Enable IP forwarding in sysctl configuration

Add conditional configuration for IP forwarding based on OS version.

CHANGELOG.md

@@ -16,8 +16,13 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - Immich: Pin version to 2.2.1 [@vhsdream](https://github.com/vhsdream) ([#8800](https://github.com/community-scripts/ProxmoxVE/pull/8800))
     - jellyfin: fix: initial update [@CrazyWolf13](https://github.com/CrazyWolf13) ([#8784](https://github.com/community-scripts/ProxmoxVE/pull/8784))
 
+### 🌐 Website
+
+  - frontend: chore: bump debian OS [@CrazyWolf13](https://github.com/CrazyWolf13) ([#8798](https://github.com/community-scripts/ProxmoxVE/pull/8798))
+
 ## 2025-10-31
 
 ### 🚀 Updated Scripts

ct/headers/pangolin

@@ -0,0 +1,6 @@
+    ____                          ___     
+   / __ \____ _____  ____ _____  / (_)___ 
+  / /_/ / __ `/ __ \/ __ `/ __ \/ / / __ \
+ / ____/ /_/ / / / / /_/ / /_/ / / / / / /
+/_/    \__,_/_/ /_/\__, /\____/_/_/_/ /_/ 
+                  /____/                  

ct/immich.sh

@@ -93,7 +93,7 @@ EOF
     msg_ok "Image-processing libraries up to date"
   fi
 
-  RELEASE="2.2.0"
+  RELEASE="2.2.1"
   if check_for_gh_release "immich" "immich-app/immich" "${RELEASE}"; then
     msg_info "Stopping Services"
     systemctl stop immich-web

ct/pangolin.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: Slaviša Arežina (tremor021)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://pangolin.net/
+
+APP="Pangolin"
+var_tags="${var_tags:-proxy}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-5}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_unprivileged="${var_unprivileged:-1}"
+var_tun="${var_tun:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+    header_info
+    check_container_storage
+    check_container_resources
+    if [[ ! -d /opt/pangolin ]]; then
+        msg_error "No ${APP} Installation Found!"
+        exit
+    fi
+
+    if check_for_gh_release "pangolin" "fosrl/pangolin"; then
+        msg_info "Stopping Service"
+        systemctl stop pangolin
+        msg_info "Service stopped"
+
+        msg_info "Creating backup"
+        tar -czf /opt/pangolin_config_backup.tar.gz -C /opt/pangolin config
+        msg_ok "Created backup"
+
+        fetch_and_deploy_gh_release "pangolin" "fosrl/pangolin" "tarball"
+        fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/bin" "gerbil_linux_amd64"
+
+        msg_info "Updating Pangolin"
+        export BUILD=oss
+        export DATABASE=sqlite
+        cd /opt/pangolin
+        $STD npm ci
+        echo "export * from \"./$DATABASE\";" > server/db/index.ts
+        echo "export const build = \"$BUILD\" as any;" > server/build.ts
+        cp tsconfig.oss.json tsconfig.json
+        $STD npm run next:build
+        $STD node esbuild.mjs -e server/index.ts -o dist/server.mjs -b $BUILD
+        $STD node esbuild.mjs -e server/setup/migrationsSqlite.ts -o dist/migrations.mjs
+        $STD npm run build:cli
+        cp -R .next/standalone ./
+
+        cat <<EOF >/usr/local/bin/pangctl
+#!/bin/sh
+cd /opt/pangolin
+./dist/cli.mjs "$@"
+EOF
+        chmod +x /usr/local/bin/pangctl ./dist/cli.mjs
+        cp server/db/names.json ./dist/names.json
+        msg_ok "Updated Pangolin"
+
+        msg_info "Restoring config"
+        tar -xzf /opt/pangolin_config_backup.tar.gz -C /opt/pangolin --overwrite
+        rm -f /opt/pangolin_config_backup.tar.gz
+        msg_ok "Restored config"
+        msg_ok "Updated successfully!"
+    fi
+    exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3002${CL}"

frontend/public/json/pangolin.json

@@ -0,0 +1,48 @@
+{
+  "name": "Pangolin",
+  "slug": "pangolin",
+  "categories": [
+    21
+  ],
+  "date_created": "2025-11-01",
+  "type": "ct",
+  "updateable": true,
+  "privileged": false,
+  "interface_port": 3002,
+  "documentation": "https://docs.pangolin.net/",
+  "config_path": "/opt/pangolin/config/config.yml",
+  "website": "https://pangolin.net/",
+  "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons/webp/pangolin.webp",
+  "description": "Pangolin securely routes traffic over WireGuard tunnels to any private network. It works like a reverse proxy that spans multiple networks — no public IPs, DNS setup, or certificates required.",
+  "install_methods": [
+    {
+      "type": "default",
+      "script": "ct/pangolin.sh",
+      "resources": {
+        "cpu": 2,
+        "ram": 4096,
+        "hdd": 5,
+        "os": "Debian",
+        "version": "13"
+      }
+    }
+  ],
+  "default_credentials": {
+    "username": null,
+    "password": null
+  },
+  "notes": [
+    {
+      "text": "Type `journalctl -u pangolin | grep -oP 'Token:\\s*\\K\\w+'` into LXC console to get admin token which you will use to create admin account.",
+      "type": "info"
+    },
+    {
+      "text": "LXC has 4GB of RAM set initially for the build stage. After installation finishes, you can decrease the RAM allocated to 1024MB or 512MB even.",
+      "type": "info"
+    },
+    {
+      "text": "Make sure you edit `/opt/pangolin/config/config.yml` and change it to match your needs",
+      "type": "warning"
+    }
+  ]
+}

frontend/public/json/versions.json

@@ -1,4 +1,49 @@
 [
+  {
+    "name": "chrisbenincasa/tunarr",
+    "version": "v0.23.0-alpha.20",
+    "date": "2025-11-01T11:42:54Z"
+  },
+  {
+    "name": "Luligu/matterbridge",
+    "version": "3.3.6",
+    "date": "2025-11-01T10:41:15Z"
+  },
+  {
+    "name": "Paymenter/Paymenter",
+    "version": "v1.4.0",
+    "date": "2025-11-01T09:51:45Z"
+  },
+  {
+    "name": "fuma-nama/fumadocs",
+    "version": "fumadocs-ui@16.0.7",
+    "date": "2025-11-01T09:43:37Z"
+  },
+  {
+    "name": "Jackett/Jackett",
+    "version": "v0.24.241",
+    "date": "2025-11-01T05:57:29Z"
+  },
+  {
+    "name": "cross-seed/cross-seed",
+    "version": "v6.13.5",
+    "date": "2025-09-27T01:10:59Z"
+  },
+  {
+    "name": "theonedev/onedev",
+    "version": "v13.0.10",
+    "date": "2025-11-01T02:08:01Z"
+  },
+  {
+    "name": "jeedom/core",
+    "version": "4.4.20",
+    "date": "2025-11-01T00:27:06Z"
+  },
+  {
+    "name": "steveiliop56/tinyauth",
+    "version": "v4.0.1",
+    "date": "2025-10-15T16:53:55Z"
+  },
   {
     "name": "ollama/ollama",
     "version": "v0.12.8",
@@ -11,19 +56,14 @@
   },
   {
     "name": "runtipi/runtipi",
-    "version": "nightly",
-    "date": "2025-10-29T19:37:29Z"
+    "version": "v4.5.5",
+    "date": "2025-10-28T21:53:07Z"
   },
   {
     "name": "evcc-io/evcc",
     "version": "0.209.6",
     "date": "2025-10-31T20:13:49Z"
   },
-  {
-    "name": "chrisbenincasa/tunarr",
-    "version": "v0.23.0-alpha.19",
-    "date": "2025-10-31T20:10:28Z"
-  },
   {
     "name": "homarr-labs/homarr",
     "version": "v1.43.1",
@@ -59,6 +99,11 @@
     "version": "v0.62.12",
     "date": "2025-10-31T17:30:55Z"
   },
+  {
+    "name": "keycloak/keycloak",
+    "version": "26.4.2",
+    "date": "2025-10-23T06:59:32Z"
+  },
   {
     "name": "Cleanuparr/Cleanuparr",
     "version": "v2.4.1",
@@ -109,31 +154,11 @@
     "version": "v1.10.1",
     "date": "2025-10-31T08:25:57Z"
   },
-  {
-    "name": "Jackett/Jackett",
-    "version": "v0.24.234",
-    "date": "2025-10-31T05:56:45Z"
-  },
   {
     "name": "firefly-iii/firefly-iii",
     "version": "6.4.3",
     "date": "2025-10-31T05:51:51Z"
   },
-  {
-    "name": "jeedom/core",
-    "version": "4.4.20",
-    "date": "2025-10-31T00:27:05Z"
-  },
-  {
-    "name": "steveiliop56/tinyauth",
-    "version": "v4.0.1",
-    "date": "2025-10-15T16:53:55Z"
-  },
-  {
-    "name": "keycloak/keycloak",
-    "version": "26.4.2",
-    "date": "2025-10-23T06:59:32Z"
-  },
   {
     "name": "getumbrel/umbrel",
     "version": "1.4.2",
@@ -314,11 +339,6 @@
     "version": "cassandra-5.0.6",
     "date": "2025-10-29T07:40:47Z"
   },
-  {
-    "name": "fuma-nama/fumadocs",
-    "version": "create-fumadocs-app@16.0.7",
-    "date": "2025-10-29T06:44:29Z"
-  },
   {
     "name": "SigNoz/signoz",
     "version": "v0.99.0",
@@ -464,11 +484,6 @@
     "version": "v13.0.2",
     "date": "2025-10-26T06:33:05Z"
   },
-  {
-    "name": "cross-seed/cross-seed",
-    "version": "v6.13.5",
-    "date": "2025-09-27T01:10:59Z"
-  },
   {
     "name": "Prowlarr/Prowlarr",
     "version": "v2.1.5.5216",
@@ -504,11 +519,6 @@
     "version": "prototype-v1.24.0.s3-snapshots-3",
     "date": "2025-10-24T09:47:47Z"
   },
-  {
-    "name": "Luligu/matterbridge",
-    "version": "3.3.4",
-    "date": "2025-10-24T06:43:49Z"
-  },
   {
     "name": "inventree/InvenTree",
     "version": "1.0.8",
@@ -659,11 +669,6 @@
     "version": "0.20.4",
     "date": "2025-10-18T10:00:42Z"
   },
-  {
-    "name": "theonedev/onedev",
-    "version": "v13.0.9",
-    "date": "2025-10-18T09:59:25Z"
-  },
   {
     "name": "grokability/snipe-it",
     "version": "v8.3.4",
@@ -1024,11 +1029,6 @@
     "version": "v2.4.0p12",
     "date": "2025-09-16T12:53:03Z"
   },
-  {
-    "name": "Paymenter/Paymenter",
-    "version": "v1.3.4",
-    "date": "2025-09-15T20:48:02Z"
-  },
   {
     "name": "apache/tika",
     "version": "3.2.0",

frontend/src/config/site-config.tsx

@@ -58,8 +58,8 @@ export const OperatingSystems: OperatingSystem[] = [
   {
     name: "Debian",
     versions: [
-      { name: "11", slug: "bullseye" },
       { name: "12", slug: "bookworm" },
+      { name: "13", slug: "trixie" },
     ],
   },
   {

install/immich-install.sh

@@ -288,7 +288,7 @@ GEO_DIR="${INSTALL_DIR}/geodata"
 mkdir -p "$INSTALL_DIR"
 mkdir -p {"${APP_DIR}","${UPLOAD_DIR}","${GEO_DIR}","${INSTALL_DIR}"/cache}
 
-fetch_and_deploy_gh_release "immich" "immich-app/immich" "tarball" "v2.2.0" "$SRC_DIR"
+fetch_and_deploy_gh_release "immich" "immich-app/immich" "tarball" "v2.2.1" "$SRC_DIR"
 
 msg_info "Installing ${APPLICATION} (patience)"
 

install/pangolin-install.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: Slaviša Arežina (tremor021)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://pangolin.net/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  sqlite3 \
+  iptables
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="22" setup_nodejs
+fetch_and_deploy_gh_release "pangolin" "fosrl/pangolin" "tarball"
+fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/bin" "gerbil_linux_amd64"
+
+msg_info "Setup Pangolin"
+IP_ADDR=$(hostname -I | awk '{print $1}')
+SECRET_KEY=$(openssl rand -base64 48 | tr -dc 'A-Za-z0-9' | head -c 32)
+export BUILD=oss
+export DATABASE=sqlite
+cd /opt/pangolin
+$STD npm ci
+echo "export * from \"./$DATABASE\";" > server/db/index.ts
+echo "export const build = \"$BUILD\" as any;" > server/build.ts
+cp tsconfig.oss.json tsconfig.json
+mkdir -p dist
+$STD npm run next:build
+$STD node esbuild.mjs -e server/index.ts -o dist/server.mjs -b $BUILD
+$STD node esbuild.mjs -e server/setup/migrationsSqlite.ts -o dist/migrations.mjs
+$STD npm run build:cli
+cp -R .next/standalone ./
+
+cat <<EOF >/usr/local/bin/pangctl
+#!/bin/sh
+cd /opt/pangolin
+./dist/cli.mjs "$@"
+EOF
+chmod +x /usr/local/bin/pangctl ./dist/cli.mjs
+cp server/db/names.json ./dist/names.json
+mkdir -p /var/config
+
+cat <<EOF >/opt/pangolin/config/config.yml
+app:
+  dashboard_url: http://$IP_ADDR:3002
+  log_level: debug
+
+domains:
+  domain1:
+    base_domain: example.com
+
+server:
+  secret: $SECRET_KEY
+
+gerbil:
+  base_endpoint: example.com
+
+orgs:
+  block_size: 24
+  subnet_group: 100.90.137.0/20
+
+flags:
+  require_email_verification: false
+  disable_signup_without_invite: true
+  disable_user_create_org: true
+  allow_raw_resources: true
+  enable_integration_api: true
+  enable_clients: true
+EOF
+$STD npm run db:sqlite:generate
+$STD npm run db:sqlite:push
+
+. /etc/os-release
+if [ "$VERSION_CODENAME" = "trixie" ]; then
+  echo "net.ipv4.ip_forward=1" >>/etc/sysctl.d/sysctl.conf
+  $STD sysctl -p /etc/sysctl.d/sysctl.conf
+else
+  echo "net.ipv4.ip_forward=1" >>/etc/sysctl.conf
+  $STD sysctl -p /etc/sysctl.conf
+fi
+msg_ok "Setup Pangolin"
+
+msg_info "Creating Services"
+cat <<EOF >/etc/systemd/system/pangolin.service
+[Unit]
+Description=Pangolin Service
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/pangolin
+ExecStart=/usr/bin/npm start
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now pangolin
+
+cat <<EOF >/etc/systemd/system/gerbil.service
+[Unit]
+Description=Gerbil Service
+After=network.target
+Requires=pangolin.service
+
+[Service]
+Type=simple
+User=root
+ExecStart=/usr/bin/gerbil --reachableAt=http://$IP_ADDR:3004 --generateAndSaveKeyTo=/var/config/key --remoteConfig=http://$IP_ADDR:3001/api/v1/
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now gerbil
+msg_ok "Created Services"
+
+motd_ssh
+customize
+
+msg_info "Cleaning up"
+$STD apt -y autoremove
+$STD apt -y autoclean
+$STD apt -y clean
+msg_ok "Cleaned"