Update CHANGELOG.md (#7734)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.github/label-priority.json

@@ -0,0 +1,38 @@
+{
+  "priorities": {
+    "refactor": 3,
+    "feature": 2,
+    "bugfix": 1,
+    "new script": 3,
+    "update script": 2,
+    "delete script": 2,
+    "json": 3,
+    "website": 2,
+    "maintenance": 1,
+    "documentation": 1,
+    "core": 2,
+    "api": 2,
+    "addon": 2,
+    "pve-tool": 2,
+    "vm": 2,
+    "github": 1
+  },
+  "conflicts": {
+    "bugfix": ["refactor"],
+    "website": ["json"],
+    "update script": ["new script", "delete script"],
+    "new script": ["update script", "delete script"],
+    "delete script": ["new script", "update script"]
+  },
+  "rules": {
+    "always_combine": [
+      "maintenance",
+      "core",
+      "api",
+      "addon",
+      "pve-tool",
+      "vm",
+      "github"
+    ]
+  }
+}

.github/workflows/autolabeler.yml

@@ -112,3 +112,119 @@ jobs:
                 labels: Array.from(labelsToAdd),
               });
             }
+  ai-check:
+    needs: autolabeler
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Load priority config
+        run: |
+          echo "PRIORITY_JSON=$(jq -c . .github/label-priority.json)" >> $GITHUB_ENV
+
+      - name: Fetch PR metadata
+        id: pr
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const pr = context.payload.pull_request;
+            const files = await github.rest.pulls.listFiles({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: pr.number
+            });
+            const prData = {
+              title: pr.title || "",
+              body: pr.body || "",
+              files: files.data.map(f => f.filename)
+            };
+            require('fs').writeFileSync(process.env.GITHUB_ENV, `PR_DATA=${JSON.stringify(prData)}\n`, {flag: 'a'});
+
+      - name: AI Label Review
+        id: ai
+        uses: actions/github-script@v7
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        with:
+          script: |
+            const prData = JSON.parse(process.env.PR_DATA);
+
+            const prompt = `
+            You are a GitHub labeling bot.
+            Task:
+            - Analyze PR title, body, and file list.
+            - For each possible label, return a confidence score (0–1).
+            - If both bugfix and refactor apply, prefer refactor.
+            - Output JSON: {"labels":[{"name":"bugfix","score":0.9},{"name":"refactor","score":0.6}]}
+
+            Valid labels: [new script, update script, delete script, bugfix, feature, maintenance, refactor, website, json, api, core, github, addon, pve-tool, vm].
+
+            PR data: ${JSON.stringify(prData)}
+            `;
+
+            const response = await fetch("https://api.openai.com/v1/chat/completions", {
+              method: "POST",
+              headers: {
+                "Content-Type": "application/json",
+                "Authorization": "Bearer " + process.env.OPENAI_API_KEY,
+              },
+              body: JSON.stringify({
+                model: "gpt-4.1-mini",
+                messages: [{ role: "user", content: prompt }],
+                temperature: 0
+              })
+            });
+
+            const data = await response.json();
+            const labels = JSON.parse(data.choices[0].message.content).labels;
+            core.setOutput("labels", JSON.stringify(labels));
+
+      - name: Apply AI Labels
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const raw = JSON.parse('${{ steps.ai.outputs.labels }}');
+            const prNumber = context.payload.pull_request.number;
+            const config = JSON.parse(process.env.PRIORITY_JSON);
+
+            let toApply = [];
+            let toSuggest = [];
+
+            raw.forEach(l => {
+              if (l.score >= 0.8) {
+                const conflicts = config.conflicts[l.name] || [];
+                const hasStrongerConflict = conflicts.some(c =>
+                  raw.some(x =>
+                    x.name === c &&
+                    x.score >= 0.6 &&
+                    (config.priorities[c] || 0) >= (config.priorities[l.name] || 0)
+                  )
+                );
+                if (!hasStrongerConflict) {
+                  toApply.push(l.name);
+                }
+              } else if (l.score >= 0.5) {
+                toSuggest.push(`${l.name} (${Math.round(l.score*100)}%)`);
+              }
+            });
+
+            if (toApply.length > 0) {
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: prNumber,
+                labels: toApply
+              });
+            }
+
+            if (toSuggest.length > 0) {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: prNumber,
+                body: `🤖 AI suggests these possible labels (uncertain): ${toSuggest.join(", ")}`
+              });
+            }

CHANGELOG.md

@@ -10,8 +10,39 @@
 > [!CAUTION]
 Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit the project's popularity for potentially malicious purposes.
 
+## 2025-09-19
+
 ## 2025-09-18
 
+### 🆕 New Scripts
+
+  - Alpine-Caddy [@tremor021](https://github.com/tremor021) ([#7711](https://github.com/community-scripts/ProxmoxVE/pull/7711))
+- pve-tool: execute.sh by @jeroenzwart [@MickLesk](https://github.com/MickLesk) ([#7708](https://github.com/community-scripts/ProxmoxVE/pull/7708))
+- GlobaLeaks ([#7707](https://github.com/community-scripts/ProxmoxVE/pull/7707))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Delay chmod after updating beszel [@CrazyWolf13](https://github.com/CrazyWolf13) ([#7725](https://github.com/community-scripts/ProxmoxVE/pull/7725))
+    - Remove redundant globaleaks configuration [@evilaliv3](https://github.com/evilaliv3) ([#7723](https://github.com/community-scripts/ProxmoxVE/pull/7723))
+    - Gatus: check for GO path before update [@vhsdream](https://github.com/vhsdream) ([#7705](https://github.com/community-scripts/ProxmoxVE/pull/7705))
+
+  - #### ✨ New Features
+
+    - Cloudflared: Bump to Debian 13 [@MickLesk](https://github.com/MickLesk) ([#7719](https://github.com/community-scripts/ProxmoxVE/pull/7719))
+    - AdGuard Home: Bump to Debian 13 [@MickLesk](https://github.com/MickLesk) ([#7720](https://github.com/community-scripts/ProxmoxVE/pull/7720))
+
+  - #### 🔧 Refactor
+
+    - Immich: Debian Trixie [@vhsdream](https://github.com/vhsdream) ([#7728](https://github.com/community-scripts/ProxmoxVE/pull/7728))
+
+### 🌐 Website
+
+  - #### 📝 Script Information
+
+    - Add Warning for Containerized Home Assistant [@ZaxLofful](https://github.com/ZaxLofful) ([#7704](https://github.com/community-scripts/ProxmoxVE/pull/7704))
+
 ## 2025-09-17
 
 ### 🚀 Updated Scripts

ct/adguard.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-debian}"
-var_version="${var_version:-12}"
+var_version="${var_version:-13}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"
@@ -20,15 +20,15 @@ color
 catch_errors
 
 function update_script() {
-    header_info
+  header_info
-    check_container_storage
+  check_container_storage
-    check_container_resources
+  check_container_resources
-    if [[ ! -d /opt/AdGuardHome ]]; then
+  if [[ ! -d /opt/AdGuardHome ]]; then
-        msg_error "No ${APP} Installation Found!"
+    msg_error "No ${APP} Installation Found!"
-        exit
-    fi
-    msg_error "Adguard Home should be updated via the user interface."
     exit
+  fi
+  msg_error "Adguard Home can only be updated via the user interface."
+  exit
 }
 
 start

ct/alpine-caddy.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: cobalt (cobaltgit)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://caddyserver.com/
+
+APP="Alpine-Caddy"
+var_tags="${var_tags:-webserver}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-256}"
+var_disk="${var_disk:-3}"
+var_os="${var_os:-alpine}"
+var_version="${var_version:-3.22}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -d /etc/caddy ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  msg_info "Updating $APP LXC"
+  $STD apk -U upgrade
+  msg_ok "Updated $APP LXC"
+
+  msg_info "Restarting Caddy"
+  rc-service caddy restart
+  msg_ok "Restarted Caddy"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:80${CL}"

ct/beszel.sh

@@ -33,7 +33,7 @@ function update_script() {
 
     msg_info "Updating $APP"
     $STD /opt/beszel/beszel update
-    chmod +x /opt/beszel/beszel
+    sleep 2 && chmod +x /opt/beszel/beszel
     msg_ok "Updated $APP"
 
     msg_info "Starting $APP"

ct/cloudflared.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-debian}"
-var_version="${var_version:-12}"
+var_version="${var_version:-13}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"
@@ -20,18 +20,18 @@ color
 catch_errors
 
 function update_script() {
-   header_info
+  header_info
-   check_container_storage
+  check_container_storage
-   check_container_resources
+  check_container_resources
-   if [[ ! -d /var ]]; then
+  if [[ ! -f /etc/systemd/system/cloudflared.service ]]; then
-      msg_error "No ${APP} Installation Found!"
+    msg_error "No ${APP} Installation Found!"
-      exit
+    exit
-   fi
+  fi
-   msg_info "Updating $APP LXC"
+  msg_info "Updating $APP LXC"
-   $STD apt-get update
+  $STD apt update
-   $STD apt-get -y upgrade
+  $STD apt -y upgrade
-   msg_ok "Updated $APP LXC"
+  msg_ok "Updated $APP LXC"
-   exit
+  exit
 }
 
 start

ct/gatus.sh

@@ -33,6 +33,11 @@ function update_script() {
     systemctl stop gatus
     msg_ok "Stopped $APP"
 
+    if [[ :$PATH: != *":/usr/local/bin:"* ]]; then
+      echo 'export PATH="/usr/local/bin:$PATH"' >>~/.bashrc
+      source ~/.bashrc
+    fi
+
     mv /opt/gatus/config/config.yaml /opt
     rm -rf /opt/gatus
     fetch_and_deploy_gh_release "gatus" "TwiN/gatus"

ct/globaleaks.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2025 communtiy-scripts ORG
+# Author: Giovanni Pellerano (evilaliv3)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/globaleaks/globaleaks-whistleblowing-software
+
+APP="GlobaLeaks"
+var_tags="${var_tags:-whistleblowing-software}"
+var_disk="${var_disk:-4}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -f /usr/sbin/globaleaks ]]; then
+    msg_error "No ${APP} installation found!"
+    exit
+  fi
+
+  msg_info "Updating $APP LXC"
+  $STD apt update
+  $STD apt -y upgrade
+  msg_ok "Updated $APP LXC"
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN} ${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}https://${IP}${CL}"

ct/headers/alpine-caddy

@@ -0,0 +1,6 @@
+    ___    __      _                  ______          __    __     
+   /   |  / /___  (_)___  ___        / ____/___ _____/ /___/ /_  __
+  / /| | / / __ \/ / __ \/ _ \______/ /   / __ `/ __  / __  / / / /
+ / ___ |/ / /_/ / / / / /  __/_____/ /___/ /_/ / /_/ / /_/ / /_/ / 
+/_/  |_/_/ .___/_/_/ /_/\___/      \____/\__,_/\__,_/\__,_/\__, /  
+        /_/                                               /____/   

ct/headers/globaleaks

@@ -0,0 +1,6 @@
+   ________      __          __               __       
+  / ____/ /___  / /_  ____ _/ /   ___  ____ _/ /_______
+ / / __/ / __ \/ __ \/ __ `/ /   / _ \/ __ `/ //_/ ___/
+/ /_/ / / /_/ / /_/ / /_/ / /___/  __/ /_/ / ,< (__  ) 
+\____/_/\____/_.___/\__,_/_____/\___/\__,_/_/|_/____/  
+                                                       

ct/immich.sh

@@ -11,7 +11,7 @@ var_disk="${var_disk:-20}"
 var_cpu="${var_cpu:-4}"
 var_ram="${var_ram:-4096}"
 var_os="${var_os:-debian}"
-var_version="${var_version:-12}"
+var_version="${var_version:-13}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"
@@ -27,11 +27,22 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
+  if [[ -f /etc/apt/sources.list.d/immich.list ]]; then
+    msg_error "Wrong Debian version detected!"
+    msg_error "You must upgrade your LXC to Debian Trixie before updating."
+    msg_error "Please visit https://github.com/community-scripts/ProxmoxVE/discussions/7726 for details."
+    echo "${TAB3}  If you have upgraded your LXC to Trixie and you still see this message, please open an Issue in the Community-Scripts repo."
+    exit
+  fi
 
   setup_uv
   PNPM_VERSION="$(curl -fsSL "https://raw.githubusercontent.com/immich-app/immich/refs/heads/main/package.json" | jq -r '.packageManager | split("@")[1]')"
   NODE_VERSION="22" NODE_MODULE="pnpm@${PNPM_VERSION}" setup_nodejs
 
+  if dpkg -l | grep -q "libmimalloc2.0"; then
+    $STD apt-get update && $STD apt-get install -y libmimalloc3
+  fi
+
   STAGING_DIR=/opt/staging
   BASE_DIR=${STAGING_DIR}/base-images
   SOURCE_DIR=${STAGING_DIR}/image-source
@@ -45,8 +56,10 @@ function update_script() {
       for url in "${INTEL_URLS[@]}"; do
         curl -fsSLO "$url"
       done
+      $STD apt-mark unhold libigdgmm12
       $STD apt install -y ./*.deb
       rm ./*.deb
+      $STD apt-mark hold libigdgmm12
       msg_ok "Intel iGPU dependencies updated"
     fi
     rm ~/Dockerfile
@@ -78,22 +91,10 @@ function update_script() {
 
     if [[ ! -f ~/.vchord_version ]] || [[ "$VCHORD_RELEASE" != "$(cat ~/.vchord_version)" ]]; then
       msg_info "Updating VectorChord"
-      if [[ ! -f ~/.vchord_version ]] || [[ ! "$(cat ~/.vchord_version)" > "0.3.0" ]]; then
-        $STD sudo -u postgres pg_dumpall --clean --if-exists --username=postgres | gzip >/etc/postgresql/immich-db-vchord0.3.0.sql.gz
-        chown postgres /etc/postgresql/immich-db-vchord0.3.0.sql.gz
-        $STD sudo -u postgres gunzip --stdout /etc/postgresql/immich-db-vchord0.3.0.sql.gz |
-          sed -e "s/SELECT pg_catalog.set_config('search_path', '', false);/SELECT pg_catalog.set_config('search_path', 'public, pg_catalog', true);/g" \
-            -e "/vchordrq.prewarm_dim/d" |
-          sudo -u postgres psql
-      fi
       curl -fsSL "https://github.com/tensorchord/vectorchord/releases/download/${VCHORD_RELEASE}/postgresql-16-vchord_${VCHORD_RELEASE}-1_amd64.deb" -o vchord.deb
       $STD apt install -y ./vchord.deb
       $STD sudo -u postgres psql -d immich -c "ALTER EXTENSION vchord UPDATE;"
       systemctl restart postgresql
-      if [[ ! -f ~/.vchord_version ]] || [[ ! "$(cat ~/.vchord_version)" > "0.3.0" ]]; then
-        $STD sudo -u postgres psql -d immich -c "REINDEX INDEX face_index;"
-        $STD sudo -u postgres psql -d immich -c "REINDEX INDEX clip_index;"
-      fi
       echo "$VCHORD_RELEASE" >~/.vchord_version
       rm ./vchord.deb
       msg_ok "Updated VectorChord to v${VCHORD_RELEASE}"
@@ -126,9 +127,6 @@ EOF
 
     msg_info "Updating ${APP} web and microservices"
     cd "$SRC_DIR"/server
-    if [[ "$RELEASE" == "1.135.1" ]]; then
-      rm ./src/schema/migrations/1750323941566-UnsetPrewarmDimParameter.ts
-    fi
     export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
     export CI=1
     corepack enable
@@ -144,6 +142,7 @@ EOF
 
     # openapi & web build
     cd "$SRC_DIR"
+    echo "packageImportMethod: hardlink" >>./pnpm-workspace.yaml
     $STD pnpm --filter @immich/sdk --filter immich-web --frozen-lockfile --force install
     $STD pnpm --filter @immich/sdk --filter immich-web build
     cp -a web/build "$APP_DIR"/www
@@ -158,16 +157,16 @@ EOF
     msg_ok "Updated ${APP} web and microservices"
 
     cd "$SRC_DIR"/machine-learning
-    mkdir -p "$ML_DIR"
+    mkdir -p "$ML_DIR" && chown -R immich:immich "$ML_DIR"
     export VIRTUAL_ENV="${ML_DIR}"/ml-venv
     if [[ -f ~/.openvino ]]; then
       msg_info "Updating HW-accelerated machine-learning"
-      $STD /usr/local/bin/uv sync --extra openvino --no-cache --active
+      $STD sudo --preserve-env=VIRTUAL_ENV -nu immich uv sync --extra openvino --active -n -p python3.11 --managed-python
       patchelf --clear-execstack "${VIRTUAL_ENV}/lib/python3.11/site-packages/onnxruntime/capi/onnxruntime_pybind11_state.cpython-311-x86_64-linux-gnu.so"
       msg_ok "Updated HW-accelerated machine-learning"
     else
       msg_info "Updating machine-learning"
-      $STD /usr/local/bin/uv sync --extra cpu --no-cache --active
+      $STD sudo --preserve-env=VIRTUAL_ENV -nu immich uv sync --extra cpu --active -n -p python3.11 --managed-python
       msg_ok "Updated machine-learning"
     fi
     cd "$SRC_DIR"
@@ -186,10 +185,6 @@ EOF
     ln -s "$GEO_DIR" "$APP_DIR"
 
     chown -R immich:immich "$INSTALL_DIR"
-    if [[ ! -f ~/.debian_version.bak ]]; then
-      cp /etc/debian_version ~/.debian_version.bak
-      sed -i 's/.*/13.0/' /etc/debian_version
-    fi
     msg_ok "Updated ${APP} to v${RELEASE}"
 
     msg_info "Cleaning up"
@@ -205,8 +200,7 @@ function compile_libjxl() {
   SOURCE=${SOURCE_DIR}/libjxl
   JPEGLI_LIBJPEG_LIBRARY_SOVERSION="62"
   JPEGLI_LIBJPEG_LIBRARY_VERSION="62.3.0"
-  # : "${LIBJXL_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libjxl.json)}"
+  : "${LIBJXL_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libjxl.json)}"
-  : "${LIBJXL_REVISION:=794a5dcf0d54f9f0b20d288a12e87afb91d20dfc}"
   if [[ "$LIBJXL_REVISION" != "$(grep 'libjxl' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
     msg_info "Recompiling libjxl"
     if [[ -d "$SOURCE" ]]; then rm -rf "$SOURCE"; fi
@@ -253,8 +247,7 @@ function compile_libheif() {
     $STD apt-get install -y libaom-dev
     local update="required"
   fi
-  # : "${LIBHEIF_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)}"
+  : "${LIBHEIF_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)}"
-  : "${LIBHEIF_REVISION:=35dad50a9145332a7bfdf1ff6aef6801fb613d68}"
   if [[ "${update:-}" ]] || [[ "$LIBHEIF_REVISION" != "$(grep 'libheif' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
     msg_info "Recompiling libheif"
     if [[ -d "$SOURCE" ]]; then rm -rf "$SOURCE"; fi
@@ -285,9 +278,7 @@ function compile_libheif() {
 
 function compile_libraw() {
   SOURCE=${SOURCE_DIR}/libraw
-  local update
+  : "${LIBRAW_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libraw.json)}"
-  # : "${LIBRAW_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libraw.json)}"
-  : "${LIBRAW_REVISION:=09bea31181b43e97959ee5452d91e5bc66365f1f}"
   if [[ "$LIBRAW_REVISION" != "$(grep 'libraw' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
     msg_info "Recompiling libraw"
     if [[ -d "$SOURCE" ]]; then rm -rf "$SOURCE"; fi
@@ -308,15 +299,15 @@ function compile_libraw() {
 
 function compile_imagemagick() {
   SOURCE=$SOURCE_DIR/imagemagick
-  # : "${IMAGEMAGICK_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/imagemagick.json)}"
+  : "${IMAGEMAGICK_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/imagemagick.json)}"
-  : "${IMAGEMAGICK_REVISION:=8289a3388a085ad5ae81aa6812f21554bdfd54f2}"
+  if [[ "$IMAGEMAGICK_REVISION" != "$(grep 'imagemagick' ~/.immich_library_revisions | awk '{print $2}')" ]] ||
-  if [[ "$IMAGEMAGICK_REVISION" != "$(grep 'imagemagick' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
+    ! grep -q 'DMAGICK_LIBRAW' /usr/local/lib/ImageMagick-7*/config-Q16HDRI/configure.xml; then
     msg_info "Recompiling ImageMagick"
     if [[ -d "$SOURCE" ]]; then rm -rf "$SOURCE"; fi
     $STD git clone https://github.com/ImageMagick/ImageMagick.git "$SOURCE"
     cd "$SOURCE"
     $STD git reset --hard "$IMAGEMAGICK_REVISION"
-    $STD ./configure --with-modules
+    $STD ./configure --with-modules CPPFLAGS="-DMAGICK_LIBRAW_VERSION_TAIL=202502"
     $STD make -j"$(nproc)"
     $STD make install
     ldconfig /usr/local/lib
@@ -329,8 +320,7 @@ function compile_imagemagick() {
 
 function compile_libvips() {
   SOURCE=$SOURCE_DIR/libvips
-  # : "${LIBVIPS_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libvips.json)}"
+  : "${LIBVIPS_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libvips.json)}"
-  : "${LIBVIPS_REVISION:=8fa37a64547e392d3808eed8d72adab7e02b3d00}"
   if [[ "$LIBVIPS_REVISION" != "$(grep 'libvips' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
     msg_info "Recompiling libvips"
     if [[ -d "$SOURCE" ]]; then rm -rf "$SOURCE"; fi

frontend/public/json/adguard.json

@@ -1,51 +1,51 @@
 {
-    "name": "AdGuard Home",
+  "name": "AdGuard Home",
-    "slug": "adguard",
+  "slug": "adguard",
-    "categories": [
+  "categories": [
-        5
+    5
-    ],
+  ],
-    "date_created": "2024-04-28",
+  "date_created": "2024-04-28",
-    "type": "ct",
+  "type": "ct",
-    "updateable": true,
+  "updateable": true,
-    "privileged": false,
+  "privileged": false,
-    "interface_port": 3000,
+  "interface_port": 3000,
-    "documentation": "https://github.com/AdguardTeam/AdGuardHome/wiki/Getting-Started",
+  "documentation": "https://github.com/AdguardTeam/AdGuardHome/wiki/Getting-Started",
-    "website": "https://adguard.com/en/adguard-home/overview.html",
+  "website": "https://adguard.com/en/adguard-home/overview.html",
-    "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons/webp/adguard-home.webp",
+  "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons/webp/adguard-home.webp",
-    "config_path": "/opt/AdGuardHome/AdGuardHome.yaml",
+  "config_path": "/opt/AdGuardHome/AdGuardHome.yaml",
-    "description": "AdGuard Home is an open-source, self-hosted network-wide ad blocker. It blocks advertisements, trackers, phishing and malware websites, and provides protection against online threats. AdGuard Home is a DNS-based solution, which means it blocks ads and malicious content at the network level, before it even reaches your device. It runs on your home network and can be easily configured and managed through a web-based interface. It provides detailed statistics and logs, allowing you to see which websites are being blocked, and why. AdGuard Home is designed to be fast, lightweight, and easy to use, making it an ideal solution for home users who want to block ads, protect their privacy, and improve the speed and security of their online experience.",
+  "description": "AdGuard Home is an open-source, self-hosted network-wide ad blocker. It blocks advertisements, trackers, phishing and malware websites, and provides protection against online threats. AdGuard Home is a DNS-based solution, which means it blocks ads and malicious content at the network level, before it even reaches your device. It runs on your home network and can be easily configured and managed through a web-based interface. It provides detailed statistics and logs, allowing you to see which websites are being blocked, and why. AdGuard Home is designed to be fast, lightweight, and easy to use, making it an ideal solution for home users who want to block ads, protect their privacy, and improve the speed and security of their online experience.",
-    "install_methods": [
+  "install_methods": [
-        {
+    {
-            "type": "default",
+      "type": "default",
-            "script": "ct/adguard.sh",
+      "script": "ct/adguard.sh",
-            "resources": {
+      "resources": {
-                "cpu": 1,
+        "cpu": 1,
-                "ram": 512,
+        "ram": 512,
-                "hdd": 2,
+        "hdd": 2,
-                "os": "debian",
+        "os": "debian",
-                "version": "12"
+        "version": "13"
-            }
+      }
-        },
-        {
-            "type": "alpine",
-            "script": "ct/alpine-adguard.sh",
-            "resources": {
-                "cpu": 1,
-                "ram": 256,
-                "hdd": 1,
-                "os": "alpine",
-                "version": "3.22"
-            }
-        }
-    ],
-    "default_credentials": {
-        "username": null,
-        "password": null
     },
-    "notes": [
+    {
-        {
+      "type": "alpine",
-            "text": "Adguard Home can be updated via the user interface.",
+      "script": "ct/alpine-adguard.sh",
-            "type": "info"
+      "resources": {
-        }
+        "cpu": 1,
-    ]
+        "ram": 256,
+        "hdd": 1,
+        "os": "alpine",
+        "version": "3.22"
+      }
+    }
+  ],
+  "default_credentials": {
+    "username": null,
+    "password": null
+  },
+  "notes": [
+    {
+      "text": "AdGuard Home can only be updated via the user interface.",
+      "type": "info"
+    }
+  ]
 }

frontend/public/json/caddy.json

@@ -4,7 +4,7 @@
   "categories": [
     21
   ],
-  "date_created": "2024-05-11",
+  "date_created": "2025-09-17",
   "type": "ct",
   "updateable": true,
   "privileged": false,
@@ -25,6 +25,17 @@
         "os": "debian",
         "version": "12"
       }
+    },
+    {
+      "type": "alpine",
+      "script": "ct/alpine-caddy.sh",
+      "resources": {
+        "cpu": 1,
+        "ram": 256,
+        "hdd": 3,
+        "os": "alpine",
+        "version": "3.22"
+      }
     }
   ],
   "default_credentials": {

frontend/public/json/cloudflared.json

@@ -23,7 +23,7 @@
         "ram": 512,
         "hdd": 2,
         "os": "debian",
-        "version": "12"
+        "version": "13"
       }
     }
   ],

frontend/public/json/execute.json

@@ -0,0 +1,48 @@
+{
+  "name": "PVE LXC Execute Command",
+  "slug": "lxc-execute",
+  "categories": [
+    1
+  ],
+  "date_created": "2025-09-18",
+  "type": "pve",
+  "updateable": false,
+  "privileged": false,
+  "interface_port": null,
+  "documentation": null,
+  "website": null,
+  "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons/webp/proxmox.webp",
+  "config_path": "",
+  "description": "This script allows administrators to execute a custom command inside one or multiple LXC containers on a Proxmox VE node. Containers can be selectively excluded via an interactive checklist. If a container is stopped, the script will automatically start it, run the command, and then shut it down again. Only Debian and Ubuntu based containers are supported.",
+  "install_methods": [
+    {
+      "type": "default",
+      "script": "tools/pve/execute.sh",
+      "resources": {
+        "cpu": null,
+        "ram": null,
+        "hdd": null,
+        "os": null,
+        "version": null
+      }
+    }
+  ],
+  "default_credentials": {
+    "username": null,
+    "password": null
+  },
+  "notes": [
+    {
+      "text": "Execute within the Proxmox shell.",
+      "type": "info"
+    },
+    {
+      "text": "Non-Debian/Ubuntu containers will be skipped automatically.",
+      "type": "info"
+    },
+    {
+      "text": "Stopped containers will be started temporarily to run the command, then shut down again.",
+      "type": "warning"
+    }
+  ]
+}

frontend/public/json/globaleaks.json

@@ -0,0 +1,35 @@
+{
+  "name": "GlobaLeaks",
+  "slug": "globaleaks",
+  "categories": [
+    0
+  ],
+  "date_created": "2025-09-18",
+  "type": "ct",
+  "updateable": true,
+  "privileged": false,
+  "interface_port": 443,
+  "documentation": "https://docs.globaleaks.org",
+  "website": "https://www.globaleaks.org/",
+  "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons/webp/globaleaks.webp",
+  "config_path": "",
+  "description": "GlobaLeaks is a free and open-source whistleblowing software enabling anyone to easily set up and maintain a secure reporting platform.",
+  "install_methods": [
+    {
+      "type": "default",
+      "script": "ct/globaleaks.sh",
+      "resources": {
+        "cpu": 2,
+        "ram": 1024,
+        "hdd": 4,
+        "os": "debian",
+        "version": "13"
+      }
+    }
+  ],
+  "default_credentials": {
+    "username": null,
+    "password": null
+  },
+  "notes": []
+}

frontend/public/json/homeassistant.json

@@ -32,6 +32,10 @@
         "password": null
     },
     "notes": [
+        {
+            "text": "Containerized version doesn't allow Home Assistant add-ons.",
+            "type": "warning"
+        },
         {
             "text": "If the LXC is created Privileged, the script will automatically set up USB passthrough.",
             "type": "warning"

frontend/public/json/immich.json

@@ -23,7 +23,7 @@
         "ram": 4096,
         "hdd": 20,
         "os": "Debian",
-        "version": "12"
+        "version": "13"
       }
     }
   ],

frontend/public/json/versions.json

@@ -1,4 +1,114 @@
 [
+  {
+    "name": "ollama/ollama",
+    "version": "v0.11.11-rc3",
+    "date": "2025-09-12T23:40:14Z"
+  },
+  {
+    "name": "pocket-id/pocket-id",
+    "version": "v1.11.1",
+    "date": "2025-09-18T20:55:56Z"
+  },
+  {
+    "name": "mattermost/mattermost",
+    "version": "mattermost-redux@10.12.0",
+    "date": "2025-09-18T20:15:19Z"
+  },
+  {
+    "name": "saltstack/salt",
+    "version": "v3007.8",
+    "date": "2025-09-18T18:19:04Z"
+  },
+  {
+    "name": "docmost/docmost",
+    "version": "v0.23.2",
+    "date": "2025-09-18T17:18:59Z"
+  },
+  {
+    "name": "bluenviron/mediamtx",
+    "version": "v1.15.0",
+    "date": "2025-09-18T17:14:15Z"
+  },
+  {
+    "name": "emqx/emqx",
+    "version": "e5.10.1",
+    "date": "2025-09-18T16:43:47Z"
+  },
+  {
+    "name": "TandoorRecipes/recipes",
+    "version": "2.2.1",
+    "date": "2025-09-18T16:18:17Z"
+  },
+  {
+    "name": "YunoHost/yunohost",
+    "version": "debian/12.1.25",
+    "date": "2025-09-18T15:40:25Z"
+  },
+  {
+    "name": "grokability/snipe-it",
+    "version": "v8.3.2",
+    "date": "2025-09-18T13:55:58Z"
+  },
+  {
+    "name": "n8n-io/n8n",
+    "version": "n8n@1.109.2",
+    "date": "2025-09-03T07:50:21Z"
+  },
+  {
+    "name": "zitadel/zitadel",
+    "version": "v4.2.2",
+    "date": "2025-09-18T10:45:22Z"
+  },
+  {
+    "name": "cloudflare/cloudflared",
+    "version": "2025.9.0",
+    "date": "2025-09-18T10:23:49Z"
+  },
+  {
+    "name": "wazuh/wazuh",
+    "version": "coverity-w38-4.14.0",
+    "date": "2025-09-18T10:14:08Z"
+  },
+  {
+    "name": "NLnetLabs/unbound",
+    "version": "release-1.24.0",
+    "date": "2025-09-18T08:36:55Z"
+  },
+  {
+    "name": "Jackett/Jackett",
+    "version": "v0.23.38",
+    "date": "2025-09-18T05:55:28Z"
+  },
+  {
+    "name": "outline/outline",
+    "version": "v0.87.4",
+    "date": "2025-09-18T00:47:08Z"
+  },
+  {
+    "name": "jeedom/core",
+    "version": "4.4.20",
+    "date": "2025-09-18T00:27:06Z"
+  },
+  {
+    "name": "steveiliop56/tinyauth",
+    "version": "v3.6.2",
+    "date": "2025-07-17T12:08:03Z"
+  },
+  {
+    "name": "MediaBrowser/Emby.Releases",
+    "version": "4.9.1.2",
+    "date": "2025-06-26T22:08:00Z"
+  },
+  {
+    "name": "TwiN/gatus",
+    "version": "v5.24.0",
+    "date": "2025-09-17T23:46:05Z"
+  },
+  {
+    "name": "keycloak/keycloak",
+    "version": "26.2.9",
+    "date": "2025-09-17T15:11:25Z"
+  },
   {
     "name": "henrygd/beszel",
     "version": "v0.12.9",
@@ -29,11 +139,6 @@
     "version": "v1.88.2",
     "date": "2025-09-17T17:25:12Z"
   },
-  {
-    "name": "keycloak/keycloak",
-    "version": "26.2.9",
-    "date": "2025-09-17T15:11:25Z"
-  },
   {
     "name": "heiher/hev-socks5-server",
     "version": "2.10.0",
@@ -49,11 +154,6 @@
     "version": "2.0.0",
     "date": "2025-08-29T13:38:35Z"
   },
-  {
-    "name": "n8n-io/n8n",
-    "version": "n8n@1.109.2",
-    "date": "2025-09-03T07:50:21Z"
-  },
   {
     "name": "jenkinsci/jenkins",
     "version": "jenkins-2.528",
@@ -94,21 +194,11 @@
     "version": "2025.9.0",
     "date": "2025-09-17T06:51:31Z"
   },
-  {
-    "name": "MediaBrowser/Emby.Releases",
-    "version": "4.9.1.2",
-    "date": "2025-06-26T22:08:00Z"
-  },
   {
     "name": "morpheus65535/bazarr",
     "version": "v1.5.3-beta.10",
     "date": "2025-07-15T06:07:03Z"
   },
-  {
-    "name": "Jackett/Jackett",
-    "version": "v0.23.32",
-    "date": "2025-09-17T06:01:29Z"
-  },
   {
     "name": "HabitRPG/habitica",
     "version": "v5.41.1",
@@ -119,16 +209,6 @@
     "version": "v0.8.6-beta",
     "date": "2025-09-17T00:57:54Z"
   },
-  {
-    "name": "jeedom/core",
-    "version": "4.4.20",
-    "date": "2025-09-17T00:27:05Z"
-  },
-  {
-    "name": "steveiliop56/tinyauth",
-    "version": "v3.6.2",
-    "date": "2025-07-17T12:08:03Z"
-  },
   {
     "name": "Ombi-app/Ombi",
     "version": "v4.47.1",
@@ -144,11 +224,6 @@
     "version": "2.510",
     "date": "2025-09-16T20:28:37Z"
   },
-  {
-    "name": "YunoHost/yunohost",
-    "version": "debian/12.1.24",
-    "date": "2025-09-16T19:55:04Z"
-  },
   {
     "name": "firefly-iii/firefly-iii",
     "version": "v6.4.0",
@@ -164,11 +239,6 @@
     "version": "v0.107.66",
     "date": "2025-09-15T13:39:52Z"
   },
-  {
-    "name": "wazuh/wazuh",
-    "version": "v4.13.0-rc5",
-    "date": "2025-09-16T16:12:20Z"
-  },
   {
     "name": "booklore-app/booklore",
     "version": "v1.3.2",
@@ -199,11 +269,6 @@
     "version": "v11.3.0",
     "date": "2025-09-16T13:53:44Z"
   },
-  {
-    "name": "emqx/emqx",
-    "version": "e5.10.1-rc.2",
-    "date": "2025-09-16T13:41:59Z"
-  },
   {
     "name": "tobychui/zoraxy",
     "version": "v3.2.5r2",
@@ -214,21 +279,11 @@
     "version": "v2.4.0p12",
     "date": "2025-09-16T12:53:03Z"
   },
-  {
-    "name": "zitadel/zitadel",
-    "version": "v4.2.0",
-    "date": "2025-09-15T09:29:55Z"
-  },
   {
     "name": "fallenbagel/jellyseerr",
     "version": "preview-debug-plex-watchlist",
     "date": "2025-09-16T09:20:58Z"
   },
-  {
-    "name": "mattermost/mattermost",
-    "version": "v10.11.3",
-    "date": "2025-09-16T07:39:13Z"
-  },
   {
     "name": "readeck/readeck",
     "version": "0.20.3",
@@ -379,11 +434,6 @@
     "version": "cli/v0.27.1",
     "date": "2025-09-14T14:48:48Z"
   },
-  {
-    "name": "docmost/docmost",
-    "version": "v0.23.1",
-    "date": "2025-09-14T14:31:45Z"
-  },
   {
     "name": "intri-in/manage-my-damn-life-nextjs",
     "version": "v0.8.1",
@@ -414,11 +464,6 @@
     "version": "v1.12.4",
     "date": "2025-09-13T08:08:55Z"
   },
-  {
-    "name": "ollama/ollama",
-    "version": "v0.11.11-rc3",
-    "date": "2025-09-12T23:40:14Z"
-  },
   {
     "name": "chrisvel/tududi",
     "version": "v0.82-rc2",
@@ -464,21 +509,11 @@
     "version": "v4.14.0",
     "date": "2025-09-05T18:28:28Z"
   },
-  {
-    "name": "NLnetLabs/unbound",
-    "version": "release-1.24.0rc1",
-    "date": "2025-09-11T07:05:16Z"
-  },
   {
     "name": "go-gitea/gitea",
     "version": "v1.24.6",
     "date": "2025-09-11T04:20:27Z"
   },
-  {
-    "name": "TandoorRecipes/recipes",
-    "version": "2.2.0",
-    "date": "2025-09-10T18:36:56Z"
-  },
   {
     "name": "aceberg/WatchYourLAN",
     "version": "2.1.4",
@@ -679,11 +714,6 @@
     "version": "2.6.1",
     "date": "2025-09-01T19:05:18Z"
   },
-  {
-    "name": "outline/outline",
-    "version": "v0.87.3",
-    "date": "2025-09-01T16:25:43Z"
-  },
   {
     "name": "seanmorley15/AdventureLog",
     "version": "v0.11.0",
@@ -694,11 +724,6 @@
     "version": "rrc_steady_12.2.0-17245430286.patch1",
     "date": "2025-09-01T14:19:14Z"
   },
-  {
-    "name": "grokability/snipe-it",
-    "version": "v8.3.1",
-    "date": "2025-09-01T11:00:07Z"
-  },
   {
     "name": "crowdsecurity/crowdsec",
     "version": "v1.7.0",
@@ -714,11 +739,6 @@
     "version": "v2.1.0",
     "date": "2025-08-29T12:56:13Z"
   },
-  {
-    "name": "saltstack/salt",
-    "version": "v3007.7",
-    "date": "2025-08-29T01:19:08Z"
-  },
   {
     "name": "linkwarden/linkwarden",
     "version": "v2.12.2",
@@ -744,11 +764,6 @@
     "version": "v1.9.2",
     "date": "2025-08-28T07:06:14Z"
   },
-  {
-    "name": "pocket-id/pocket-id",
-    "version": "v1.10.0",
-    "date": "2025-08-27T20:35:47Z"
-  },
   {
     "name": "ipfs/kubo",
     "version": "v0.37.0",
@@ -804,11 +819,6 @@
     "version": "v6.9.1",
     "date": "2025-08-22T04:04:12Z"
   },
-  {
-    "name": "cloudflare/cloudflared",
-    "version": "2025.8.1",
-    "date": "2025-08-21T15:39:34Z"
-  },
   {
     "name": "gethomepage/homepage",
     "version": "v1.4.6",
@@ -824,11 +834,6 @@
     "version": "v2.1.2.0-2.1.2.0_beta_2025-08-20",
     "date": "2025-08-20T08:15:46Z"
   },
-  {
-    "name": "TwiN/gatus",
-    "version": "v5.23.2",
-    "date": "2025-08-19T21:24:45Z"
-  },
   {
     "name": "karlomikus/bar-assistant",
     "version": "v5.8.0",
@@ -894,11 +899,6 @@
     "version": "v2.5.308",
     "date": "2025-08-13T07:09:29Z"
   },
-  {
-    "name": "bluenviron/mediamtx",
-    "version": "v1.14.0",
-    "date": "2025-08-12T13:58:46Z"
-  },
   {
     "name": "slskd/slskd",
     "version": "0.23.2",

install/adguard-install.sh

@@ -13,9 +13,7 @@ setting_up_container
 network_check
 update_os
 
-msg_info "Installing AdGuard Home"
+fetch_and_deploy_gh_release "AdGuardHome" "AdguardTeam/AdGuardHome" "prebuild" "latest" "/opt/AdGuardHome" "AdGuardHome_linux_amd64.tar.gz"
-$STD tar zxvf <(curl -fsSL https://static.adtidy.org/adguardhome/release/AdGuardHome_linux_amd64.tar.gz) -C /opt
-msg_ok "Installed AdGuard Home"
 
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/AdGuardHome.service
@@ -45,6 +43,7 @@ motd_ssh
 customize
 
 msg_info "Cleaning up"
-$STD apt-get -y autoremove
+$STD apt -y autoremove
-$STD apt-get -y autoclean
+$STD apt -y autoclean
+$STD apt -y clean
 msg_ok "Cleaned"

install/alpine-caddy-install.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: cobalt (cobaltgit)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://caddyserver.com/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Caddy"
+$STD apk add --no-cache caddy caddy-openrc
+cat <<EOF >/etc/caddy/Caddyfile
+:80 {
+        # Set this path to your site's directory.
+        root * /var/www/html
+
+        # Enable the static file server.
+        file_server
+
+        # Another common task is to set up a reverse proxy:
+        # reverse_proxy localhost:8080
+
+        # Or serve a PHP site through php-fpm:
+        # php_fastcgi localhost:9000
+}
+EOF
+mkdir -p /var/www/html
+cat <<EOF >/var/www/html/index.html
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Caddy works!</title>
+  </head>
+  <body>
+    <h1>Hello Caddy!</h1>
+    <p>For more information, refer to the Caddy <a href="https://caddyserver.com/docs/">documentation</a><p>
+  </body>
+</html>
+EOF
+msg_ok "Installed Caddy"
+
+read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
+if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
+  GO_VERSION="$(curl -fsSL https://go.dev/VERSION?m=text | head -1 | cut -c3-)" setup_go
+  msg_info "Setup xCaddy"
+  cd /opt
+  RELEASE=$(curl -fsSL https://api.github.com/repos/caddyserver/xcaddy/releases/latest | grep "tag_name" | awk '{print substr($2, 2, length($2)-3) }')
+  curl -fsSL "https://github.com/caddyserver/xcaddy/releases/download/${RELEASE}/xcaddy_${RELEASE:1}_linux_amd64.tar.gz" -o "xcaddy_${RELEASE:1}_linux_amd64.tar.gz"
+  $STD tar xzf xcaddy_"${RELEASE:1}"_linux_amd64.tar.gz -C /usr/local/bin xcaddy
+  rm -rf /opt/xcaddy*
+  $STD xcaddy build
+  msg_ok "Setup xCaddy"
+fi
+
+msg_info "Enabling Caddy Service"
+$STD rc-update add caddy default
+msg_ok "Enabled Caddy Service"
+
+msg_info "Starting Caddy"
+$STD service caddy start
+msg_ok "Started Caddy"
+
+motd_ssh
+customize

install/cloudflared-install.sh

@@ -15,11 +15,16 @@ update_os
 
 msg_info "Installing Cloudflared"
 mkdir -p --mode=0755 /usr/share/keyrings
-VERSION="$(awk -F'=' '/^VERSION_CODENAME=/{ print $NF }' /etc/os-release)"
 curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg >/usr/share/keyrings/cloudflare-main.gpg
-echo "deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared $VERSION main" >/etc/apt/sources.list.d/cloudflared.list
+cat <<EOF >/etc/apt/sources.list.d/cloudflared.sources
-$STD apt-get update
+Types: deb
-$STD apt-get install -y cloudflared
+URIs: https://pkg.cloudflare.com/cloudflared/
+Suites: any
+Components: main
+Signed-By: /usr/share/keyrings/cloudflare-main.gpg
+EOF
+$STD apt update
+$STD apt install -y cloudflared
 msg_ok "Installed Cloudflared"
 
 read -r -p "${TAB3}Would you like to configure cloudflared as a DNS-over-HTTPS (DoH) proxy? <y/N> " prompt
@@ -61,6 +66,7 @@ motd_ssh
 customize
 
 msg_info "Cleaning up"
-$STD apt-get -y autoremove
+$STD apt -y autoremove
-$STD apt-get -y autoclean
+$STD apt -y autoclean
+$STD apt -y clean
 msg_ok "Cleaned"

install/globaleaks-install.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: Giovanni Pellerano (evilaliv3)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/globaleaks/globaleaks-whistleblowing-software
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Setup GlobaLeaks"
+DISTRO_CODENAME="$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)"
+curl -fsSL https://deb.globaleaks.org/globaleaks.asc | gpg --dearmor -o /etc/apt/trusted.gpg.d/globaleaks.gpg
+echo "deb [signed-by=/etc/apt/trusted.gpg.d/globaleaks.gpg] http://deb.globaleaks.org $DISTRO_CODENAME/" >/etc/apt/sources.list.d/globaleaks.list
+echo 'APPARMOR_SANDBOXING=0' >/etc/default/globaleaks
+$STD apt update
+$STD apt -y install globaleaks
+msg_ok "Setup GlobaLeaks"
+
+motd_ssh
+customize
+
+msg_info "Cleaning up"
+$STD apt-get -y autoremove
+$STD apt-get -y autoclean
+msg_ok "Cleaned"

install/immich-install.sh

@@ -15,14 +15,7 @@ update_os
 
 setup_uv
 
-msg_info "Configuring apt and installing dependencies"
+msg_info "Installing dependencies"
-echo "deb http://deb.debian.org/debian testing main contrib" >/etc/apt/sources.list.d/immich.list
-cat <<EOF >/etc/apt/preferences.d/immich
-Package: *
-Pin: release a=testing
-Pin-Priority: -10
-EOF
-
 $STD apt-get update
 $STD apt-get install --no-install-recommends -y \
   git \
@@ -53,25 +46,33 @@ $STD apt-get install --no-install-recommends -y \
   libgomp1 \
   liblqr-1-0 \
   libltdl7 \
-  libmimalloc2.0 \
+  libmimalloc3 \
   libopenjp2-7 \
   meson \
   ninja-build \
   pkg-config \
-  cpanminus \
   mesa-utils \
   mesa-va-drivers \
   mesa-vulkan-drivers \
   ocl-icd-libopencl1 \
   tini \
-  zlib1g
+  zlib1g \
+  libio-compress-brotli-perl \
+  libwebp7 \
+  libwebpdemux2 \
+  libwebpmux3 \
+  libhwy1t64 \
+  libdav1d-dev \
+  libhwy-dev \
+  libwebp-dev \
+  libaom-dev
 curl -fsSL https://repo.jellyfin.org/jellyfin_team.gpg.key | gpg --dearmor -o /etc/apt/keyrings/jellyfin.gpg
 DPKG_ARCHITECTURE="$(dpkg --print-architecture)"
 export DPKG_ARCHITECTURE
 cat <<EOF >/etc/apt/sources.list.d/jellyfin.sources
 Types: deb
 URIs: https://repo.jellyfin.org/debian
-Suites: bookworm
+Suites: trixie
 Components: main
 Architectures: ${DPKG_ARCHITECTURE}
 Signed-By: /etc/apt/keyrings/jellyfin.gpg
@@ -93,6 +94,7 @@ read -r -p "${TAB3}Install OpenVINO dependencies for Intel HW-accelerated machin
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   msg_info "Installing OpenVINO dependencies"
   touch ~/.openvino
+  $STD apt-get install -y --no-install-recommends patchelf
   tmp_dir=$(mktemp -d)
   $STD pushd "$tmp_dir"
   curl -fsSLO https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17384.11/intel-igc-core_1.0.17384.11_amd64.deb
@@ -100,6 +102,7 @@ if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   curl -fsSLO https://github.com/intel/compute-runtime/releases/download/24.31.30508.7/intel-opencl-icd_24.31.30508.7_amd64.deb
   curl -fsSLO https://github.com/intel/compute-runtime/releases/download/24.31.30508.7/libigdgmm12_22.4.1_amd64.deb
   $STD apt install -y ./*.deb
+  $STD apt-mark hold libigdgmm12
   $STD popd
   rm -rf "$tmp_dir"
   dpkg -l | grep "intel-opencl-icd" | awk '{print $3}' >~/.intel_version
@@ -134,27 +137,7 @@ $STD sudo -u postgres psql -c "ALTER USER $DB_USER WITH SUPERUSER;"
 } >>~/"$APPLICATION".creds
 msg_ok "Set up Postgresql Database"
 
-msg_info "Installing Packages from Testing Repo"
+msg_info "Compiling Custom Photo-processing Library (extreme patience)"
-export APT_LISTCHANGES_FRONTEND=none
-export DEBIAN_FRONTEND=noninteractive
-$STD apt-get install -t testing --no-install-recommends -y \
-  libio-compress-brotli-perl \
-  libwebp7 \
-  libwebpdemux2 \
-  libwebpmux3 \
-  libhwy1t64 \
-  libdav1d-dev \
-  libhwy-dev \
-  libwebp-dev \
-  libaom-dev
-if [[ -f ~/.openvino ]]; then
-  $STD apt-get install -t testing -y patchelf
-fi
-msg_ok "Packages from Testing Repo Installed"
-
-$STD sudo -u postgres psql -c "ALTER DATABASE postgres REFRESH COLLATION VERSION;"
-$STD sudo -u postgres psql -c "ALTER DATABASE $DB_NAME REFRESH COLLATION VERSION;"
-
 LD_LIBRARY_PATH=/usr/local/lib
 export LD_RUN_PATH=/usr/local/lib
 STAGING_DIR=/opt/staging
@@ -169,8 +152,7 @@ cd "$STAGING_DIR"
 SOURCE=${SOURCE_DIR}/libjxl
 JPEGLI_LIBJPEG_LIBRARY_SOVERSION="62"
 JPEGLI_LIBJPEG_LIBRARY_VERSION="62.3.0"
-# : "${LIBJXL_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libjxl.json)}"
+: "${LIBJXL_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libjxl.json)}"
-: "${LIBJXL_REVISION:=794a5dcf0d54f9f0b20d288a12e87afb91d20dfc}"
 $STD git clone https://github.com/libjxl/libjxl.git "$SOURCE"
 cd "$SOURCE"
 $STD git reset --hard "$LIBJXL_REVISION"
@@ -207,8 +189,7 @@ msg_ok "(1/5) Compiled libjxl"
 
 msg_info "(2/5) Compiling libheif"
 SOURCE=${SOURCE_DIR}/libheif
-# : "${LIBHEIF_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libheif.json)}"
+: "${LIBHEIF_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libheif.json)}"
-: "${LIBHEIF_REVISION:=35dad50a9145332a7bfdf1ff6aef6801fb613d68}"
 $STD git clone https://github.com/strukturag/libheif.git "$SOURCE"
 cd "$SOURCE"
 $STD git reset --hard "$LIBHEIF_REVISION"
@@ -233,8 +214,7 @@ msg_ok "(2/5) Compiled libheif"
 
 msg_info "(3/5) Compiling libraw"
 SOURCE=${SOURCE_DIR}/libraw
-# : "${LIBRAW_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libraw.json)}"
+: "${LIBRAW_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libraw.json)}"
-: "${LIBRAW_REVISION:=09bea31181b43e97959ee5452d91e5bc66365f1f}"
 $STD git clone https://github.com/libraw/libraw.git "$SOURCE"
 cd "$SOURCE"
 $STD git reset --hard "$LIBRAW_REVISION"
@@ -249,12 +229,11 @@ msg_ok "(3/5) Compiled libraw"
 
 msg_info "(4/5) Compiling imagemagick"
 SOURCE=$SOURCE_DIR/imagemagick
-# : "${IMAGEMAGICK_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/imagemagick.json)}"
+: "${IMAGEMAGICK_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/imagemagick.json)}"
-: "${IMAGEMAGICK_REVISION:=8289a3388a085ad5ae81aa6812f21554bdfd54f2}"
 $STD git clone https://github.com/ImageMagick/ImageMagick.git "$SOURCE"
 cd "$SOURCE"
 $STD git reset --hard "$IMAGEMAGICK_REVISION"
-$STD ./configure --with-modules
+$STD ./configure --with-modules CPPFLAGS="-DMAGICK_LIBRAW_VERSION_TAIL=202502"
 $STD make -j"$(nproc)"
 $STD make install
 ldconfig /usr/local/lib
@@ -264,8 +243,7 @@ msg_ok "(4/5) Compiled imagemagick"
 
 msg_info "(5/5) Compiling libvips"
 SOURCE=$SOURCE_DIR/libvips
-# : "${LIBVIPS_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libvips.json)}"
+: "${LIBVIPS_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libvips.json)}"
-: "${LIBVIPS_REVISION:=8fa37a64547e392d3808eed8d72adab7e02b3d00}"
 $STD git clone https://github.com/libvips/libvips.git "$SOURCE"
 cd "$SOURCE"
 $STD git reset --hard "$LIBVIPS_REVISION"
@@ -314,6 +292,7 @@ sed -i 's|^start|./start|' "$APP_DIR"/bin/immich-admin
 
 # openapi & web build
 cd "$SRC_DIR"
+echo "packageImportMethod: hardlink" >>./pnpm-workspace.yaml
 $STD pnpm --filter @immich/sdk --filter immich-web --frozen-lockfile --force install
 $STD pnpm --filter @immich/sdk --filter immich-web build
 cp -a web/build "$APP_DIR"/www
@@ -326,16 +305,17 @@ $STD pnpm --filter @immich/cli --prod --no-optional deploy "$APP_DIR"/cli
 msg_ok "Installed Immich Server and Web Components"
 
 cd "$SRC_DIR"/machine-learning
-mkdir -p "$ML_DIR"
+$STD useradd -U -s /usr/sbin/nologin -r -M -d "$INSTALL_DIR" immich
+mkdir -p "$ML_DIR" && chown -R immich:immich "$INSTALL_DIR"
 export VIRTUAL_ENV="${ML_DIR}/ml-venv"
 if [[ -f ~/.openvino ]]; then
   msg_info "Installing HW-accelerated machine-learning"
-  $STD uv sync --extra openvino --no-cache --active
+  $STD sudo --preserve-env=VIRTUAL_ENV -nu immich uv sync --extra openvino --active -n -p python3.11 --managed-python
   patchelf --clear-execstack "${VIRTUAL_ENV}/lib/python3.11/site-packages/onnxruntime/capi/onnxruntime_pybind11_state.cpython-311-x86_64-linux-gnu.so"
   msg_ok "Installed HW-accelerated machine-learning"
 else
   msg_info "Installing machine-learning"
-  $STD uv sync --extra cpu --no-cache --active
+  $STD sudo --preserve-env=VIRTUAL_ENV -nu immich uv sync --extra cpu --active -n -p python3.11 --managed-python
   msg_ok "Installed machine-learning"
 fi
 cd "$SRC_DIR"
@@ -374,8 +354,7 @@ mkdir -p /var/log/immich
 touch /var/log/immich/{web.log,ml.log}
 msg_ok "Installed ${APPLICATION}"
 
-msg_info "Creating user, env file, scripts & services"
+msg_info "Modifying user, creating env file, scripts & services"
-$STD useradd -U -s /usr/sbin/nologin -r -M -d "$INSTALL_DIR" immich
 usermod -aG video,render immich
 
 cat <<EOF >"${INSTALL_DIR}"/.env
@@ -464,11 +443,8 @@ WantedBy=multi-user.target
 EOF
 chown -R immich:immich "$INSTALL_DIR" /var/log/immich
 systemctl enable -q --now "$APPLICATION"-ml.service "$APPLICATION"-web.service
-msg_ok "Created user, env file, scripts and services"
+msg_ok "Modified user, created env file, scripts and services"
 
-sed -i "$ a VERSION_ID=12" /etc/os-release # otherwise the motd_ssh function will fail
-cp /etc/debian_version ~/.debian_version.bak
-sed -i 's/.*/13.0/' /etc/debian_version
 motd_ssh
 customize
 

tools/pve/execute.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: jeroenzwart
+# License: MIT
+# https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+
+function header_info() {
+  clear
+  cat <<"EOF"
+     ______                     __          __   _  ________
+   / ____/  _____  _______  __/ /____     / /  | |/ / ____/
+  / __/ | |/_/ _ \/ ___/ / / / __/ _ \   / /   |   / /     
+ / /____>  </  __/ /__/ /_/ / /_/  __/  / /___/   / /___   
+/_____/_/|_|\___/\___/\__,_/\__/\___/  /_____/_/|_\____/   
+                                                           
+EOF
+}
+set -eEuo pipefail
+BL=$(echo "\033[36m")
+RD=$(echo "\033[01;31m")
+CM='\xE2\x9C\x94\033'
+GN=$(echo "\033[1;92m")
+CL=$(echo "\033[m")
+header_info
+echo "Loading..."
+whiptail --backtitle "Proxmox VE Helper Scripts" --title "Proxmox VE LXC Execute" --yesno "This will execute a command inside selected LXC Containers. Proceed?" 10 58
+NODE=$(hostname)
+EXCLUDE_MENU=()
+MSG_MAX_LENGTH=0
+while read -r TAG ITEM; do
+  OFFSET=2
+  ((${#ITEM} + OFFSET > MSG_MAX_LENGTH)) && MSG_MAX_LENGTH=${#ITEM}+OFFSET
+  EXCLUDE_MENU+=("$TAG" "$ITEM " "OFF")
+done < <(pct list | awk 'NR>1')
+excluded_containers=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Containers on $NODE" --checklist "\nSelect containers to skip from executing:\n" \
+  16 $((MSG_MAX_LENGTH + 23)) 6 "${EXCLUDE_MENU[@]}" 3>&1 1>&2 2>&3 | tr -d '"')
+
+if [ $? -ne 0 ]; then
+  exit
+fi
+
+
+read -r -p "Enter here command for inside the containers: " custom_command
+
+header_info
+echo "One moment please...\n"
+
+function execute_in() {
+  container=$1
+  name=$(pct exec "$container" hostname)
+  echo -e "${BL}[Info]${GN} Execute inside${BL} ${name}${GN} with output: ${CL}"
+  pct exec "$container" -- bash -c "${custom_command}" | tee
+}
+
+for container in $(pct list | awk '{if(NR>1) print $1}'); do
+  if [[ " ${excluded_containers[@]} " =~ " $container " ]]; then
+    echo -e "${BL}[Info]${GN} Skipping ${BL}$container${CL}"
+  else
+    os=$(pct config "$container" | awk '/^ostype/ {print $2}')
+    if [ "$os" != "debian" ] && [ "$os" != "ubuntu" ]; then
+      echo -e "${BL}[Info]${GN} Skipping ${name} ${RD}$container is not Debian or Ubuntu ${CL}"
+      continue
+    fi
+
+    status=$(pct status "$container")
+    template=$(pct config "$container" | grep -q "template:" && echo "true" || echo "false")
+    if [ "$template" == "false" ] && [ "$status" == "status: stopped" ]; then
+      echo -e "${BL}[Info]${GN} Starting${BL} $container ${CL}"
+      pct start "$container"
+      echo -e "${BL}[Info]${GN} Waiting For${BL} $container${CL}${GN} To Start ${CL}"
+      sleep 5
+      execute_in "$container"
+      echo -e "${BL}[Info]${GN} Shutting down${BL} $container ${CL}"
+      pct shutdown "$container" &
+    elif [ "$status" == "status: running" ]; then
+      execute_in "$container"
+    fi
+  fi
+done
+
+wait
+
+echo -e "${GN} Finished, execute command inside selected containers. ${CL} \n"