIVILEGED; then
+    restore_opts+=(--unprivileged false)
+  else
+    restore_opts+=(--unprivileged)
+  fi
+
+  if pct restore "${restore_opts[@]}" -ignore-unpack-errors 1; then
+    msg_ok "Conversion successful"
+  else
+    msg_error "Conversion failed"
+    exit 1
+  fi
+}
+
+manage_states() {
+  read -rp "Shutdown source and start new container? [Y/n]: " answer
+  answer=${answer:-Y}
+  if [[ $answer =~ ^[Yy] ]]; then
+    pct shutdown "$CONTAINER_ID"
+    for i in {1..36}; do
+      sleep 5
+      ! pct status "$CONTAINER_ID" | grep -q running && break
+    done
+    if pct status "$CONTAINER_ID" | grep -q running; then
+      read -rp "Timeout reached. Force shutdown? [Y/n]: " force
+      if [[ ${force:-Y} =~ ^[Yy] ]]; then
+        pkill -9 -f "lxc-start -F -n $CONTAINER_ID"
+      fi
+    fi
+    pct start "$NEW_CONTAINER_ID"
+    msg_ok "New container started"
+  else
+    msg_custom "ℹ️" "\e[36m" "Skipped container state change"
+  fi
+}
+
+cleanup_files() {
+  read -rp "Delete backup archive? [$BACKUP_PATH] [Y/n]: " cleanup
+  if [[ ${cleanup:-Y} =~ ^[Yy] ]]; then
+    rm -f "$BACKUP_PATH" && msg_ok "Removed backup archive"
+  else
+    msg_custom "💾" "\e[36m" "Retained backup archive"
+  fi
+}
+
+summary() {
+  local conversion="Unknown"
+  if [[ -n "${UNPRIVILEGED:-}" ]]; then
+    if $UNPRIVILEGED; then
+      conversion="Unprivileged → Privileged"
+    else
+      conversion="Privileged → Unprivileged"
+    fi
+  fi
+
+  echo
+  msg_custom "📄" "\e[36m" "Summary:"
+  msg_custom "   " "\e[36m" "$(printf "%-22s %s" "Original Container:" "$CONTAINER_ID ($CONTAINER_NAME)")"
+  msg_custom "   " "\e[36m" "$(printf "%-22s %s" "Backup Storage:" "$BACKUP_STORAGE")"
+  msg_custom "   " "\e[36m" "$(printf "%-22s %s" "Target Storage:" "$TARGET_STORAGE")"
+  msg_custom "   " "\e[36m" "$(printf "%-22s %s" "Backup Path:" "$BACKUP_PATH")"
+  msg_custom "   " "\e[36m" "$(printf "%-22s %s" "New Container ID:" "$NEW_CONTAINER_ID")"
+  msg_custom "   " "\e[36m" "$(printf "%-22s %s" "Privilege Conversion:" "$conversion")"
+  echo
+}
+
+main() {
+  header_info
+  check_root
+  select_container
+  select_backup_storage
+  backup_container
+  select_target_storage_and_container_id
+  perform_conversion
+  manage_states
+  cleanup_files
+  summary
+}
+
+main