Merge develop and refresh the OCI validation summary

2026-11-04 20:02:07 +00:00 · 2026-11-03 18:05:19 +01:00
parent 07f7f9a6a1 7ec022af81
commit 79c0f268fd
30 changed files with 3929 additions and 83 deletions
@@ -25,6 +25,11 @@ on:
 permissions:
  contents: read

+# A newer push to the same branch or pull request replaces the run in progress.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
  check:
    runs-on: ubuntu-latest
@@ -112,6 +112,11 @@ on:
 permissions:
  contents: read

+# A newer push to the same branch or pull request replaces the run in progress.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
  apprise-services:
    runs-on: ubuntu-latest
@@ -51,6 +51,11 @@ on:
 permissions:
  contents: read

+# A newer push to the same branch or pull request replaces the run in progress.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
  # Preserve this check ID for existing branch protection rules. This suite
  # includes menu, download and scheduler regressions as well as i18n tests.
@@ -57,6 +57,11 @@ on:
 permissions:
  contents: read

+# A newer push to the same branch or pull request replaces the run in progress.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
  offline-python:
    runs-on: ubuntu-latest
@@ -256,6 +256,7 @@
  "Acceleration for llama.cpp": "Beschleunigung für llama.cpp",
  "Accept routes from other nodes?": "Routen von anderen Knoten akzeptieren?",
  "Accept this host monitoring profile?": "Akzeptieren Sie dieses Host Monitoring Profil?",
+  "Access Movistar and O2 Cloud from WebDAV clients and backup tools.": "Zugriff auf die Movistar- und O2-Cloud über WebDAV-Clients und Backup-Werkzeuge.",
  "Access Scope:": "Zugriffsbereich:",
  "Access bridge": "Zugangsbrücke",
  "Access bridge for Immich": "Access Bridge für Immich",
@@ -410,6 +411,7 @@
  "After the reboot, you will only be able to access the Proxmox host via:": "Nach dem Neustart können Sie nur noch auf den Proxmox-Host zugreifen über:",
  "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Starten Sie nach diesem Wechsel von LXC → VM den Host neu, damit der neue Bindungsstatus sauber angewendet wird.",
  "Agentless monitoring and observability platform.": "Agentenlose Plattform für Monitoring und Observability.",
+  "AirDC++ administrator": "AirDC++-Administrator",
  "Airsonic Advanced web interface": "Airsonic Advanced Web-Schnittstelle",
  "Airsonic-advanced is a free, web-based media streamer, providing ubiquitious access to your music. Use it to share your music with friends, or to listen to your own music while at work. You can stream to multiple players simultaneously, for instance to one player in your kitchen and another in your living room.": "Airsonic-advanced ist ein kostenloser, webbasierter Medienstreamer, der ubiquitious Zugang zu Ihrer Musik bietet. Verwenden Sie es, um Ihre Musik mit Freunden zu teilen oder Ihre eigene Musik während der Arbeit zu hören. Sie können zu mehreren Spielern gleichzeitig streamen, zum Beispiel zu einem Spieler in Ihrer Küche und einem anderen in Ihrem Wohnzimmer.",
  "Aliases added to .bashrc": "Aliase wurden zu .bashrc hinzugefügt",
@@ -603,6 +605,9 @@
  "Audit socket disabled or not required": "Audit-Socket deaktiviert oder nicht erforderlich",
  "Auth key is required.": "Authentifizierungsschlüssel ist erforderlich.",
  "Auth:": "Authentifizierung:",
+  "Authelia Web UI": "Authelia Web-Benutzeroberfläche",
+  "Authelia administrator": "Authelia-Administrator",
+  "Authelia session cookie domain for this portal (for example example.com)": "Authelia Sitzungscookie-Domäne für dieses Portal (z. B. example.com)",
  "Authentication": "Authentifizierung",
  "Authentication & Security": "Authentifizierung und Sicherheit",
  "Authentication Error": "Authentifizierungsfehler",
@@ -642,6 +647,7 @@
  "Available PVE Version": "Verfügbare PVE-Version",
  "Available Shares:": "Verfügbare Aktien:",
  "Available action": "Verfügbare Aktion",
+  "Available applications: {count}": "Verfügbare Anwendungen: {count}",
  "Available archives:": "Verfügbare Archive:",
  "Available disks detected.": "Verfügbare Festplatten erkannt.",
  "Available host backups:": "Verfügbare Host-Backups:",
@@ -873,6 +879,7 @@
  "Cannot write the image archive to {storage}. Check storage access and mount status.": "Das Bildarchiv kann nicht in {storage} geschrieben werden. Überprüfen Sie den Speicherzugriff und den Bereitstellungsstatus.",
  "Capabilities cannot be kept and all dropped at the same time": "Fähigkeiten können nicht gehalten werden und alle gleichzeitig fallen gelassen werden",
  "Catalog options": "Katalogoptionen",
+  "Catalog refresh unavailable; using the local catalog.": "Der Katalog konnte nicht aktualisiert werden; der lokale Katalog wird verwendet.",
  "Category": "Kategorie",
  "Caution: Maximum mode generates more heat.": "Achtung: Im Maximalmodus entsteht mehr Wärme.",
  "Central server for file and image backups.": "Zentraler Server für Datei- und Bildsicherungen.",
@@ -1927,6 +1934,7 @@
  "Dgraph": "Dgraph",
  "Diff: current system vs backup (--- system  +++ backup)": "Unterschied: aktuelles System vs. Backup (--- System +++ Backup)",
  "Different host. Backup from:": "Anderer Gastgeber. Backup von:",
+  "Direct Connect file sharing with a web interface": "Direct-Connect-Dateifreigabe mit Weboberfläche",
  "Direct conversion completed for container": "Direkte Konvertierung für Container abgeschlossen",
  "Directory Exists": "Verzeichnis existiert",
  "Directory Not Empty": "Verzeichnis nicht leer",
@@ -4435,6 +4443,7 @@
  "New Search": "Neue Suche",
  "New VM:": "Neue VM:",
  "New Virtual Machine": "Neue virtuelle Maschine",
+  "New applications since your last visit: {count}": "Neue Anwendungen seit Ihrem letzten Besuch: {count}",
  "New backup job": "Neuer Sicherungsauftrag",
  "New backups on this host will be unencrypted until a new keyfile is set up.": "Neue Backups auf diesem Host werden unverschlüsselt sein, bis eine neue Schlüsseldatei eingerichtet wird.",
  "New image compatible:": "Neues Bild kompatibel:",
@@ -4897,6 +4906,7 @@
  "Open the page of an application in the menu": "Die Seite einer Anwendung im Menü öffnen",
  "Open the web address and create the first account: the daemon registers by itself and starts the first scan.": "Öffne die Webadresse und erstelle das erste Konto: Der Daemon registriert sich selbst und startet den ersten Scan.",
  "Open the web address and create the password of the akadmin user in the first-run setup.": "Öffnen Sie die Webadresse und erstellen Sie im ersten Setup das Passwort des akadmin-Benutzers.",
+  "Open the web dashboard and link your Movistar/O2 account using its SMS flow.": "Öffnen Sie das Web-Dashboard und verknüpfen Sie Ihr Movistar/O2-Konto über die SMS-Bestätigung.",
  "Open-source AI-powered coding assistant": "Open-Source AI-powered Coding Assistant",
  "Open-source UI for building and debugging multi-agent and RAG applications": "Open-Source-Benutzeroberfläche zum Erstellen und Debuggen von Multi-Agenten- und RAG-Anwendungen",
  "Open-source in-memory data store.": "Open-Source-Datenspeicher im Arbeitsspeicher.",
@@ -5396,6 +5406,7 @@
  "Proxmox web interface: Datacenter > Storage > Add > ZFS": "Proxmox-Weboberfläche: Datencenter > Speicher > Hinzufügen > ZFS",
  "Proxmox web interface: Datacenter > Storage > Add > iSCSI": "Proxmox-Weboberfläche: Rechenzentrum > Speicher > Hinzufügen > iSCSI",
  "Proxy address to reach the API (optional)": "Proxy-Adresse zum Erreichen der API (optional)",
+  "Public HTTPS URL used to open this Authelia portal (for example https://auth.example.com)": "Öffentliche HTTPS-URL, die zum Öffnen dieses Authelia-Portals verwendet wird (zum Beispiel https://auth.example.com)",
  "Public UDP port clients connect to": "Öffentliche UDP Port Clients verbinden sich mit",
  "Public UDP port peers connect to": "Öffentliche UDP-Port Peers verbinden sich mit",
  "Public URL of phpMyAdmin when it is served behind a reverse proxy": "Öffentliche URL von phpMyAdmin, wenn sie hinter einem Reverse-Proxy bereitgestellt wird",
@@ -5561,6 +5572,7 @@
  "Recursive and authoritative DNS server.": "Rekursiver und autoritativer DNS-Server.",
  "Redmine": "Redmine",
  "Refresh APT index and verify repositories:": "APT-Index aktualisieren und Repositorys überprüfen:",
+  "Refresh catalog": "Katalog aktualisieren",
  "Refresh the configured APT repositories and review the PBS package upgrade? Repository files will be preserved.": "Die konfigurierten APT-Repositories aktualisieren und die PBS-Paketaktualisierung prüfen? Repository-Dateien bleiben erhalten.",
  "Refresh the index from the image sources": "Den Index aus den Image-Quellen aktualisieren",
  "Refresh token of the connector, from the Twingate admin console": "Aktualisierungstoken des Connectors aus der Twingate-Verwaltungskonsole",
@@ -5568,6 +5580,7 @@
  "Refresh your browser to see changes (server restart may be required)": "Aktualisieren Sie Ihren Browser, um Änderungen zu sehen (möglicherweise ist ein Neustart des Servers erforderlich).",
  "Refreshing apt cache...": "Apt-Cache wird aktualisiert...",
  "Refreshing the NVIDIA runtime...": "Erfrischung der NVIDIA Runtime...",
+  "Refreshing the application catalog...": "Anwendungskatalog wird aktualisiert...",
  "Refusing an unexpected rootfs path:": "Ablehnung eines unerwarteten Rootfs-Pfades:",
  "Regenerate the catalog templates": "Die Katalogvorlagen neu erstellen",
  "Regenerate the template of one application": "Die Vorlage einer Anwendung neu erstellen",
@@ -6453,6 +6466,7 @@
  "Simple and easy to use DDNS": "Einfach und einfach zu bedienen DDNS",
  "Simple self-hosted file sharing.": "Einfacher, selbst gehosteter Dateiaustausch.",
  "Single GPU Warning": "Warnung vor einer einzelnen GPU",
+  "Single sign-on and multi-factor authentication": "Single Sign-On und Multi-Faktor-Authentifizierung",
  "Single target found — selected automatically:": "Einzelnes Ziel gefunden – automatisch ausgewählt:",
  "Single-node log storage and query UI.": "Logspeicher mit Abfrageoberfläche für einen einzelnen Knoten.",
  "Single-node observability database for metrics, logs and traces.": "Einzelknoten-Datenbank für Metriken, Protokolle und Traces.",
@@ -7858,6 +7872,7 @@
  "Update the whole stack?": "Aktualisieren Sie den gesamten Stack?",
  "Update, modify or recreate one installed OCI instance": "Eine installierte OCI-Instanz aktualisieren, ändern oder neu erstellen",
  "Updated": "Aktualisiert",
+  "Updated recipes since your last visit: {count}": "Aktualisierte Rezepte seit Ihrem letzten Besuch: {count}",
  "Updated sharedfiles group to GID: 101000": "Sharedfiles-Gruppe auf GID aktualisiert: 101000",
  "Updated stack checked": "Aktualisierter Stapel geprüft",
  "Updated:": "Aktualisiert:",
@@ -8202,12 +8217,17 @@
  "Web access": "Webzugang",
  "Web address of the AdGuard Home that receives the settings (e.g. http://192.168.1.3)": "Webadresse des AdGuard Home, der die Einstellungen erhält (z. B. http://192.168.1.3)",
  "Web address of the main AdGuard Home, whose settings are copied (e.g. http://192.168.1.2)": "Webadresse des AdGuard Home, dessen Einstellungen kopiert sind (z. B. http://192.168.1.2)",
+  "Web dashboard": "Web-Dashboard",
+  "Web dashboard and WebDAV": "Web-Dashboard und WebDAV",
  "Web interface": "Weboberfläche",
  "Web interface for Borg Backup repositories and jobs.": "Weboberfläche für Borg-Backup-Repositories und -Jobs.",
  "Web interface for managing 3D printers.": "Weboberfläche zur Verwaltung von 3D-Druckern.",
  "Web interface to manage devices running Tasmota firmware.": "Web-Schnittstelle zur Verwaltung von Geräten mit Tasmota-Firmware.",
  "Web reverse proxy with an administration interface.": "Web-Reverse-Proxy mit Administrationsoberfläche.",
  "WebCord can be summarized as a pack of security and privacy hardenings, Discord features reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, internal pages and wrapped https://discord.com page, designed to conform with ToS as much as it is possible (or hide the changes that might violate it from Discord's eyes).": "WebCord kann als ein Paket von Sicherheits- und Datenschutz-Härtungen, Discord-Features-Reimplementierungen, Electron / Chromium / Discord-Bugs-Workarounds, Stylesheets, interne Seiten und verpackte https://discord.com-Seite zusammengefasst werden, die so weit wie möglich mit ToS konform sind (oder die Änderungen, die es verletzen könnten, vor Discords Augen verbergen).",
+  "WebDAV": "WebDAV",
+  "WebDAV and dashboard password (leave empty to generate)": "Passwort für WebDAV und Dashboard (leer = generiert)",
+  "WebDAV is available on container port 8080. Account linking is required before cloud file operations.": "WebDAV ist auf Port 8080 des Containers verfügbar. Vor Dateioperationen in der Cloud muss das Konto verknüpft werden.",
  "Webgrabplus is a multi-site incremental xmltv epg grabber. It collects tv-program guide data from selected tvguide sites for your favourite channels.": "Webgrabplus ist ein multi-site inkrementeller xmltv epg grabber. Es sammelt tv-programm-guide-daten von ausgewählten tvguide-seiten für ihre lieblingskanäle.",
  "Webservers & Proxies": "Webserver und Proxys",
  "Website": "Webseite",
@@ -8967,11 +8987,5 @@
  "⚠ Disk data will NOT be erased.": "⚠ Festplattendaten werden NICHT gelöscht.",
  "⚠ Disk will be unmounted and removed from /etc/fstab.": "⚠ Die Festplatte wird ausgehängt und aus /etc/fstab entfernt.",
  "⚠ The /etc/fstab entry will be removed.": "⚠ Der /etc/fstab-Eintrag wird entfernt.",
-  "⚠ The disk will be unmounted.": "⚠ Die Festplatte wird ausgehängt.",
-  "Available applications: {count}": "Verfügbare Anwendungen: {count}",
-  "New applications since your last visit: {count}": "Neue Anwendungen seit Ihrem letzten Besuch: {count}",
-  "Updated recipes since your last visit: {count}": "Aktualisierte Rezepte seit Ihrem letzten Besuch: {count}",
-  "Refreshing the application catalog...": "Anwendungskatalog wird aktualisiert...",
-  "Catalog refresh unavailable; using the local catalog.": "Der Katalog konnte nicht aktualisiert werden; der lokale Katalog wird verwendet.",
-  "Refresh catalog": "Katalog aktualisieren"
+  "⚠ The disk will be unmounted.": "⚠ Die Festplatte wird ausgehängt."
 }
@@ -255,6 +255,7 @@
  "Acceleration for llama.cpp": "Aceleración para llama.cpp",
  "Accept routes from other nodes?": "¿Aceptar rutas de otros nodos?",
  "Accept this host monitoring profile?": "¿Aceptar este perfil de monitorización del host?",
+  "Access Movistar and O2 Cloud from WebDAV clients and backup tools.": "Accede a la nube de Movistar y O2 desde clientes WebDAV y herramientas de backup.",
  "Access Scope:": "Ámbito de acceso:",
  "Access bridge": "Puente de acceso",
  "Access bridge for Immich": "Puente de acceso para Immich",
@@ -408,6 +409,7 @@
  "After the reboot, you will only be able to access the Proxmox host via:": "Después del reinicio, solo podrá acceder al host Proxmox a través de:",
  "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Después de este cambio LXC → VM, reinicia el host para que el nuevo estado de enlace se aplique limpiamente.",
  "Agentless monitoring and observability platform.": "Plataforma de monitorización y observabilidad sin agentes.",
+  "AirDC++ administrator": "Administrador de AirDC++",
  "Airsonic Advanced web interface": "Interfaz web de Airsonic Advanced",
  "Airsonic-advanced is a free, web-based media streamer, providing ubiquitious access to your music. Use it to share your music with friends, or to listen to your own music while at work. You can stream to multiple players simultaneously, for instance to one player in your kitchen and another in your living room.": "Airsonic-advanced es un servidor de streaming multimedia gratuito y basado en web que da acceso a tu música desde cualquier lugar. Úsalo para compartir tu música con amigos o para escuchar la tuya en el trabajo. Puede transmitir a varios reproductores a la vez, por ejemplo a uno en la cocina y a otro en el salón.",
  "Aliases added to .bashrc": "Alias añadidos a .bashrc",
@@ -601,6 +603,9 @@
  "Audit socket disabled or not required": "Socket de auditoría deshabilitado o no requerido",
  "Auth key is required.": "Se requiere clave de autenticación.",
  "Auth:": "Autenticación:",
+  "Authelia Web UI": "Authelia Interfaz de usuario web",
+  "Authelia administrator": "administrador Authelia",
+  "Authelia session cookie domain for this portal (for example example.com)": "dominio de cookie de sesión Authelia para este portal (por ejemplo, ejemplo.com)",
  "Authentication": "Autenticación",
  "Authentication & Security": "Authentication & Security",
  "Authentication Error": "Error de autenticación",
@@ -640,6 +645,7 @@
  "Available PVE Version": "Versión PVE disponible",
  "Available Shares:": "Recursos compartidos disponibles:",
  "Available action": "Acción disponible",
+  "Available applications: {count}": "Aplicaciones disponibles: {count}",
  "Available archives:": "Archivos disponibles:",
  "Available disks detected.": "Discos disponibles detectados.",
  "Available host backups:": "Backups de host disponibles:",
@@ -872,6 +878,7 @@
  "Cannot write the image archive to {storage}. Check storage access and mount status.": "No se puede escribir el archivo de la imagen en {storage}. Comprueba el acceso al almacenamiento y que esté montado.",
  "Capabilities cannot be kept and all dropped at the same time": "No se pueden mantener las capacidades y todas se disminuyen al mismo tiempo",
  "Catalog options": "Opciones del catálogo",
+  "Catalog refresh unavailable; using the local catalog.": "No se pudo actualizar el catálogo; se está usando la copia local.",
  "Category": "Categoría",
  "Caution: Maximum mode generates more heat.": "Precaución: el modo máximo genera más calor.",
  "Central server for file and image backups.": "Servidor central para copias de seguridad de archivos e imágenes.",
@@ -1925,6 +1932,7 @@
  "Dgraph": "Dgraph",
  "Diff: current system vs backup (--- system  +++ backup)": "Diferencias: sistema actual frente al backup (--- sistema  +++ backup)",
  "Different host. Backup from:": "Host diferente. Backup procedente de:",
+  "Direct Connect file sharing with a web interface": "Intercambio de archivos Direct Connect con interfaz web",
  "Direct conversion completed for container": "Conversión directa completada para el contenedor",
  "Directory Exists": "El directorio existe",
  "Directory Not Empty": "Directorio no vacío",
@@ -4430,6 +4438,7 @@
  "New Search": "Nueva búsqueda",
  "New VM:": "Nueva máquina virtual:",
  "New Virtual Machine": "Nueva máquina virtual",
+  "New applications since your last visit: {count}": "Aplicaciones nuevas desde tu última visita: {count}",
  "New backup job": "Nuevo trabajo de backup",
  "New backups on this host will be unencrypted until a new keyfile is set up.": "Los nuevos backups de este host no se cifrarán hasta que se configure un nuevo archivo de claves.",
  "New image compatible:": "Nueva imagen compatible:",
@@ -4888,6 +4897,7 @@
  "Open the page of an application in the menu": "Abrir la página de una aplicación en el menú",
  "Open the web address and create the first account: the daemon registers by itself and starts the first scan.": "Abre la dirección web y crea la primera cuenta: el daemon se registra solo y empieza el primer escaneo.",
  "Open the web address and create the password of the akadmin user in the first-run setup.": "abra la dirección web y cree la contraseña del usuario akaadmin en la configuración de primera ejecución.",
+  "Open the web dashboard and link your Movistar/O2 account using its SMS flow.": "Abre el panel web y vincula tu cuenta de Movistar/O2 con su verificación por SMS.",
  "Open-source AI-powered coding assistant": "Asistente de programación con IA de código abierto",
  "Open-source UI for building and debugging multi-agent and RAG applications": "Interfaz de código abierto para crear y depurar aplicaciones multiagente y RAG",
  "Open-source in-memory data store.": "Almacén de datos en memoria de código abierto.",
@@ -5386,6 +5396,7 @@
  "Proxmox web interface: Datacenter > Storage > Add > ZFS": "Interfaz web de Proxmox: Datacenter > Storage > Add > ZFS",
  "Proxmox web interface: Datacenter > Storage > Add > iSCSI": "Interfaz web de Proxmox: Datacenter > Storage > Add > iSCSI",
  "Proxy address to reach the API (optional)": "Dirección del proxy para llegar a la API (opcional)",
+  "Public HTTPS URL used to open this Authelia portal (for example https://auth.example.com)": "URL HTTPS pública utilizada para abrir este portal Authelia (por ejemplo, https://auth.example.com)",
  "Public UDP port clients connect to": "Puerto UDP público al que se conectan los clientes",
  "Public UDP port peers connect to": "Puerto UDP público al que se conectan los peers",
  "Public URL of phpMyAdmin when it is served behind a reverse proxy": "URL pública de phpMyAdmin cuando se sirve detrás de un proxy inverso",
@@ -5544,6 +5555,7 @@
  "Recursive and authoritative DNS server.": "Servidor DNS recursivo y autoritativo.",
  "Redmine": "Redmine",
  "Refresh APT index and verify repositories:": "Actualizar el índice APT y verificar los repositorios:",
+  "Refresh catalog": "Actualizar catálogo",
  "Refresh the configured APT repositories and review the PBS package upgrade? Repository files will be preserved.": "¿Actualizar los índices de los repositorios de APT configurados y revisar la actualización de paquetes de PBS? Se conservarán los archivos de los repositorios.",
  "Refresh the index from the image sources": "Actualizar el índice desde las fuentes de imágenes",
  "Refresh token of the connector, from the Twingate admin console": "Token de renovación del conector, de la consola de administración de Twingate",
@@ -5551,6 +5563,7 @@
  "Refresh your browser to see changes (server restart may be required)": "Actualiza tu navegador para ver los cambios (es posible que sea necesario reiniciar el servidor)",
  "Refreshing apt cache...": "Actualizando caché de apt...",
  "Refreshing the NVIDIA runtime...": "Refrescando el tiempo de ejecución de NVIDIA...",
+  "Refreshing the application catalog...": "Actualizando el catálogo de aplicaciones...",
  "Refusing an unexpected rootfs path:": "Refusing an inesperado rootfs path:",
  "Regenerate the catalog templates": "Regenerar las plantillas del catálogo",
  "Regenerate the template of one application": "Regenerar la plantilla de una aplicación",
@@ -6436,6 +6449,7 @@
  "Simple and easy to use DDNS": "DDNS simple y fácil de usar",
  "Simple self-hosted file sharing.": "Servicio sencillo y autoalojado para compartir archivos.",
  "Single GPU Warning": "Advertencia de GPU única",
+  "Single sign-on and multi-factor authentication": "inicio de sesión único y autenticación multifactor",
  "Single target found — selected automatically:": "Destino único encontrado: seleccionado automáticamente:",
  "Single-node log storage and query UI.": "Almacenamiento de logs para un solo nodo con interfaz de consulta.",
  "Single-node observability database for metrics, logs and traces.": "Base de datos de observabilidad de un solo nodo para métricas, registros y trazas.",
@@ -7829,6 +7843,7 @@
  "Update the whole stack?": "¿Actualizar toda la pila?",
  "Update, modify or recreate one installed OCI instance": "Actualizar, modificar o recrear una instancia OCI instalada",
  "Updated": "Actualizado",
+  "Updated recipes since your last visit: {count}": "Recetas actualizadas desde tu última visita: {count}",
  "Updated sharedfiles group to GID: 101000": "Grupo de archivos compartidos actualizado a GID: 101000",
  "Updated stack checked": "Pila actualizada comprobada",
  "Updated:": "Actualizado:",
@@ -8175,12 +8190,17 @@
  "Web access": "Acceso web",
  "Web address of the AdGuard Home that receives the settings (e.g. http://192.168.1.3)": "Dirección web del AdGuard Home que recibe los ajustes (por ejemplo, http://192.168.1.3)",
  "Web address of the main AdGuard Home, whose settings are copied (e.g. http://192.168.1.2)": "Dirección web del AdGuard Home principal, cuyos ajustes se copian (por ejemplo, http://192.168.1.2)",
+  "Web dashboard": "Panel web",
+  "Web dashboard and WebDAV": "Panel web y WebDAV",
  "Web interface": "interfaz web",
  "Web interface for Borg Backup repositories and jobs.": "Interfaz web para gestionar repositorios y tareas de Borg Backup.",
  "Web interface for managing 3D printers.": "Interfaz web para gestionar impresoras 3D.",
  "Web interface to manage devices running Tasmota firmware.": "Interfaz web para gestionar dispositivos con firmware Tasmota.",
  "Web reverse proxy with an administration interface.": "Proxy inverso web con interfaz de administración.",
  "WebCord can be summarized as a pack of security and privacy hardenings, Discord features reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, internal pages and wrapped https://discord.com page, designed to conform with ToS as much as it is possible (or hide the changes that might violate it from Discord's eyes).": "WebCord puede resumirse como un conjunto de medidas de hardening de seguridad y privacidad, reimplementaciones de funciones de Discord, soluciones a fallos de Electron / Chromium / Discord, hojas de estilo, páginas internas y la página https://discord.com encapsulada, diseñado para cumplir los ToS en lo posible (u ocultar a Discord los cambios que podrían incumplirlos).",
+  "WebDAV": "WebDAV",
+  "WebDAV and dashboard password (leave empty to generate)": "Contraseña de WebDAV y del panel (vacío = generada)",
+  "WebDAV is available on container port 8080. Account linking is required before cloud file operations.": "WebDAV está disponible en el puerto 8080 del contenedor. Hay que vincular la cuenta antes de trabajar con los archivos de la nube.",
  "Webgrabplus is a multi-site incremental xmltv epg grabber. It collects tv-program guide data from selected tvguide sites for your favourite channels.": "Webgrabplus es un capturador incremental de EPG xmltv para múltiples sitios. Recoge los datos de la guía de programación de los sitios de guías de TV seleccionados para tus canales favoritos.",
  "Webservers & Proxies": "Webservers & Proxies",
  "Website": "Sitio web",
@@ -8937,11 +8957,5 @@
  "⚠ Disk data will NOT be erased.": "⚠ Los datos del disco NO se borrarán.",
  "⚠ Disk will be unmounted and removed from /etc/fstab.": "⚠ El disco se desmontará y se eliminará de /etc/fstab.",
  "⚠ The /etc/fstab entry will be removed.": "⚠ Se eliminará la entrada /etc/fstab.",
-  "⚠ The disk will be unmounted.": "⚠ El disco se desmontará.",
-  "Available applications: {count}": "Aplicaciones disponibles: {count}",
-  "New applications since your last visit: {count}": "Aplicaciones nuevas desde tu última visita: {count}",
-  "Updated recipes since your last visit: {count}": "Recetas actualizadas desde tu última visita: {count}",
-  "Refreshing the application catalog...": "Actualizando el catálogo de aplicaciones...",
-  "Catalog refresh unavailable; using the local catalog.": "No se pudo actualizar el catálogo; se está usando la copia local.",
-  "Refresh catalog": "Actualizar catálogo"
+  "⚠ The disk will be unmounted.": "⚠ El disco se desmontará."
 }
@@ -256,6 +256,7 @@
  "Acceleration for llama.cpp": "Accélération pour llama.cpp",
  "Accept routes from other nodes?": "Accepter les routes d'autres nœuds ?",
  "Accept this host monitoring profile?": "Accepter ce profil de surveillance de l'hôte?",
+  "Access Movistar and O2 Cloud from WebDAV clients and backup tools.": "Accédez au cloud Movistar et O2 depuis des clients WebDAV et des outils de sauvegarde.",
  "Access Scope:": "Portée d'accès :",
  "Access bridge": "Pont d'accès",
  "Access bridge for Immich": "Pont d'accès pour Immich",
@@ -410,6 +411,7 @@
  "After the reboot, you will only be able to access the Proxmox host via:": "Après le redémarrage, vous ne pourrez accéder à l'hôte Proxmox que via :",
  "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Après ce commutateur LXC → VM, redémarrez l'hôte afin que le nouvel état de liaison soit appliqué proprement.",
  "Agentless monitoring and observability platform.": "Plateforme de supervision et d’observabilité sans agent.",
+  "AirDC++ administrator": "Administrateur AirDC++",
  "Airsonic Advanced web interface": "Interface web Airsonic Advanced",
  "Airsonic-advanced is a free, web-based media streamer, providing ubiquitious access to your music. Use it to share your music with friends, or to listen to your own music while at work. You can stream to multiple players simultaneously, for instance to one player in your kitchen and another in your living room.": "Airsonic-Advanced est un flux multimédia gratuit, basé sur le web, offrant un accès ubiquitious à votre musique. Utilisez-le pour partager votre musique avec des amis, ou pour écouter votre propre musique au travail. Vous pouvez diffuser simultanément vers plusieurs joueurs, par exemple vers un joueur dans votre cuisine et un autre dans votre salon.",
  "Aliases added to .bashrc": "Alias ajoutés à .bashrc",
@@ -603,6 +605,9 @@
  "Audit socket disabled or not required": "Socket d'audit désactivé ou non requis",
  "Auth key is required.": "La clé d'authentification est requise.",
  "Auth:": "Authentification :",
+  "Authelia Web UI": "interface utilisateur Web Authelia",
+  "Authelia administrator": "Administrateur Authelia",
+  "Authelia session cookie domain for this portal (for example example.com)": "domaine de cookie de session Authelia pour ce portail (par exemple exemple.com)",
  "Authentication": "Authentification",
  "Authentication & Security": "Authentification et sécurité",
  "Authentication Error": "Erreur d'authentification",
@@ -642,6 +647,7 @@
  "Available PVE Version": "Version PVE disponible",
  "Available Shares:": "Actions disponibles :",
  "Available action": "Action disponible",
+  "Available applications: {count}": "Applications disponibles : {count}",
  "Available archives:": "Archives disponibles :",
  "Available disks detected.": "Disques disponibles détectés.",
  "Available host backups:": "Sauvegardes d'hôte disponibles :",
@@ -873,6 +879,7 @@
  "Cannot write the image archive to {storage}. Check storage access and mount status.": "Impossible d'écrire l'archive d'images sur {storage}. Vérifiez l'accès au stockage et l'état du montage.",
  "Capabilities cannot be kept and all dropped at the same time": "Les capacités ne peuvent être conservées et toutes abandonnées en même temps",
  "Catalog options": "Options du catalogue",
+  "Catalog refresh unavailable; using the local catalog.": "Impossible de mettre à jour le catalogue ; le catalogue local est utilisé.",
  "Category": "Catégorie",
  "Caution: Maximum mode generates more heat.": "Attention : le mode maximum génère plus de chaleur.",
  "Central server for file and image backups.": "Serveur central pour les sauvegardes de fichiers et d’images.",
@@ -1927,6 +1934,7 @@
  "Dgraph": "Dgraph",
  "Diff: current system vs backup (--- system  +++ backup)": "Diff : système actuel vs sauvegarde (--- système +++ sauvegarde)",
  "Different host. Backup from:": "Hôte différent. Sauvegarde depuis :",
+  "Direct Connect file sharing with a web interface": "Partage de fichiers Direct Connect avec une interface web",
  "Direct conversion completed for container": "Conversion directe terminée pour le conteneur",
  "Directory Exists": "Le répertoire existe",
  "Directory Not Empty": "Répertoire non vide",
@@ -4435,6 +4443,7 @@
  "New Search": "Nouvelle recherche",
  "New VM:": "Nouvelle VM :",
  "New Virtual Machine": "Nouvelle machine virtuelle",
+  "New applications since your last visit: {count}": "Nouvelles applications depuis votre dernière visite : {count}",
  "New backup job": "Nouveau travail de sauvegarde",
  "New backups on this host will be unencrypted until a new keyfile is set up.": "Les nouvelles sauvegardes sur cet hôte ne seront pas chiffrées jusqu'à ce qu'un nouveau fichier de clés soit configuré.",
  "New image compatible:": "Nouvelle image compatible & #160;:",
@@ -4897,6 +4906,7 @@
  "Open the page of an application in the menu": "Ouvrir la page d'une application dans le menu",
  "Open the web address and create the first account: the daemon registers by itself and starts the first scan.": "Ouvrez l'adresse web et créez le premier compte : le daemon s'enregistre tout seul et lance la première analyse.",
  "Open the web address and create the password of the akadmin user in the first-run setup.": "ouvrez l'adresse Web et créez le mot de passe de l'utilisateur akadmin lors de la configuration de première exécution.",
+  "Open the web dashboard and link your Movistar/O2 account using its SMS flow.": "Ouvrez le tableau de bord web et liez votre compte Movistar/O2 avec sa vérification par SMS.",
  "Open-source AI-powered coding assistant": "Assistant de codage à source ouverte",
  "Open-source UI for building and debugging multi-agent and RAG applications": "UI open-source pour la construction et le débogage d'applications multi-agents et RAG",
  "Open-source in-memory data store.": "Magasin de données en mémoire libre.",
@@ -5396,6 +5406,7 @@
  "Proxmox web interface: Datacenter > Storage > Add > ZFS": "Interface web Proxmox : Datacenter > Stockage > Ajouter > ZFS",
  "Proxmox web interface: Datacenter > Storage > Add > iSCSI": "Interface Web Proxmox : Datacenter > Stockage > Ajouter > iSCSI",
  "Proxy address to reach the API (optional)": "Adresse proxy pour accéder à l'API (facultatif)",
+  "Public HTTPS URL used to open this Authelia portal (for example https://auth.example.com)": "URL HTTPS publique utilisée pour ouvrir ce portail Authelia (par exemple https://auth.example.com)",
  "Public UDP port clients connect to": "Les clients du port UDP public se connectent à",
  "Public UDP port peers connect to": "Les pairs du port UDP public se connectent à",
  "Public URL of phpMyAdmin when it is served behind a reverse proxy": "URL publique de phpMyAdmin quand elle est servie derrière un proxy inversé",
@@ -5561,6 +5572,7 @@
  "Recursive and authoritative DNS server.": "Serveur DNS récursif et faisant autorité.",
  "Redmine": "Redmine",
  "Refresh APT index and verify repositories:": "Actualisez l'index APT et vérifiez les référentiels :",
+  "Refresh catalog": "Actualiser le catalogue",
  "Refresh the configured APT repositories and review the PBS package upgrade? Repository files will be preserved.": "Actualiser les dépôts APT configurés et examiner la mise à niveau des paquets PBS ? Les fichiers des dépôts seront conservés.",
  "Refresh the index from the image sources": "Actualiser l'index à partir des sources d'images",
  "Refresh token of the connector, from the Twingate admin console": "Jeton d'actualisation du connecteur, depuis la console d'administration Twingate",
@@ -5568,6 +5580,7 @@
  "Refresh your browser to see changes (server restart may be required)": "Actualisez votre navigateur pour voir les modifications (un redémarrage du serveur peut être nécessaire)",
  "Refreshing apt cache...": "Actualisation du cache apt...",
  "Refreshing the NVIDIA runtime...": "Rafraîchir l'exécution NVIDIA...",
+  "Refreshing the application catalog...": "Mise à jour du catalogue des applications...",
  "Refusing an unexpected rootfs path:": "Refuser un chemin inattendu de roofs :",
  "Regenerate the catalog templates": "Régénérer les modèles du catalogue",
  "Regenerate the template of one application": "Régénérer le modèle d'une application",
@@ -6453,6 +6466,7 @@
  "Simple and easy to use DDNS": "Simple et facile à utiliser DDNS",
  "Simple self-hosted file sharing.": "Service simple et auto-hébergé de partage de fichiers.",
  "Single GPU Warning": "Avertissement sur un seul GPU",
+  "Single sign-on and multi-factor authentication": "authentification unique et authentification multifacteur",
  "Single target found — selected automatically:": "Cible unique trouvée — sélectionnée automatiquement :",
  "Single-node log storage and query UI.": "Stockage de journaux sur un nœud unique avec interface de requête.",
  "Single-node observability database for metrics, logs and traces.": "Base de données d’observabilité à nœud unique pour les métriques, les journaux et les traces.",
@@ -7857,6 +7871,7 @@
  "Update the whole stack?": "Mettre à jour toute la pile ?",
  "Update, modify or recreate one installed OCI instance": "Mettre à jour, modifier ou recréer une instance OCI installée",
  "Updated": "Mis à jour",
+  "Updated recipes since your last visit: {count}": "Recettes mises à jour depuis votre dernière visite : {count}",
  "Updated sharedfiles group to GID: 101000": "Groupe de fichiers partagés mis à jour vers GID : 101000",
  "Updated stack checked": "Correction de la pile",
  "Updated:": "Mise à jour :",
@@ -8201,12 +8216,17 @@
  "Web access": "Accès au Web",
  "Web address of the AdGuard Home that receives the settings (e.g. http://192.168.1.3)": "Adresse Web du AdGuard Home qui reçoit les paramètres (p. ex. http://192.168.1.3)",
  "Web address of the main AdGuard Home, whose settings are copied (e.g. http://192.168.1.2)": "Adresse Web du principal AdGuard Home, dont les paramètres sont copiés (par exemple http://192.168.1.2)",
+  "Web dashboard": "Tableau de bord web",
+  "Web dashboard and WebDAV": "Tableau de bord web et WebDAV",
  "Web interface": "interface Web",
  "Web interface for Borg Backup repositories and jobs.": "Interface web pour les dépôts et tâches Borg Backup.",
  "Web interface for managing 3D printers.": "Interface web de gestion des imprimantes 3D.",
  "Web interface to manage devices running Tasmota firmware.": "Interface Web pour gérer les appareils utilisant le firmware Tasmota.",
  "Web reverse proxy with an administration interface.": "Proxy inverse web doté d’une interface d’administration.",
  "WebCord can be summarized as a pack of security and privacy hardenings, Discord features reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, internal pages and wrapped https://discord.com page, designed to conform with ToS as much as it is possible (or hide the changes that might violate it from Discord's eyes).": "WebCord peut être résumé comme un paquet de durcissements de sécurité et de confidentialité, les fonctionnalités Discord réimplémentations, Electron / Chromium / Discord bugs workarounds, les feuilles de style, les pages internes et la page https://discord.com enveloppée, conçue pour se conformer à ToS autant qu'il est possible (ou cacher les changements qui pourraient la violer des yeux de Discord).",
+  "WebDAV": "WebDAV",
+  "WebDAV and dashboard password (leave empty to generate)": "Mot de passe WebDAV et du tableau de bord (vide = généré)",
+  "WebDAV is available on container port 8080. Account linking is required before cloud file operations.": "WebDAV est disponible sur le port 8080 du conteneur. Le compte doit être lié avant toute opération sur les fichiers du cloud.",
  "Webgrabplus is a multi-site incremental xmltv epg grabber. It collects tv-program guide data from selected tvguide sites for your favourite channels.": "Webgrabplus est un accrocheur différentiel multisite xmltv egg. Il recueille les données du guide TV-programme à partir de sites sélectionnés pour vos chaînes préférées.",
  "Webservers & Proxies": "Serveurs web et proxys",
  "Website": "Site web",
@@ -8966,11 +8986,5 @@
  "⚠ Disk data will NOT be erased.": "⚠ Les données du disque ne seront PAS effacées.",
  "⚠ Disk will be unmounted and removed from /etc/fstab.": "⚠ Le disque sera démonté et supprimé de /etc/fstab.",
  "⚠ The /etc/fstab entry will be removed.": "⚠ L'entrée /etc/fstab sera supprimée.",
-  "⚠ The disk will be unmounted.": "⚠ Le disque sera démonté.",
-  "Available applications: {count}": "Applications disponibles : {count}",
-  "New applications since your last visit: {count}": "Nouvelles applications depuis votre dernière visite : {count}",
-  "Updated recipes since your last visit: {count}": "Recettes mises à jour depuis votre dernière visite : {count}",
-  "Refreshing the application catalog...": "Mise à jour du catalogue des applications...",
-  "Catalog refresh unavailable; using the local catalog.": "Impossible de mettre à jour le catalogue ; le catalogue local est utilisé.",
-  "Refresh catalog": "Actualiser le catalogue"
+  "⚠ The disk will be unmounted.": "⚠ Le disque sera démonté."
 }
@@ -256,6 +256,7 @@
  "Acceleration for llama.cpp": "Accelerazione per llama.cpp",
  "Accept routes from other nodes?": "Accettare rotte da altri nodi?",
  "Accept this host monitoring profile?": "Accettare questo profilo di monitoraggio host?",
+  "Access Movistar and O2 Cloud from WebDAV clients and backup tools.": "Accedi al cloud di Movistar e O2 da client WebDAV e strumenti di backup.",
  "Access Scope:": "Ambito di accesso:",
  "Access bridge": "Bridge di accesso",
  "Access bridge for Immich": "Bridge di accesso per Immich",
@@ -410,6 +411,7 @@
  "After the reboot, you will only be able to access the Proxmox host via:": "Dopo il riavvio, potrai accedere all'host Proxmox solo tramite:",
  "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Dopo questo passaggio LXC → VM, riavviare l’host in modo che il nuovo stato di associazione venga applicato correttamente.",
  "Agentless monitoring and observability platform.": "Piattaforma di monitoraggio e osservabilità senza agent.",
+  "AirDC++ administrator": "Amministratore AirDC++",
  "Airsonic Advanced web interface": "Interfaccia web Airsonic Advanced",
  "Airsonic-advanced is a free, web-based media streamer, providing ubiquitious access to your music. Use it to share your music with friends, or to listen to your own music while at work. You can stream to multiple players simultaneously, for instance to one player in your kitchen and another in your living room.": "Airsonic-advanced è un servizio gratuito di streaming multimediale via web che permette di accedere alla propria musica ovunque. Puoi condividerla con gli amici o ascoltarla mentre lavori. Puoi riprodurla contemporaneamente su più dispositivi, per esempio in cucina e in soggiorno.",
  "Aliases added to .bashrc": "Alias aggiunti a .bashrc",
@@ -603,6 +605,9 @@
  "Audit socket disabled or not required": "Socket di audit disabilitato o non richiesto",
  "Auth key is required.": "È richiesta la chiave di autenticazione.",
  "Auth:": "Autenticazione:",
+  "Authelia Web UI": "interfaccia utente Web Authelia",
+  "Authelia administrator": "amministratore Authelia",
+  "Authelia session cookie domain for this portal (for example example.com)": "dominio del cookie di sessione Authelia per questo portale (ad esempio example.com)",
  "Authentication": "Autenticazione",
  "Authentication & Security": "Autenticazione e sicurezza",
  "Authentication Error": "Errore di autenticazione",
@@ -642,6 +647,7 @@
  "Available PVE Version": "Versione PVE disponibile",
  "Available Shares:": "Condivisioni disponibili:",
  "Available action": "Azione disponibile",
+  "Available applications: {count}": "Applicazioni disponibili: {count}",
  "Available archives:": "Archivi disponibili:",
  "Available disks detected.": "Rilevati dischi disponibili.",
  "Available host backups:": "Backup host disponibili:",
@@ -873,6 +879,7 @@
  "Cannot write the image archive to {storage}. Check storage access and mount status.": "Impossibile scrivere l'archivio dell'immagine su {storage}. Controlla l'accesso allo storage e lo stato di montaggio.",
  "Capabilities cannot be kept and all dropped at the same time": "Non è possibile conservare alcune capability e rimuoverle tutte contemporaneamente",
  "Catalog options": "Opzioni del catalogo",
+  "Catalog refresh unavailable; using the local catalog.": "Impossibile aggiornare il catalogo; viene usata la copia locale.",
  "Category": "Categoria",
  "Caution: Maximum mode generates more heat.": "Attenzione: la modalità massima genera più calore.",
  "Central server for file and image backups.": "Server centrale per il backup di file e immagini.",
@@ -1927,6 +1934,7 @@
  "Dgraph": "Dgraph",
  "Diff: current system vs backup (--- system  +++ backup)": "Differenza: sistema attuale vs backup (--- sistema +++ backup)",
  "Different host. Backup from:": "Host diverso. Backup da:",
+  "Direct Connect file sharing with a web interface": "Condivisione di file Direct Connect con interfaccia web",
  "Direct conversion completed for container": "Conversione diretta completata per il container",
  "Directory Exists": "Directory esistente",
  "Directory Not Empty": "Directory non vuota",
@@ -4435,6 +4443,7 @@
  "New Search": "Nuova ricerca",
  "New VM:": "Nuova VM:",
  "New Virtual Machine": "Nuova VM",
+  "New applications since your last visit: {count}": "Nuove applicazioni dalla tua ultima visita: {count}",
  "New backup job": "Nuova attività di backup",
  "New backups on this host will be unencrypted until a new keyfile is set up.": "I nuovi backup su questo host non saranno crittografati finché non verrà impostato un nuovo file di chiavi.",
  "New image compatible:": "Nuova immagine compatibile:",
@@ -4897,6 +4906,7 @@
  "Open the page of an application in the menu": "Apri la pagina di un'applicazione nel menu",
  "Open the web address and create the first account: the daemon registers by itself and starts the first scan.": "Apri l'indirizzo web e crea il primo account: il daemon si registra da solo e avvia la prima scansione.",
  "Open the web address and create the password of the akadmin user in the first-run setup.": "Apri l'indirizzo web e imposta la password dell'utente akadmin durante la configurazione iniziale.",
+  "Open the web dashboard and link your Movistar/O2 account using its SMS flow.": "Apri la dashboard web e collega il tuo account Movistar/O2 con la verifica tramite SMS.",
  "Open-source AI-powered coding assistant": "Assistente open source per la programmazione basato sull'IA",
  "Open-source UI for building and debugging multi-agent and RAG applications": "Interfaccia open source per creare ed eseguire il debug di applicazioni multiagente e RAG",
  "Open-source in-memory data store.": "Archivio dati in memoria open source.",
@@ -5396,6 +5406,7 @@
  "Proxmox web interface: Datacenter > Storage > Add > ZFS": "Interfaccia web Proxmox: Datacenter > Storage > Aggiungi > ZFS",
  "Proxmox web interface: Datacenter > Storage > Add > iSCSI": "Interfaccia web Proxmox: Datacenter > Storage > Aggiungi > iSCSI",
  "Proxy address to reach the API (optional)": "Indirizzo proxy per raggiungere l'API (facoltativo)",
+  "Public HTTPS URL used to open this Authelia portal (for example https://auth.example.com)": "URL HTTPS pubblico utilizzato per aprire questo portale Authelia (ad esempio https://auth.example.com)",
  "Public UDP port clients connect to": "Porta UDP pubblica a cui si connettono i client",
  "Public UDP port peers connect to": "Porta UDP pubblica a cui si connettono i peer",
  "Public URL of phpMyAdmin when it is served behind a reverse proxy": "URL pubblico di phpMyAdmin quando viene servito dietro un proxy inverso",
@@ -5561,6 +5572,7 @@
  "Recursive and authoritative DNS server.": "Server DNS ricorsivo e autorevole.",
  "Redmine": "Redmine",
  "Refresh APT index and verify repositories:": "Aggiorna l'indice APT e verifica i repository:",
+  "Refresh catalog": "Aggiorna catalogo",
  "Refresh the configured APT repositories and review the PBS package upgrade? Repository files will be preserved.": "Aggiornare gli indici dei repository APT configurati ed esaminare l'aggiornamento dei pacchetti PBS? I file dei repository verranno conservati.",
  "Refresh the index from the image sources": "Aggiorna l'indice dalle sorgenti delle immagini",
  "Refresh token of the connector, from the Twingate admin console": "Token di refresh del connettore, dalla console di amministrazione Twingate",
@@ -5568,6 +5580,7 @@
  "Refresh your browser to see changes (server restart may be required)": "Aggiorna il browser per vedere le modifiche (potrebbe essere necessario il riavvio del server)",
  "Refreshing apt cache...": "Aggiornamento cache apt...",
  "Refreshing the NVIDIA runtime...": "Aggiornamento del runtime NVIDIA...",
+  "Refreshing the application catalog...": "Aggiornamento del catalogo delle applicazioni...",
  "Refusing an unexpected rootfs path:": "Rifiutato un percorso rootfs inatteso:",
  "Regenerate the catalog templates": "Rigenera i modelli del catalogo",
  "Regenerate the template of one application": "Rigenera il modello di un'applicazione",
@@ -6453,6 +6466,7 @@
  "Simple and easy to use DDNS": "DDNS semplice e facile da usare",
  "Simple self-hosted file sharing.": "Servizio semplice e self-hosted per condividere file.",
  "Single GPU Warning": "Avviso GPU singola",
+  "Single sign-on and multi-factor authentication": "Single Sign-On e autenticazione a più fattori",
  "Single target found — selected automatically:": "Unica destinazione trovata - selezionata automaticamente:",
  "Single-node log storage and query UI.": "Archiviazione dei log su un singolo nodo e interfaccia di interrogazione.",
  "Single-node observability database for metrics, logs and traces.": "Database di osservabilità a nodo singolo per metriche, log e tracce.",
@@ -7858,6 +7872,7 @@
  "Update the whole stack?": "Aggiornare l’intero stack?",
  "Update, modify or recreate one installed OCI instance": "Aggiorna, modifica o ricrea un'istanza OCI installata",
  "Updated": "Aggiornato",
+  "Updated recipes since your last visit: {count}": "Ricette aggiornate dalla tua ultima visita: {count}",
  "Updated sharedfiles group to GID: 101000": "Gruppo sharedfiles aggiornato a GID: 101000",
  "Updated stack checked": "Stack aggiornato verificato",
  "Updated:": "Aggiornato:",
@@ -8202,12 +8217,17 @@
  "Web access": "Accesso web",
  "Web address of the AdGuard Home that receives the settings (e.g. http://192.168.1.3)": "Indirizzo web dell'istanza AdGuard Home che riceve le impostazioni (ad es. http://192.168.1.3)",
  "Web address of the main AdGuard Home, whose settings are copied (e.g. http://192.168.1.2)": "Indirizzo web dell'istanza AdGuard Home principale, da cui vengono copiate le impostazioni (ad es. http://192.168.1.2)",
+  "Web dashboard": "Dashboard web",
+  "Web dashboard and WebDAV": "Dashboard web e WebDAV",
  "Web interface": "Interfaccia web",
  "Web interface for Borg Backup repositories and jobs.": "Interfaccia web per repository e job di Borg Backup.",
  "Web interface for managing 3D printers.": "Interfaccia web per gestire stampanti 3D.",
  "Web interface to manage devices running Tasmota firmware.": "Interfaccia web per gestire dispositivi con firmware Tasmota.",
  "Web reverse proxy with an administration interface.": "Proxy inverso web con interfaccia di amministrazione.",
  "WebCord can be summarized as a pack of security and privacy hardenings, Discord features reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, internal pages and wrapped https://discord.com page, designed to conform with ToS as much as it is possible (or hide the changes that might violate it from Discord's eyes).": "WebCord comprende miglioramenti alla sicurezza e alla privacy, reimplementazioni di funzioni di Discord, soluzioni alternative ai bug di Electron, Chromium e Discord, fogli di stile, pagine interne e la pagina https://discord.com incapsulata. È progettato per rispettare i termini di servizio per quanto possibile (o nascondere a Discord le modifiche che potrebbero violarli).",
+  "WebDAV": "WebDAV",
+  "WebDAV and dashboard password (leave empty to generate)": "Password di WebDAV e della dashboard (campo vuoto = generata)",
+  "WebDAV is available on container port 8080. Account linking is required before cloud file operations.": "WebDAV è disponibile sulla porta 8080 del container. Prima di operare sui file del cloud bisogna collegare l'account.",
  "Webgrabplus is a multi-site incremental xmltv epg grabber. It collects tv-program guide data from selected tvguide sites for your favourite channels.": "Webgrabplus acquisisce dati EPG XMLTV incrementalmente da più siti. Raccoglie le guide TV dai siti selezionati per i canali preferiti.",
  "Webservers & Proxies": "Server web e proxy",
  "Website": "Sito web",
@@ -8967,11 +8987,5 @@
  "⚠ Disk data will NOT be erased.": "⚠ I dati del disco NON verranno cancellati.",
  "⚠ Disk will be unmounted and removed from /etc/fstab.": "⚠ Il disco verrà smontato e rimosso da /etc/fstab.",
  "⚠ The /etc/fstab entry will be removed.": "⚠ La voce /etc/fstab verrà rimossa.",
-  "⚠ The disk will be unmounted.": "⚠ Il disco verrà smontato.",
-  "Available applications: {count}": "Applicazioni disponibili: {count}",
-  "New applications since your last visit: {count}": "Nuove applicazioni dalla tua ultima visita: {count}",
-  "Updated recipes since your last visit: {count}": "Ricette aggiornate dalla tua ultima visita: {count}",
-  "Refreshing the application catalog...": "Aggiornamento del catalogo delle applicazioni...",
-  "Catalog refresh unavailable; using the local catalog.": "Impossibile aggiornare il catalogo; viene usata la copia locale.",
-  "Refresh catalog": "Aggiorna catalogo"
+  "⚠ The disk will be unmounted.": "⚠ Il disco verrà smontato."
 }
@@ -256,6 +256,7 @@
  "Acceleration for llama.cpp": "Aceleração para llama.cpp",
  "Accept routes from other nodes?": "Aceita rotas de outros nós?",
  "Accept this host monitoring profile?": "Aceita este perfil de monitorização da máquina?",
+  "Access Movistar and O2 Cloud from WebDAV clients and backup tools.": "Acesse a nuvem da Movistar e da O2 a partir de clientes WebDAV e ferramentas de backup.",
  "Access Scope:": "Escopo de acesso:",
  "Access bridge": "Ponte de acesso",
  "Access bridge for Immich": "Ponte de acesso para Immich",
@@ -410,6 +411,7 @@
  "After the reboot, you will only be able to access the Proxmox host via:": "Após a reinicialização, você só poderá acessar o host Proxmox via:",
  "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Após esta opção LXC → VM, reinicialize o host para que o novo estado de ligação seja aplicado de forma limpa.",
  "Agentless monitoring and observability platform.": "Plataforma de monitoramento e observabilidade sem agentes.",
+  "AirDC++ administrator": "Administrador do AirDC++",
  "Airsonic Advanced web interface": "Interface Web Airsonic Advanced",
  "Airsonic-advanced is a free, web-based media streamer, providing ubiquitious access to your music. Use it to share your music with friends, or to listen to your own music while at work. You can stream to multiple players simultaneously, for instance to one player in your kitchen and another in your living room.": "Airsonic-avanced é uma transmissão de mídia gratuita, baseada na web, proporcionando ubiquitious acesso à sua música. Use-o para compartilhar sua música com amigos, ou para ouvir sua própria música durante o trabalho. Você pode transmitir para vários jogadores simultaneamente, por exemplo para um jogador na sua cozinha e outro na sua sala de estar.",
  "Aliases added to .bashrc": "Aliases adicionados a .bashrc",
@@ -603,6 +605,9 @@
  "Audit socket disabled or not required": "soquete de auditoria desabilitado ou não necessário",
  "Auth key is required.": "A chave de autenticação é obrigatória.",
  "Auth:": "Autenticação:",
+  "Authelia Web UI": "UI da Web Authelia",
+  "Authelia administrator": "administrador Authelia",
+  "Authelia session cookie domain for this portal (for example example.com)": "domínio de cookie de sessão Authelia para este portal (por exemplo example.com)",
  "Authentication": "Autenticação",
  "Authentication & Security": "Autenticação e segurança",
  "Authentication Error": "Erro de autenticação",
@@ -642,6 +647,7 @@
  "Available PVE Version": "Versão PVE disponível",
  "Available Shares:": "Ações disponíveis:",
  "Available action": "Ação disponível",
+  "Available applications: {count}": "Aplicações disponíveis: {count}",
  "Available archives:": "Arquivos disponíveis:",
  "Available disks detected.": "Discos disponíveis detectados.",
  "Available host backups:": "Backups de host disponíveis:",
@@ -873,6 +879,7 @@
  "Cannot write the image archive to {storage}. Check storage access and mount status.": "Não é possível gravar o arquivo de imagem em {storage}. Verifique o acesso ao armazenamento e o status de montagem.",
  "Capabilities cannot be kept and all dropped at the same time": "Capacidades não podem ser mantidas e todas retiradas ao mesmo tempo",
  "Catalog options": "Opções do catálogo",
+  "Catalog refresh unavailable; using the local catalog.": "Não foi possível atualizar o catálogo; está a ser usada a cópia local.",
  "Category": "Categoria",
  "Caution: Maximum mode generates more heat.": "Cuidado: O modo máximo gera mais calor.",
  "Central server for file and image backups.": "Servidor central para backups de arquivos e imagens.",
@@ -1927,6 +1934,7 @@
  "Dgraph": "Dgraph",
  "Diff: current system vs backup (--- system  +++ backup)": "Diferença: sistema atual vs backup (--- backup do sistema +++)",
  "Different host. Backup from:": "Anfitrião diferente. Backup de:",
+  "Direct Connect file sharing with a web interface": "Partilha de ficheiros Direct Connect com interface web",
  "Direct conversion completed for container": "Conversão direta concluída para contêiner",
  "Directory Exists": "O diretório existe",
  "Directory Not Empty": "Diretório não vazio",
@@ -4435,6 +4443,7 @@
  "New Search": "Nova pesquisa",
  "New VM:": "Nova VM:",
  "New Virtual Machine": "Nova máquina virtual",
+  "New applications since your last visit: {count}": "Novas aplicações desde a sua última visita: {count}",
  "New backup job": "Nova tarefa de backup",
  "New backups on this host will be unencrypted until a new keyfile is set up.": "Novos backups neste host serão descriptografados até que um novo arquivo-chave seja configurado.",
  "New image compatible:": "Nova imagem compatível:",
@@ -4897,6 +4906,7 @@
  "Open the page of an application in the menu": "Abrir a página de uma aplicação no menu",
  "Open the web address and create the first account: the daemon registers by itself and starts the first scan.": "Abra o endereço web e crie a primeira conta: o daemon regista-se sozinho e inicia a primeira análise.",
  "Open the web address and create the password of the akadmin user in the first-run setup.": "Abra o endereço da web e crie a senha do usuário akadmin na configuração inicial.",
+  "Open the web dashboard and link your Movistar/O2 account using its SMS flow.": "Abra o painel web e vincule sua conta Movistar/O2 com a verificação por SMS.",
  "Open-source AI-powered coding assistant": "Assistente de codificação com código aberto",
  "Open-source UI for building and debugging multi-agent and RAG applications": "UI de código aberto para a construção e depuração de aplicações multi-agente e RAG",
  "Open-source in-memory data store.": "Armazenamento de dados em memória de código aberto.",
@@ -5396,6 +5406,7 @@
  "Proxmox web interface: Datacenter > Storage > Add > ZFS": "Interface web Proxmox: Datacenter > Armazenamento > Adicionar > ZFS",
  "Proxmox web interface: Datacenter > Storage > Add > iSCSI": "Interface web Proxmox: Datacenter > Armazenamento > Adicionar > iSCSI",
  "Proxy address to reach the API (optional)": "Endereço proxy para acessar a API (opcional)",
+  "Public HTTPS URL used to open this Authelia portal (for example https://auth.example.com)": "URL HTTPS público usado para abrir este portal Authelia (por exemplo https://auth.example.com)",
  "Public UDP port clients connect to": "Clientes públicos de porta UDP se conectam",
  "Public UDP port peers connect to": "Os pares públicos de portas UDP se conectam",
  "Public URL of phpMyAdmin when it is served behind a reverse proxy": "URL público do phpMyAdmin quando é servido por trás de um proxy reverso",
@@ -5561,6 +5572,7 @@
  "Recursive and authoritative DNS server.": "Servidor DNS recursivo e autoritativo.",
  "Redmine": "Redmine",
  "Refresh APT index and verify repositories:": "Atualize o índice APT e verifique os repositórios:",
+  "Refresh catalog": "Atualizar catálogo",
  "Refresh the configured APT repositories and review the PBS package upgrade? Repository files will be preserved.": "Atualizar os índices dos repositórios APT configurados e rever a atualização de pacotes PBS? Os ficheiros dos repositórios serão preservados.",
  "Refresh the index from the image sources": "Atualizar o índice a partir das origens de imagens",
  "Refresh token of the connector, from the Twingate admin console": "Token de atualização do conector, no console administrativo Twingate",
@@ -5568,6 +5580,7 @@
  "Refresh your browser to see changes (server restart may be required)": "Atualize seu navegador para ver as alterações (pode ser necessário reiniciar o servidor)",
  "Refreshing apt cache...": "Atualizando o cache do apt...",
  "Refreshing the NVIDIA runtime...": "Atualizando o tempo de execução NVIDIA...",
+  "Refreshing the application catalog...": "A atualizar o catálogo de aplicações...",
  "Refusing an unexpected rootfs path:": "Recusando um caminho inesperado do rootfs:",
  "Regenerate the catalog templates": "Regenerar os modelos do catálogo",
  "Regenerate the template of one application": "Regenerar o modelo de uma aplicação",
@@ -6453,6 +6466,7 @@
  "Simple and easy to use DDNS": "Simples e fácil de usar DDNS",
  "Simple self-hosted file sharing.": "Serviço simples e autoalojado para partilha de ficheiros.",
  "Single GPU Warning": "Aviso de GPU única",
+  "Single sign-on and multi-factor authentication": "login único e autenticação multifator",
  "Single target found — selected automatically:": "Único alvo encontrado — selecionado automaticamente:",
  "Single-node log storage and query UI.": "Armazenamento de logs para um único nó com interface de consulta.",
  "Single-node observability database for metrics, logs and traces.": "Banco de dados de observabilidade de nó único para métricas, logs e traces.",
@@ -7858,6 +7872,7 @@
  "Update the whole stack?": "Atualizar toda a pilha?",
  "Update, modify or recreate one installed OCI instance": "Atualizar, modificar ou recriar uma instância OCI instalada",
  "Updated": "Atualizado",
+  "Updated recipes since your last visit: {count}": "Receitas atualizadas desde a sua última visita: {count}",
  "Updated sharedfiles group to GID: 101000": "Grupo de arquivos compartilhados atualizado para GID: 101000",
  "Updated stack checked": "Stack atualizado verificado",
  "Updated:": "Actualizado:",
@@ -8202,12 +8217,17 @@
  "Web access": "Acesso à Internet",
  "Web address of the AdGuard Home that receives the settings (e.g. http://192.168.1.3)": "Endereço Web do AdGuard Home que recebe as definições (por exemplo, http://192.168.1.3)",
  "Web address of the main AdGuard Home, whose settings are copied (e.g. http://192.168.1.2)": "Endereço Web do AdGuard Home principal, cujas configurações são copiadas (por exemplo, http://192.168.1.2)",
+  "Web dashboard": "Painel web",
+  "Web dashboard and WebDAV": "Painel web e WebDAV",
  "Web interface": "Interface da Web",
  "Web interface for Borg Backup repositories and jobs.": "Interface web para gerenciar repositórios e tarefas do Borg Backup.",
  "Web interface for managing 3D printers.": "Interface web para gerenciar impressoras 3D.",
  "Web interface to manage devices running Tasmota firmware.": "Interface Web para gerenciar dispositivos rodando firmware Tasmota.",
  "Web reverse proxy with an administration interface.": "Proxy reverso web com interface de administração.",
  "WebCord can be summarized as a pack of security and privacy hardenings, Discord features reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, internal pages and wrapped https://discord.com page, designed to conform with ToS as much as it is possible (or hide the changes that might violate it from Discord's eyes).": "WebCord pode ser resumido como um pacote de endurecimentos de segurança e privacidade, recursos de discórdia reimplementações, Electron / Chromium / Erros de discórdia workarounds, stylesheets, páginas internas e página envolto https://discord.com, projetado para se conformar com ToS tanto quanto possível (ou ocultar as alterações que podem violá-lo dos olhos da Discord).",
+  "WebDAV": "WebDAV",
+  "WebDAV and dashboard password (leave empty to generate)": "Senha do WebDAV e do painel (vazio = gerada)",
+  "WebDAV is available on container port 8080. Account linking is required before cloud file operations.": "O WebDAV está disponível na porta 8080 do contêiner. É preciso vincular a conta antes de operar com os arquivos da nuvem.",
  "Webgrabplus is a multi-site incremental xmltv epg grabber. It collects tv-program guide data from selected tvguide sites for your favourite channels.": "Webgrabplus é um multi-site incremental xmltv epg grabber. Ele coleta dados de guias de tv-programa de sites selecionados para seus canais favoritos.",
  "Webservers & Proxies": "Servidores web e proxies",
  "Website": "Site",
@@ -8967,11 +8987,5 @@
  "⚠ Disk data will NOT be erased.": "⚠ Os dados do disco NÃO serão apagados.",
  "⚠ Disk will be unmounted and removed from /etc/fstab.": "⚠ O disco será desmontado e removido de /etc/fstab.",
  "⚠ The /etc/fstab entry will be removed.": "⚠ A entrada /etc/fstab será removida.",
-  "⚠ The disk will be unmounted.": "⚠ O disco será desmontado.",
-  "Available applications: {count}": "Aplicações disponíveis: {count}",
-  "New applications since your last visit: {count}": "Novas aplicações desde a sua última visita: {count}",
-  "Updated recipes since your last visit: {count}": "Receitas atualizadas desde a sua última visita: {count}",
-  "Refreshing the application catalog...": "A atualizar o catálogo de aplicações...",
-  "Catalog refresh unavailable; using the local catalog.": "Não foi possível atualizar o catálogo; está a ser usada a cópia local.",
-  "Refresh catalog": "Atualizar catálogo"
+  "⚠ The disk will be unmounted.": "⚠ O disco será desmontado."
 }
@@ -256,6 +256,7 @@
  "Acceleration for llama.cpp": "Zrýchlenie pre llama.cpp",
  "Accept routes from other nodes?": "Prijímať trasy z iných uzlov?",
  "Accept this host monitoring profile?": "Prijať tento profil monitorovania hostiteľa?",
+  "Access Movistar and O2 Cloud from WebDAV clients and backup tools.": "Prístup ku cloudu Movistar a O2 z klientov WebDAV a nástrojov na zálohovanie.",
  "Access Scope:": "Rozsah prístupu:",
  "Access bridge": "Sieťový most (bridge)",
  "Access bridge for Immich": "Sieťový most (bridge) pre Immich",
@@ -410,6 +411,7 @@
  "After the reboot, you will only be able to access the Proxmox host via:": "Po reštarte sa k Proxmox hostovi dostanete iba cez:",
  "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Po tomto prepnutí LXC → VM reštartujte host, aby sa nové naviazanie použilo čisto.",
  "Agentless monitoring and observability platform.": "Platforma na monitorovanie a observabilitu bez klientskych agentov.",
+  "AirDC++ administrator": "Správca AirDC++",
  "Airsonic Advanced web interface": "Webové rozhranie Airsonic Advanced",
  "Airsonic-advanced is a free, web-based media streamer, providing ubiquitious access to your music. Use it to share your music with friends, or to listen to your own music while at work. You can stream to multiple players simultaneously, for instance to one player in your kitchen and another in your living room.": "Airsonic-advanced je bezplatný webový server na streamovanie hudby. Umožňuje zdieľať hudbu s priateľmi alebo počúvať vlastnú zbierku aj v práci. Podporuje súčasné prehrávanie na viacerých zariadeniach, napríklad v kuchyni a obývačke.",
  "Aliases added to .bashrc": "Aliasy boli pridané do .bashrc",
@@ -603,6 +605,9 @@
  "Audit socket disabled or not required": "Zásuvka auditu je zakázaná alebo sa nevyžaduje",
  "Auth key is required.": "Auth key je povinný.",
  "Auth:": "Prihlásenie:",
+  "Authelia Web UI": "Webové rozhranie Authelia",
+  "Authelia administrator": "Správca Authelia",
+  "Authelia session cookie domain for this portal (for example example.com)": "Doména súboru cookie relácie Authelia pre tento portál (napríklad example.com)",
  "Authentication": "Prihlásenie",
  "Authentication & Security": "Overovanie a zabezpečenie",
  "Authentication Error": "Chyba prihlásenia",
@@ -642,6 +647,7 @@
  "Available PVE Version": "Dostupná verzia PVE",
  "Available Shares:": "Dostupné zdieľania:",
  "Available action": "Dostupná akcia",
+  "Available applications: {count}": "Dostupné aplikácie: {count}",
  "Available archives:": "Dostupné archívy:",
  "Available disks detected.": "Dostupné disky boli nájdené.",
  "Available host backups:": "Dostupné zálohy hosta:",
@@ -873,6 +879,7 @@
  "Cannot write the image archive to {storage}. Check storage access and mount status.": "Archív obrazu sa nedá zapísať do úložiska {storage}. Skontrolujte prístup k úložisku a stav jeho pripojenia.",
  "Capabilities cannot be kept and all dropped at the same time": "Oprávnenia capabilities nemožno súčasne ponechať aj všetky odobrať",
  "Catalog options": "Možnosti katalógu",
+  "Catalog refresh unavailable; using the local catalog.": "Katalóg sa nepodarilo aktualizovať; používa sa miestna kópia.",
  "Category": "Kategória",
  "Caution: Maximum mode generates more heat.": "Pozor: maximálny režim vytvára viac tepla.",
  "Central server for file and image backups.": "Centrálny server na zálohovanie súborov a obrazov.",
@@ -1927,6 +1934,7 @@
  "Dgraph": "Dgraph",
  "Diff: current system vs backup (--- system  +++ backup)": "Rozdiel: aktuálny systém vs záloha (--- systém  +++ záloha)",
  "Different host. Backup from:": "Iný host. Záloha z:",
+  "Direct Connect file sharing with a web interface": "Zdieľanie súborov cez Direct Connect s webovým rozhraním",
  "Direct conversion completed for container": "Priama konverzia bola dokončená pre kontajner",
  "Directory Exists": "Priečinok už existuje",
  "Directory Not Empty": "Priečinok nie je prázdny",
@@ -4435,6 +4443,7 @@
  "New Search": "Nové hľadanie",
  "New VM:": "Nová VM:",
  "New Virtual Machine": "Nová virtuálna mašina",
+  "New applications since your last visit: {count}": "Nové aplikácie od vašej poslednej návštevy: {count}",
  "New backup job": "Nová úloha zálohy",
  "New backups on this host will be unencrypted until a new keyfile is set up.": "Nové zálohy na tomto hostovi budú nešifrované, kým nenastavíte nový keyfile.",
  "New image compatible:": "Nový obraz je kompatibilný:",
@@ -4899,6 +4908,7 @@
  "Open the page of an application in the menu": "Otvoriť stránku aplikácie v ponuke",
  "Open the web address and create the first account: the daemon registers by itself and starts the first scan.": "Otvorte webovú adresu a vytvorte prvé konto: daemon sa zaregistruje sám a spustí prvé skenovanie.",
  "Open the web address and create the password of the akadmin user in the first-run setup.": "Otvorte webovú adresu a v prvotnom nastavení vytvorte heslo používateľa akadmin.",
+  "Open the web dashboard and link your Movistar/O2 account using its SMS flow.": "Otvorte webový panel a prepojte svoj účet Movistar/O2 pomocou overenia cez SMS.",
  "Open-source AI-powered coding assistant": "Programátorský asistent využívajúci AI s otvoreným zdrojovým kódom",
  "Open-source UI for building and debugging multi-agent and RAG applications": "Rozhranie s otvoreným zdrojovým kódom na tvorbu a ladenie aplikácií s viacerými agentmi a RAG",
  "Open-source in-memory data store.": "Úložisko údajov v pamäti s otvoreným zdrojovým kódom.",
@@ -5398,6 +5408,7 @@
  "Proxmox web interface: Datacenter > Storage > Add > ZFS": "Webové rozhranie Proxmoxu: Datacenter > Storage > Add > ZFS",
  "Proxmox web interface: Datacenter > Storage > Add > iSCSI": "Webové rozhranie Proxmoxu: Datacenter > Storage > Add > iSCSI",
  "Proxy address to reach the API (optional)": "Adresa proxy na prístup k API (voliteľné)",
+  "Public HTTPS URL used to open this Authelia portal (for example https://auth.example.com)": "Verejná adresa HTTPS na otvorenie tohto portálu Authelia (napríklad https://auth.example.com)",
  "Public UDP port clients connect to": "Verejný port UDP na pripojenie klientov",
  "Public UDP port peers connect to": "Verejný port UDP na pripojenie účastníkov",
  "Public URL of phpMyAdmin when it is served behind a reverse proxy": "Verejné URL phpMyAdmin, keď sa podáva za reverzným proxy",
@@ -5563,6 +5574,7 @@
  "Recursive and authoritative DNS server.": "Rekurzívny a autoritatívny DNS server.",
  "Redmine": "Redmine",
  "Refresh APT index and verify repositories:": "Obnovte APT index a overte repozitáre:",
+  "Refresh catalog": "Aktualizovať katalóg",
  "Refresh the configured APT repositories and review the PBS package upgrade? Repository files will be preserved.": "Obnoviť indexy nakonfigurovaných repozitárov APT a skontrolovať aktualizáciu balíkov PBS? Súbory repozitárov sa zachovajú.",
  "Refresh the index from the image sources": "Obnoviť index zo zdrojov obrazov",
  "Refresh token of the connector, from the Twingate admin console": "Obnovovací token konektora z administrátorskej konzoly Twingate",
@@ -5570,6 +5582,7 @@
  "Refresh your browser to see changes (server restart may be required)": "Obnovte stránku v prehliadači, aby ste videli zmeny (môže byť potrebný reštart servera)",
  "Refreshing apt cache...": "Obnovujem apt cache...",
  "Refreshing the NVIDIA runtime...": "Obnovenie prevádzky NVIDIA...",
+  "Refreshing the application catalog...": "Aktualizuje sa katalóg aplikácií...",
  "Refusing an unexpected rootfs path:": "Odmietnutá neočakávaná cesta koreňového súborového systému:",
  "Regenerate the catalog templates": "Znova vygenerovať šablóny katalógu",
  "Regenerate the template of one application": "Znova vygenerovať šablónu jednej aplikácie",
@@ -6455,6 +6468,7 @@
  "Simple and easy to use DDNS": "Jednoducho použiteľné dynamické DNS (DDNS)",
  "Simple self-hosted file sharing.": "Jednoduchá samohostovaná služba na zdieľanie súborov.",
  "Single GPU Warning": "Upozornenie na jednu GPU",
+  "Single sign-on and multi-factor authentication": "Jednotné prihlásenie a viacfaktorové overovanie",
  "Single target found — selected automatically:": "Našiel sa jeden target - vybraný automaticky:",
  "Single-node log storage and query UI.": "Úložisko logov a vyhľadávacie rozhranie pre jeden uzol.",
  "Single-node observability database for metrics, logs and traces.": "Databáza na jednom uzle na ukladanie metrík, logov a záznamov o priebehu požiadaviek.",
@@ -7858,6 +7872,7 @@
  "Update the whole stack?": "Aktualizovať celú aplikáciu?",
  "Update, modify or recreate one installed OCI instance": "Aktualizovať, upraviť alebo znova vytvoriť jednu nainštalovanú inštanciu OCI",
  "Updated": "Aktualizované",
+  "Updated recipes since your last visit: {count}": "Aktualizované recepty od vašej poslednej návštevy: {count}",
  "Updated sharedfiles group to GID: 101000": "Skupina sharedfiles bola aktualizovaná na GID: 101000",
  "Updated stack checked": "Aktualizovaná aplikácia je skontrolovaná",
  "Updated:": "Aktualizované:",
@@ -8202,12 +8217,17 @@
  "Web access": "Adresa webového rozhrania",
  "Web address of the AdGuard Home that receives the settings (e.g. http://192.168.1.3)": "Webová adresa AdGuard Home, ktorá prijíma nastavenia (napr. http://192.168.1.3)",
  "Web address of the main AdGuard Home, whose settings are copied (e.g. http://192.168.1.2)": "Webová adresa hlavného AdGuard Home, ktorého nastavenia sú kopírované (napr. http://192.168.1.2)",
+  "Web dashboard": "Webový panel",
+  "Web dashboard and WebDAV": "Webový panel a WebDAV",
  "Web interface": "Webové rozhranie",
  "Web interface for Borg Backup repositories and jobs.": "Webové rozhranie na správu úložísk a úloh Borg Backup.",
  "Web interface for managing 3D printers.": "Webové rozhranie na správu 3D tlačiarní.",
  "Web interface to manage devices running Tasmota firmware.": "Webové rozhranie pre správu zariadení bežiacich na Tasmota firmware.",
  "Web reverse proxy with an administration interface.": "Webový reverzný proxy server s administračným rozhraním.",
  "WebCord can be summarized as a pack of security and privacy hardenings, Discord features reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, internal pages and wrapped https://discord.com page, designed to conform with ToS as much as it is possible (or hide the changes that might violate it from Discord's eyes).": "WebCord je klient obklopujúci stránku https://discord.com, ktorý zlepšuje bezpečnosť a súkromie, upravuje funkcie Discordu, obchádza chyby Electronu, Chromia a Discordu a pridáva štýly aj interné stránky. Snaží sa čo najviac dodržiavať podmienky používania alebo skryť pred Discordom úpravy, ktoré by ich mohli porušovať.",
+  "WebDAV": "WebDAV",
+  "WebDAV and dashboard password (leave empty to generate)": "Heslo pre WebDAV a panel (prázdne = generované)",
+  "WebDAV is available on container port 8080. Account linking is required before cloud file operations.": "WebDAV je dostupný na porte 8080 kontajnera. Pred prácou so súbormi v cloude je potrebné prepojiť účet.",
  "Webgrabplus is a multi-site incremental xmltv epg grabber. It collects tv-program guide data from selected tvguide sites for your favourite channels.": "WebGrab+Plus priebežne získava elektronický programový sprievodca (EPG) vo formáte XMLTV z viacerých webov. Zhromažďuje televízny program vybraných staníc z podporovaných stránok.",
  "Webservers & Proxies": "Webové servery a proxy",
  "Website": "Webová stránka",
@@ -8967,11 +8987,5 @@
  "⚠ Disk data will NOT be erased.": "⚠ Dáta na disku sa NEVYMAŽÚ.",
  "⚠ Disk will be unmounted and removed from /etc/fstab.": "⚠ Disk sa odpojí a odstráni z /etc/fstab.",
  "⚠ The /etc/fstab entry will be removed.": "⚠ Záznam v /etc/fstab bude odstránený.",
-  "⚠ The disk will be unmounted.": "⚠ Disk bude odpojený.",
-  "Available applications: {count}": "Dostupné aplikácie: {count}",
-  "New applications since your last visit: {count}": "Nové aplikácie od vašej poslednej návštevy: {count}",
-  "Updated recipes since your last visit: {count}": "Aktualizované recepty od vašej poslednej návštevy: {count}",
-  "Refreshing the application catalog...": "Aktualizuje sa katalóg aplikácií...",
-  "Catalog refresh unavailable; using the local catalog.": "Katalóg sa nepodarilo aktualizovať; používa sa miestna kópia.",
-  "Refresh catalog": "Aktualizovať katalóg"
+  "⚠ The disk will be unmounted.": "⚠ Disk bude odpojený."
 }
@@ -256,6 +256,7 @@
  "Acceleration for llama.cpp": "Acceleration för llama.cpp",
  "Accept routes from other nodes?": "Acceptera rutter från andra noder?",
  "Accept this host monitoring profile?": "Acceptera denna värdövervakningsprofil?",
+  "Access Movistar and O2 Cloud from WebDAV clients and backup tools.": "Kom åt Movistar- och O2-molnet från WebDAV-klienter och säkerhetskopieringsverktyg.",
  "Access Scope:": "Åtkomstomfång:",
  "Access bridge": "Tillgång bridge",
  "Access bridge for Immich": "Tillgångsbro för Immich",
@@ -410,6 +411,7 @@
  "After the reboot, you will only be able to access the Proxmox host via:": "Efter omstarten kommer du bara att kunna komma åt Proxmox-värden via:",
  "After this LXC → VM switch, reboot the host so the new binding state is applied cleanly.": "Efter denna LXC → VM-switch, starta om värden så att det nya bindningsläget tillämpas korrekt.",
  "Agentless monitoring and observability platform.": "Agentlös plattform för övervakning och observerbarhet.",
+  "AirDC++ administrator": "AirDC++-administratör",
  "Airsonic Advanced web interface": "Airsonic Advanced webbgränssnitt",
  "Airsonic-advanced is a free, web-based media streamer, providing ubiquitious access to your music. Use it to share your music with friends, or to listen to your own music while at work. You can stream to multiple players simultaneously, for instance to one player in your kitchen and another in your living room.": "Airsonic-advanced är en gratis, webbaserad media streamer, som ger ubiquitious tillgång till din musik. Använd den för att dela din musik med vänner, eller för att lyssna på din egen musik på jobbet. Du kan strömma till flera spelare samtidigt, till exempel till en spelare i ditt kök och en annan i ditt vardagsrum.",
  "Aliases added to .bashrc": "Alias har lagts till i .bashrc",
@@ -603,6 +605,8 @@
  "Audit socket disabled or not required": "Granskningsuttaget inaktiverat eller inte nödvändigt",
  "Auth key is required.": "Auth-nyckel krävs.",
  "Auth:": "Auth:",
+  "Authelia administrator": "Authelia administratör",
+  "Authelia session cookie domain for this portal (for example example.com)": "Authelia sessionscookiedomän för denna portal (till exempel example.com)",
  "Authentication": "Autentisering",
  "Authentication & Security": "Autentisering och säkerhet",
  "Authentication Error": "Autentiseringsfel",
@@ -642,6 +646,7 @@
  "Available PVE Version": "Tillgänglig PVE-version",
  "Available Shares:": "Tillgängliga andelar:",
  "Available action": "Tillgänglig åtgärd",
+  "Available applications: {count}": "Tillgängliga appar: {count}",
  "Available archives:": "Tillgängliga arkiv:",
  "Available disks detected.": "Tillgängliga diskar har upptäckts.",
  "Available host backups:": "Tillgängliga värdsäkerhetskopior:",
@@ -873,6 +878,7 @@
  "Cannot write the image archive to {storage}. Check storage access and mount status.": "Kan inte skriva bildarkivet till {storage}. Kontrollera lagringsåtkomst och monteringsstatus.",
  "Capabilities cannot be kept and all dropped at the same time": "Förmågor kan inte hållas och alla tappas samtidigt",
  "Catalog options": "Katalogalternativ",
+  "Catalog refresh unavailable; using the local catalog.": "Katalogen kunde inte uppdateras; den lokala katalogen används.",
  "Category": "Kategori",
  "Caution: Maximum mode generates more heat.": "Varning: Maximalt läge genererar mer värme.",
  "Central server for file and image backups.": "Central server för säkerhetskopiering av filer och bilder.",
@@ -1927,6 +1933,7 @@
  "Dgraph": "Dgraph",
  "Diff: current system vs backup (--- system  +++ backup)": "Diff: nuvarande system vs säkerhetskopia (--- system +++ säkerhetskopia)",
  "Different host. Backup from:": "Annorlunda värd. Säkerhetskopiering från:",
+  "Direct Connect file sharing with a web interface": "Fildelning via Direct Connect med webbgränssnitt",
  "Direct conversion completed for container": "Direkt konvertering slutförd för container",
  "Directory Exists": "Katalog finns",
  "Directory Not Empty": "Katalog inte tom",
@@ -4435,6 +4442,7 @@
  "New Search": "Ny sökning",
  "New VM:": "Ny VM:",
  "New Virtual Machine": "Ny virtuell maskin",
+  "New applications since your last visit: {count}": "Nya appar sedan ditt senaste besök: {count}",
  "New backup job": "Nytt säkerhetskopia jobb",
  "New backups on this host will be unencrypted until a new keyfile is set up.": "Nya säkerhetskopior på denna värd kommer att vara okrypterade tills en ny nyckelfil ställs in.",
  "New image compatible:": "Ny bildkompatibel:",
@@ -4897,6 +4905,7 @@
  "Open the page of an application in the menu": "Öppna en applikations sida i menyn",
  "Open the web address and create the first account: the daemon registers by itself and starts the first scan.": "Öppna webbadressen och skapa det första kontot: daemonen registrerar sig själv och startar den första skanningen.",
  "Open the web address and create the password of the akadmin user in the first-run setup.": "Öppna webbadressen och skapa lösenordet för akadmin-användaren i den första körningen.",
+  "Open the web dashboard and link your Movistar/O2 account using its SMS flow.": "Öppna webbpanelen och koppla ditt Movistar/O2-konto med SMS-verifieringen.",
  "Open-source AI-powered coding assistant": "Open-source AI-driven kodningsassistent",
  "Open-source UI for building and debugging multi-agent and RAG applications": "Open-source UI för att bygga och debugga multi-agent- och RAG-applikationer",
  "Open-source in-memory data store.": "Öppen datalagring i minnet.",
@@ -5396,6 +5405,7 @@
  "Proxmox web interface: Datacenter > Storage > Add > ZFS": "Proxmox webbgränssnitt: Datacenter > Lagring > Lägg till > ZFS",
  "Proxmox web interface: Datacenter > Storage > Add > iSCSI": "Proxmox webbgränssnitt: Datacenter > Lagring > Lägg till > iSCSI",
  "Proxy address to reach the API (optional)": "Proxyadress för att nå API:t (valfritt)",
+  "Public HTTPS URL used to open this Authelia portal (for example https://auth.example.com)": "Offentlig HTTPS-URL som används för att öppna denna Authelia-portal (till exempel https://auth.example.com)",
  "Public UDP port clients connect to": "Offentliga UDP-portklienter ansluter till",
  "Public UDP port peers connect to": "Offentliga UDP-portpeers ansluter till",
  "Public URL of phpMyAdmin when it is served behind a reverse proxy": "Public URL av phpMyAdmin när den serveras bakom en omvänd proxy",
@@ -5561,6 +5571,7 @@
  "Recursive and authoritative DNS server.": "Rekursiv och auktoritativ DNS-server.",
  "Redmine": "Redmine",
  "Refresh APT index and verify repositories:": "Uppdatera APT-index och verifiera förråd:",
+  "Refresh catalog": "Uppdatera katalogen",
  "Refresh the configured APT repositories and review the PBS package upgrade? Repository files will be preserved.": "Uppdatera de konfigurerade APT-paketförråden och granska PBS-paketuppgraderingen? Paketförrådens filer bevaras.",
  "Refresh the index from the image sources": "Uppdatera indexet från avbildskällorna",
  "Refresh token of the connector, from the Twingate admin console": "Uppdateringstoken för kontakten, från Twingate-administratörskonsolen",
@@ -5568,6 +5579,7 @@
  "Refresh your browser to see changes (server restart may be required)": "Uppdatera din webbläsare för att se ändringar (serverns omstart kan krävas)",
  "Refreshing apt cache...": "Uppdaterar apt cache...",
  "Refreshing the NVIDIA runtime...": "Uppfriskande NVIDIA runtime...",
+  "Refreshing the application catalog...": "Uppdaterar appkatalogen...",
  "Refusing an unexpected rootfs path:": "Vägrar en oväntad rootfs väg:",
  "Regenerate the catalog templates": "Generera om katalogmallarna",
  "Regenerate the template of one application": "Generera om mallen för en applikation",
@@ -6453,6 +6465,7 @@
  "Simple and easy to use DDNS": "Enkelt och enkelt att använda DDNS",
  "Simple self-hosted file sharing.": "Enkel självhostad fildelning.",
  "Single GPU Warning": "Varning för enkel GPU",
+  "Single sign-on and multi-factor authentication": "Enkel inloggning och multifaktorautentisering",
  "Single target found — selected automatically:": "Enstaka mål hittades — väljs automatiskt:",
  "Single-node log storage and query UI.": "Gränssnitt för logglagring och loggsökning på en enda nod.",
  "Single-node observability database for metrics, logs and traces.": "Observabilitetsdatabas med en nod för mätvärden, loggar och spår.",
@@ -7858,6 +7871,7 @@
  "Update the whole stack?": "Uppdatera hela stacken?",
  "Update, modify or recreate one installed OCI instance": "Uppdatera, ändra eller återskapa en installerad OCI-instans",
  "Updated": "Uppdaterad",
+  "Updated recipes since your last visit: {count}": "Uppdaterade recept sedan ditt senaste besök: {count}",
  "Updated sharedfiles group to GID: 101000": "Uppdaterad sharedfiles-grupp till GID: 101000",
  "Updated stack checked": "Uppdaterad stack kontrollerad",
  "Updated:": "Uppdaterad:",
@@ -8202,12 +8216,17 @@
  "Web access": "Web access",
  "Web address of the AdGuard Home that receives the settings (e.g. http://192.168.1.3)": "Webbadress för AdGuard Home som tar emot inställningarna (t.ex. http://192.168.1.3)",
  "Web address of the main AdGuard Home, whose settings are copied (e.g. http://192.168.1.2)": "Webbadressen för AdGuard Home, vars inställningar kopieras (t.ex. http://192.168.1.2)",
+  "Web dashboard": "Webbpanel",
+  "Web dashboard and WebDAV": "Webbpanel och WebDAV",
  "Web interface": "Webbgränssnitt",
  "Web interface for Borg Backup repositories and jobs.": "Webbgränssnitt för Borg Backup-arkiv och jobb.",
  "Web interface for managing 3D printers.": "Webbgränssnitt för hantering av 3D-skrivare.",
  "Web interface to manage devices running Tasmota firmware.": "Webbgränssnitt för att hantera enheter som kör Tasmota firmware.",
  "Web reverse proxy with an administration interface.": "Omvänd proxy för webben med administrationsgränssnitt.",
  "WebCord can be summarized as a pack of security and privacy hardenings, Discord features reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, internal pages and wrapped https://discord.com page, designed to conform with ToS as much as it is possible (or hide the changes that might violate it from Discord's eyes).": "WebCord kan sammanfattas som ett paket av säkerhets- och sekretesshärdningar, Discord-funktioner reimplementations, Electron / Chromium / Discord bugs workarounds, stylesheets, interna sidor och wrapped https://discord.com sida, utformad för att överensstämma med ToS så mycket som möjligt (eller dölja de förändringar som kan bryta mot det från Discords ögon).",
+  "WebDAV": "WebDAV",
+  "WebDAV and dashboard password (leave empty to generate)": "Lösenord för WebDAV och panelen (tom = genererat)",
+  "WebDAV is available on container port 8080. Account linking is required before cloud file operations.": "WebDAV är tillgängligt på containerns port 8080. Kontot måste kopplas innan du arbetar med filerna i molnet.",
  "Webgrabplus is a multi-site incremental xmltv epg grabber. It collects tv-program guide data from selected tvguide sites for your favourite channels.": "Webgrabplus är en multi-site inkrementell xmltv epg grabber. Det samlar in tv-programguide data från utvalda tvguide webbplatser för dina favoritkanaler.",
  "Webservers & Proxies": "Webbservrar och proxyservrar",
  "Website": "Webbplats",
@@ -8967,11 +8986,5 @@
  "⚠ Disk data will NOT be erased.": "⚠ Diskdata kommer INTE att raderas.",
  "⚠ Disk will be unmounted and removed from /etc/fstab.": "⚠ Disken kommer att avmonteras och tas bort från /etc/fstab.",
  "⚠ The /etc/fstab entry will be removed.": "⚠ /etc/fstab-posten kommer att tas bort.",
-  "⚠ The disk will be unmounted.": "⚠ Disken kommer att avmonteras.",
-  "Available applications: {count}": "Tillgängliga appar: {count}",
-  "New applications since your last visit: {count}": "Nya appar sedan ditt senaste besök: {count}",
-  "Updated recipes since your last visit: {count}": "Uppdaterade recept sedan ditt senaste besök: {count}",
-  "Refreshing the application catalog...": "Uppdaterar appkatalogen...",
-  "Catalog refresh unavailable; using the local catalog.": "Katalogen kunde inte uppdateras; den lokala katalogen används.",
-  "Refresh catalog": "Uppdatera katalogen"
+  "⚠ The disk will be unmounted.": "⚠ Disken kommer att avmonteras."
 }
@@ -2,7 +2,7 @@

 <!-- Generated from oci/catalog/verification.json by .github/scripts/oci_validation.py. Do not edit by hand. -->

-52 of 533 applications in the OCI catalog have been tested for real: 49 in the ProxMenux lab and 3 by the community. The OCI installer shows them as verified, with a ✓ in the lists.
+52 of 536 applications in the OCI catalog have been tested for real: 49 in the ProxMenux lab and 3 by the community. The OCI installer shows them as verified, with a ✓ in the lists.

 Each test describes the scenario that was run and names the image it ran on. It does not cover every possible configuration of the application, and a newer image has not been tested until someone reports it.

@@ -0,0 +1,585 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-airdcpp-webclient",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "AirDC++ Web Client",
+      "es_ES": "AirDC++ Web Client"
+    },
+    "tagline": {
+      "en_US": "Direct Connect file sharing with a web interface",
+      "es_ES": "Intercambio de archivos Direct Connect con interfaz web"
+    },
+    "description": {
+      "en_US": "AirDC++ Web Client using the community-maintained gangefors image. Configuration, downloads and shared content use separate persistent paths.",
+      "es_ES": "AirDC++ Web Client con la imagen comunitaria de gangefors. La configuración, las descargas y los archivos compartidos usan rutas persistentes separadas."
+    },
+    "category": "downloads",
+    "category_label": "Files & Downloads",
+    "author": "gangefors",
+    "developer": "AirDC++",
+    "icon": "https://raw.githubusercontent.com/airdcpp-web/airdcpp-webui/eeeea5025a5e720f38dac53ced8e002940f00a74/resources/images/logo.svg",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 5600,
+      "path": "/"
+    },
+    "website": "https://airdcpp-web.github.io/",
+    "documentation": "https://github.com/gangefors/docker-airdcpp-webclient",
+    "repository": "https://github.com/gangefors/docker-airdcpp-webclient",
+    "tips": [
+      "The upstream initial login is admin / password. Change it in Settings > System > Users before allowing access beyond a trusted LAN.",
+      "Configuration uses /.airdcpp on a managed Proxmox volume included in backups. /Downloads and /Share can use managed volumes or explicitly selected host directories.",
+      "Files under /Share are shared by AirDC++. Select the contents deliberately; router forwarding and hub configuration are separate administrator actions.",
+      "PUID and PGID default to 1000 and must be at least 101. The original entrypoint creates the application account; volume ownership follows these values.",
+      "Open HTTP port 5600 on the dedicated LXC address. HTTPS port 5601 uses the upstream self-signed certificate; use a trusted reverse proxy certificate for remote web access.",
+      "Incoming Direct Connect traffic uses TCP and UDP 21248 and TLS TCP 21249. ProxMenux keeps those native ports and does not configure your router."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": "2026-10-25"
+  },
+  "source": {
+    "provider": "gangefors",
+    "repository": "https://github.com/gangefors/docker-airdcpp-webclient",
+    "revision": "37f2e939c152fb2c0158bc83bc76cc972aed965e",
+    "image_repository_url": "https://hub.docker.com/r/gangefors/airdcpp-webclient",
+    "readme_pushed_at": "2026-10-25T11:51:53Z",
+    "compose_sha256": "4ce8aec542cfc3e7f5ca142e309a41f04aca444bd1724ca1741c96acb5c3d5bf",
+    "generated_at": "2026-11-03T11:47:04+00:00",
+    "default_branch": "master",
+    "readme_raw_url": "https://raw.githubusercontent.com/gangefors/docker-airdcpp-webclient/37f2e939c152fb2c0158bc83bc76cc972aed965e/docker-compose.yml"
+  },
+  "container_contract": {
+    "service_name": "airdcpp",
+    "container_name": "airdcpp",
+    "image": {
+      "reference": "docker.io/gangefors/airdcpp-webclient:latest",
+      "registry": "docker.io",
+      "repository": "docker.io/gangefors/airdcpp-webclient",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-written-reference-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "PUID",
+        "example": "1000",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-compose"
+      },
+      {
+        "name": "PGID",
+        "example": "1000",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-compose"
+      },
+      {
+        "name": "UMASK",
+        "example": "0022",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-compose"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "config",
+        "container_path": "/.airdcpp",
+        "compose_source_example": "./config",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 16
+        }
+      },
+      {
+        "id": "downloads",
+        "container_path": "/Downloads",
+        "compose_source_example": "./downloads",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 32
+        }
+      },
+      {
+        "id": "share",
+        "container_path": "/Share",
+        "compose_source_example": "./share",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 32
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 5600,
+        "published_example": 5600,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      },
+      {
+        "container_port": 5601,
+        "published_example": 5601,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      },
+      {
+        "container_port": 21248,
+        "published_example": 21248,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      },
+      {
+        "container_port": 21248,
+        "published_example": 21248,
+        "protocol": "udp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      },
+      {
+        "container_port": 21249,
+        "published_example": 21249,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "name: airdcpp-webclient\nservices:\n  airdcpp:\n    image: docker.io/gangefors/airdcpp-webclient:latest\n    restart: unless-stopped\n    environment:\n      PUID: '1000'\n      PGID: '1000'\n      UMASK: '0022'\n    ports:\n    - 5600:5600\n    - 5601:5601\n    - 21248:21248/tcp\n    - 21248:21248/udp\n    - 21249:21249/tcp\n    volumes:\n    - ./config:/.airdcpp\n    - ./downloads:/Downloads\n    - ./share:/Share\n"
+  },
+  "compose_stack": {
+    "project_name": "airdcpp-webclient",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "airdcpp",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "airdcpp",
+        "image": "docker.io/gangefors/airdcpp-webclient:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "docker.io/gangefors/airdcpp-webclient:latest",
+          "restart": "unless-stopped",
+          "environment": {
+            "PUID": "1000",
+            "PGID": "1000",
+            "UMASK": "0022"
+          },
+          "ports": [
+            "5600:5600",
+            "5601:5601",
+            "21248:21248/tcp",
+            "21248:21248/udp",
+            "21249:21249/tcp"
+          ],
+          "volumes": [
+            "./config:/.airdcpp",
+            "./downloads:/Downloads",
+            "./share:/Share"
+          ]
+        }
+      }
+    ],
+    "top_level": {
+      "name": "airdcpp-webclient"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "airdcpp-volume-0",
+        "service": "airdcpp",
+        "container_path": "/.airdcpp",
+        "mode": "managed-volume",
+        "user_selectable": false,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      },
+      {
+        "id": "airdcpp-volume-1",
+        "service": "airdcpp",
+        "container_path": "/Downloads",
+        "mode": "managed-volume",
+        "user_selectable": false,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      },
+      {
+        "id": "airdcpp-volume-2",
+        "service": "airdcpp",
+        "container_path": "/Share",
+        "mode": "managed-volume",
+        "user_selectable": false,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "airdcpp"
+      ],
+      "stop_order": [
+        "airdcpp"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": []
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Web UI",
+        "scheme": "http",
+        "port": 5600,
+        "path": "/",
+        "source": "https://github.com/gangefors/docker-airdcpp-webclient"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "AirDC++ administrator",
+        "type": "static-default",
+        "username": "admin",
+        "password": "password",
+        "change_required": true,
+        "source": "https://github.com/gangefors/docker-airdcpp-webclient#run-the-application"
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 30
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "volume_preparations": [
+        {
+          "container_path": "/.airdcpp",
+          "remove_lost_found": true,
+          "owner_strategy": "mapped-application-user",
+          "only_when_mount_type": "managed-volume"
+        },
+        {
+          "container_path": "/Downloads",
+          "remove_lost_found": true,
+          "owner_strategy": "mapped-application-user",
+          "only_when_mount_type": "managed-volume"
+        },
+        {
+          "container_path": "/Share",
+          "remove_lost_found": true,
+          "owner_strategy": "mapped-application-user",
+          "only_when_mount_type": "managed-volume"
+        }
+      ],
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 5600,
+        "path": "/index.html",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 5,
+        "stability_seconds": 4,
+        "verify_tls": true
+      }
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "stop_signal",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Community image and single-LXC contract reviewed against the publisher Compose and entrypoint; Linux amd64 confirmed in the registry manifest. Runtime lifecycle checks remain pending."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending",
+    "authenticated_login": "pending",
+    "advanced_install": "pending",
+    "host_bind_storage": "pending",
+    "managed_storage": "pending",
+    "removal": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}
@@ -0,0 +1,453 @@
+{
+  "schema_version": "0.4.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-authelia",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Authelia",
+      "es_ES": "Authelia"
+    },
+    "tagline": {
+      "en_US": "Single sign-on and multi-factor authentication",
+      "es_ES": "Inicio de sesión único y autenticación multifactor"
+    },
+    "description": {
+      "en_US": "An open-source authentication and authorization server for protecting web applications. This single-image profile provides a local SQLite database and file notifications; configure your domain, reverse proxy and access rules before protecting other services.",
+      "es_ES": "Servidor de autenticación y autorización de código abierto para proteger aplicaciones web. Este perfil de una sola imagen incluye una base de datos SQLite local y notificaciones en archivo; configura el dominio, el proxy inverso y las reglas de acceso antes de proteger otros servicios."
+    },
+    "category": "security",
+    "category_label": "Authentication & Security",
+    "author": "Authelia",
+    "developer": "Authelia",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/authelia.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 9091,
+      "path": "/"
+    },
+    "website": "https://www.authelia.com/",
+    "documentation": "https://www.authelia.com/integration/deployment/docker/",
+    "repository": "https://github.com/authelia/authelia",
+    "tips": [
+      "The installer creates a unique admin password and stores only its Argon2id hash in /config/users_database.yml. The password is shown in the installation result.",
+      "Authelia requires an HTTPS portal URL and a cookie domain matching that hostname. If you use Nginx Proxy Manager, follow the official integration guide and configure trusted proxies and forward-auth separately.",
+      "The default notifier writes messages to /config/notification.txt. Configure SMTP in /config/configuration.yml if you want email delivery.",
+      "The initial access-control policy is one_factor. Add explicit access-control rules before attaching Authelia to protected proxy hosts."
+    ],
+    "mini_changelog": [],
+    "display_version": "4.39.28",
+    "updated_at": "2026-09-17"
+  },
+  "source": {
+    "provider": "authelia",
+    "repository": "https://github.com/authelia/authelia",
+    "default_branch": "master",
+    "revision": "8da42b2348b0351c6284a2940a9c5eec3d4cd3fd",
+    "readme_raw_url": "https://raw.githubusercontent.com/authelia/authelia/v4.39.28/examples/compose/lite/compose.yml",
+    "readme_pushed_at": "2026-09-17T12:13:30Z",
+    "compose_sha256": "848ce0f70e502981a050ac200d9d1882978a6c3b0f9f0dfcc6d52ce66ca37fb5",
+    "generated_at": "2026-11-03T09:10:57+00:00",
+    "image_repository_url": "https://hub.docker.com/r/authelia/authelia"
+  },
+  "container_contract": {
+    "service_name": "authelia",
+    "container_name": "authelia",
+    "image": {
+      "reference": "docker.io/authelia/authelia:4.39.28",
+      "registry": "docker.io",
+      "repository": "docker.io/authelia/authelia",
+      "tag": "4.39.28",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "PROXMENUX_ADMIN_PASSWORD",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "proxmenux-first-start"
+      },
+      {
+        "name": "AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "proxmenux-generated"
+      },
+      {
+        "name": "AUTHELIA_SESSION_SECRET",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "proxmenux-generated"
+      },
+      {
+        "name": "AUTHELIA_STORAGE_ENCRYPTION_KEY",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "proxmenux-generated"
+      },
+      {
+        "name": "X_AUTHELIA_CONFIG_FILTERS",
+        "example": "template",
+        "required": true,
+        "sensitive": false,
+        "source": "authelia-container"
+      },
+      {
+        "name": "PROXMENUX_AUTHELIA_COOKIE_DOMAIN",
+        "example": "",
+        "prompt": "Authelia session cookie domain for this portal (for example example.com)",
+        "required": true,
+        "sensitive": false,
+        "source": "administrator"
+      },
+      {
+        "name": "PROXMENUX_AUTHELIA_URL",
+        "example": "",
+        "prompt": "Public HTTPS URL used to open this Authelia portal (for example https://auth.example.com)",
+        "required": true,
+        "sensitive": false,
+        "source": "administrator"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "config",
+        "container_path": "/config",
+        "compose_source_example": "./authelia",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 4
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 9091,
+        "published_example": 9091,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "services:\n  authelia:\n    entrypoint:\n    - /bin/sh\n    - /usr/local/bin/proxmenux-authelia-bootstrap\n    environment:\n      AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET: ${GENERATED_RESET_PASSWORD_JWT_SECRET}\n      AUTHELIA_SESSION_SECRET: ${GENERATED_SESSION_SECRET}\n      AUTHELIA_STORAGE_ENCRYPTION_KEY: ${GENERATED_STORAGE_ENCRYPTION_KEY}\n      PROXMENUX_ADMIN_PASSWORD: ${GENERATED_ADMIN_PASSWORD}\n      PROXMENUX_AUTHELIA_COOKIE_DOMAIN: ${AUTHELIA_COOKIE_DOMAIN}\n      PROXMENUX_AUTHELIA_URL: ${AUTHELIA_URL}\n      X_AUTHELIA_CONFIG_FILTERS: template\n    image: docker.io/authelia/authelia:4.39.28\n    ports:\n    - 9091:9091\n    restart: unless-stopped\n    volumes:\n    - ./authelia:/config\n"
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Authelia Web UI",
+        "scheme": "http",
+        "port": 9091,
+        "path": "/",
+        "source": "official-image"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "Authelia administrator",
+        "type": "configured-or-installer-generated",
+        "username": "admin",
+        "password": null,
+        "password_environment": "PROXMENUX_ADMIN_PASSWORD",
+        "change_required": false,
+        "source": "Generated on first start and stored as an Argon2id hash in the persistent users file."
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 512,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 60
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "installer_profile": {
+      "runtime": {
+        "compose_entrypoint": [
+          "/bin/sh",
+          "/usr/local/bin/proxmenux-authelia-bootstrap"
+        ]
+      },
+      "generated_sensitive_environment": {
+        "PROXMENUX_ADMIN_PASSWORD": {
+          "strategy": "token-hex",
+          "bytes": 24,
+          "prompt": false
+        },
+        "AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET": {
+          "strategy": "token-hex",
+          "bytes": 32,
+          "prompt": false
+        },
+        "AUTHELIA_SESSION_SECRET": {
+          "strategy": "token-hex",
+          "bytes": 32,
+          "prompt": false
+        },
+        "AUTHELIA_STORAGE_ENCRYPTION_KEY": {
+          "strategy": "token-hex",
+          "bytes": 32,
+          "prompt": false
+        }
+      },
+      "minimum_secret_length": {
+        "PROXMENUX_ADMIN_PASSWORD": 24,
+        "AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET": 32,
+        "AUTHELIA_SESSION_SECRET": 32,
+        "AUTHELIA_STORAGE_ENCRYPTION_KEY": 32
+      },
+      "generated_files": [
+        {
+          "container_path": "/config/configuration.yml",
+          "mode": "0600",
+          "owner": "mapped-root",
+          "only_if_missing": true,
+          "content": "---\nserver:\n  address: 'tcp://:9091'\n\nlog:\n  level: 'info'\n\ntotp:\n  issuer: 'Authelia'\n\nidentity_validation:\n  reset_password:\n    jwt_secret: 'configured-by-environment'\n\nauthentication_backend:\n  file:\n    path: '/config/users_database.yml'\n    watch: true\n\naccess_control:\n  default_policy: 'one_factor'\n\nsession:\n  secret: 'configured-by-environment'\n  cookies:\n    - name: 'authelia_session'\n      domain: '{{ env \"PROXMENUX_AUTHELIA_COOKIE_DOMAIN\" }}'\n      authelia_url: '{{ env \"PROXMENUX_AUTHELIA_URL\" }}'\n      expiration: '1 hour'\n      inactivity: '5 minutes'\n\nstorage:\n  encryption_key: 'configured-by-environment'\n  local:\n    path: '/config/db.sqlite3'\n\nnotifier:\n  filesystem:\n    filename: '/config/notification.txt'\n"
+        },
+        {
+          "container_path": "/usr/local/bin/proxmenux-authelia-bootstrap",
+          "mode": "0700",
+          "owner": "mapped-root",
+          "only_if_missing": false,
+          "content": "#!/bin/sh\nset -eu\numask 077\n\nusers_file=/config/users_database.yml\nif [ ! -s \"$users_file\" ]; then\n  : \"${PROXMENUX_ADMIN_PASSWORD:?ProxMenux did not provide an initial administrator password}\"\n  mkdir -p /config\n  hash_output=$(authelia crypto hash generate argon2 --password \"$PROXMENUX_ADMIN_PASSWORD\" --no-confirm)\n  password_hash=$(printf '%s\\n' \"$hash_output\" | sed -n 's/^Digest: //p')\n  case \"$password_hash\" in\n    '$argon2id$'*) ;;\n    *) printf '%s\\n' 'Authelia did not return an Argon2id password hash' >&2; exit 1 ;;\n  esac\n  temporary_file=\"${users_file}.tmp.$$\"\n  cat >\"$temporary_file\" <<EOF\nusers:\n  admin:\n    disabled: false\n    displayname: 'Authelia Administrator'\n    password: \"$password_hash\"\n    groups:\n      - 'admins'\nEOF\n  chmod 0600 \"$temporary_file\"\n  mv -f \"$temporary_file\" \"$users_file\"\nfi\nunset PROXMENUX_ADMIN_PASSWORD\nexec /app/entrypoint.sh \"$@\"\n"
+        }
+      ],
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 9091,
+        "path": "/api/health",
+        "timeout_seconds": 240,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      }
+    },
+    "adaptations": [
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "The application listens on the same container ports at its dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Users open the LXC address instead of the Proxmox host address.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-environment-overlay",
+        "upstream_behavior": "Compose environment values override OCI image environment values.",
+        "native_lxc_behavior": "ProxMenux merges the same values into lxc.environment.runtime while the CT is stopped.",
+        "reason": "PVE imports image Env automatically; Compose values still need to override it.",
+        "behavioral_impact": "None expected.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "stop-grace-period",
+        "upstream_behavior": "Docker waits for Compose stop_grace_period before forcing termination.",
+        "native_lxc_behavior": "ProxMenux records the same timeout for its pct shutdown lifecycle operations.",
+        "reason": "Proxmox has no equivalent per-CT persistent restart-policy field; startup.down is not a shutdown timeout.",
+        "behavioral_impact": "Normal Proxmox node shutdown remains governed by the node-wide shutdown policy.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ]
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "stop_signal",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "A single-image profile for the Authelia authentication portal. ProxMenux creates a unique initial administrator account; the local notifier and SQLite storage are kept in /config. Reverse-proxy trust and explicit access-control rules remain administrator settings."
+  },
+  "validation": {
+    "schema": "pending-local-validation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "replace-rootfs-from-new-oci-image-preserve-managed-volumes",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}
@@ -68,7 +68,7 @@
        "source": "docker-compose"
      },
      {
-        "name": "LLAMA_ARG_CONTEXT_SIZE",
+        "name": "LLAMA_ARG_CTX_SIZE",
        "example": "8192",
        "required": true,
        "sensitive": false,
@@ -142,7 +142,7 @@
          ],
          "environment": [
            "LLAMA_ARG_N_GPU_LAYERS=999",
-            "LLAMA_ARG_CONTEXT_SIZE=8192",
+            "LLAMA_ARG_CTX_SIZE=8192",
            "LLAMA_ARG_MODELS_DIR=/models"
          ],
          "devices": [
@@ -342,6 +342,28 @@
                  "0x1002"
                ]
              }
+            ],
+            "environment": [
+              {
+                "name": "LLAMA_ARG_FLASH_ATTN",
+                "value": "off"
+              },
+              {
+                "name": "LLAMA_ARG_UBATCH",
+                "value": "32"
+              },
+              {
+                "name": "LLAMA_ARG_BATCH",
+                "value": "128"
+              },
+              {
+                "name": "GGML_VK_DISABLE_F16",
+                "value": "1"
+              },
+              {
+                "name": "GGML_VK_DISABLE_ASYNC",
+                "value": "1"
+              }
            ]
          },
          {
@@ -0,0 +1,609 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-movistar-webdav-proxy",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Movistar / O2 Cloud WebDAV Proxy"
+    },
+    "tagline": {
+      "en_US": "Access Movistar and O2 Cloud from WebDAV clients and backup tools."
+    },
+    "description": {
+      "en_US": "Official uniextra image with a web dashboard for Movistar/O2 Cloud account linking. Persistent OAuth credentials, authenticated WebDAV and disk-backed temporary uploads."
+    },
+    "category": "backup",
+    "category_label": "Backup & Recovery",
+    "author": "uniextra",
+    "developer": "uniextra",
+    "icon": "https://raw.githubusercontent.com/uniextra/MovistarWebDAVProxy/main/static/favicon.svg",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 5000,
+      "path": "/"
+    },
+    "website": "https://github.com/uniextra/MovistarWebDAVProxy",
+    "documentation": "https://github.com/uniextra/MovistarWebDAVProxy#readme",
+    "repository": "https://github.com/uniextra/MovistarWebDAVProxy",
+    "tips": [
+      "Link your Movistar or O2 account from the dashboard after installation.",
+      "Use the container IP and port 8080 for WebDAV. Docker's published port 5050 is not used by native OCI LXC.",
+      "Temporary uploads use a separate disk volume, excluded from backups, to avoid filling RAM."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "uniextra",
+    "repository": "https://github.com/uniextra/MovistarWebDAVProxy",
+    "revision": "e48485bc8bdf9745caa6249fdc92db6d28214549",
+    "image_repository_url": "https://hub.docker.com/r/uniextra/movistar-webdav-proxy",
+    "readme_pushed_at": "",
+    "compose_sha256": "e51607e979c1a776ececda038caeffb4195f443ebc017eba753a4b4ff8fd5c28",
+    "generated_at": "2026-11-02T23:42:04+00:00",
+    "readme_raw_url": "https://raw.githubusercontent.com/uniextra/MovistarWebDAVProxy/e48485bc8bdf9745caa6249fdc92db6d28214549/README.md"
+  },
+  "container_contract": {
+    "service_name": "movistar-webdav-proxy",
+    "container_name": "movistar-webdav-proxy",
+    "image": {
+      "reference": "uniextra/movistar-webdav-proxy:latest",
+      "registry": "docker.io",
+      "repository": "uniextra/movistar-webdav-proxy",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-written-reference-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "WEBDAV_USER",
+        "example": "admin",
+        "required": true,
+        "sensitive": false,
+        "source": "docker-compose"
+      },
+      {
+        "name": "WEBDAV_PASSWORD",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "docker-compose",
+        "prompt": "WebDAV and dashboard password (leave empty to generate)"
+      },
+      {
+        "name": "REQUIRE_AUTH",
+        "example": "true",
+        "required": true,
+        "sensitive": false,
+        "source": "docker-compose"
+      },
+      {
+        "name": "TOKENS_ENCRYPTION_KEY",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "docker-compose"
+      },
+      {
+        "name": "MAX_UPLOAD_MB",
+        "example": "4096",
+        "required": false,
+        "sensitive": false,
+        "source": "docker-compose"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "tokens",
+        "container_path": "/app/tokens",
+        "compose_source_example": "./tokens",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 16
+        }
+      },
+      {
+        "id": "uploads",
+        "container_path": "/tmp",
+        "compose_source_example": "./tmp",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 16
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 5000,
+        "published_example": 5000,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      },
+      {
+        "container_port": 8080,
+        "published_example": 8080,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "services:\n  movistar-webdav-proxy:\n    image: uniextra/movistar-webdav-proxy:v2.1.0\n    container_name: movistar-webdav-proxy\n    restart: unless-stopped\n    read_only: true\n    tmpfs:\n      - /tmp\n    security_opt:\n      - no-new-privileges:true\n    environment:\n      - WEBDAV_USER=${WEBDAV_USER:-}\n      - WEBDAV_PASSWORD=${WEBDAV_PASSWORD:-}\n      - WEBUI_USER=${WEBUI_USER:-}\n      - WEBUI_PASSWORD=${WEBUI_PASSWORD:-}\n    ports:\n      - \"${BIND_IP:-0.0.0.0}:${WEB_PORT:-5000}:5000\"      # Panel Web de gestión y logs (usa BIND_IP=127.0.0.1 para acceso solo local)\n      - \"${BIND_IP:-0.0.0.0}:${WEBDAV_PORT:-5050}:8080\"   # Endpoint WebDAV (Duplicati / Synology HyperBackup)\n    volumes:\n      - movistar_tokens:/app/tokens\n\nvolumes:\n  movistar_tokens:\n    name: movistar_webdav_tokens\n"
+  },
+  "compose_stack": {
+    "project_name": "movistar-webdav-proxy",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "movistar-webdav-proxy",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "movistar-webdav-proxy",
+        "image": "uniextra/movistar-webdav-proxy:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "environment": {
+            "MAX_UPLOAD_MB": "4096",
+            "REQUIRE_AUTH": "true",
+            "TOKENS_ENCRYPTION_KEY": "${GENERATED_TOKENS_ENCRYPTION_KEY}",
+            "WEBDAV_PASSWORD": "${GENERATED_WEBDAV_PASSWORD}",
+            "WEBDAV_USER": "admin"
+          },
+          "image": "uniextra/movistar-webdav-proxy:latest",
+          "ports": [
+            "5000:5000",
+            "8080:8080"
+          ],
+          "volumes": [
+            "./tokens:/app/tokens",
+            "./tmp:/tmp"
+          ]
+        }
+      }
+    ],
+    "top_level": {
+      "name": "movistar-webdav-proxy"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "movistar-webdav-proxy-volume-0",
+        "service": "movistar-webdav-proxy",
+        "container_path": "/app/tokens",
+        "mode": "managed-volume",
+        "user_selectable": false,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      },
+      {
+        "id": "movistar-webdav-proxy-volume-1",
+        "service": "movistar-webdav-proxy",
+        "container_path": "/tmp",
+        "mode": "managed-volume",
+        "user_selectable": false,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "movistar-webdav-proxy"
+      ],
+      "stop_order": [
+        "movistar-webdav-proxy"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": [
+        {
+          "id": "tokens-encryption-key",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "movistar-webdav-proxy",
+              "environment_variable": "TOKENS_ENCRYPTION_KEY"
+            }
+          ]
+        },
+        {
+          "id": "webdav-password",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "movistar-webdav-proxy",
+              "environment_variable": "WEBDAV_PASSWORD"
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Web dashboard",
+        "scheme": "http",
+        "port": 5000,
+        "path": "/",
+        "source": "upstream-documentation"
+      },
+      {
+        "label": "WebDAV",
+        "scheme": "http",
+        "port": 8080,
+        "path": "/",
+        "source": "native-container-port"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "Web dashboard and WebDAV",
+        "type": "configured-or-installer-generated",
+        "username": "admin",
+        "username_environment": "WEBDAV_USER",
+        "password": null,
+        "password_environment": "WEBDAV_PASSWORD",
+        "change_required": false,
+        "source": "installer-generated",
+        "retrieval": null
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 1,
+      "memory_mb": 512,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 30
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "disk-backed-upload-scratch",
+        "upstream_behavior": "Compose mounts /tmp as a tmpfs.",
+        "native_lxc_behavior": "A separate managed disk volume provides /tmp and is excluded from backups.",
+        "reason": "Uploads can reach 4096 MB; a disk-backed scratch volume avoids consuming the LXC RAM limit.",
+        "behavioral_impact": "Scratch data uses disk and can survive a restart; the application removes completed temporary uploads.",
+        "validation": "passed-in-lab"
+      },
+      {
+        "id": "native-rootfs-permissions",
+        "upstream_behavior": "Docker Compose requests read_only for the root filesystem.",
+        "native_lxc_behavior": "Proxmox uses a writable native root disk; /app is owned by root, while the upstream entrypoint drops to UID 10001. Tokens and upload scratch have separate writable volumes.",
+        "reason": "The Proxmox pre-start setup requires a writable root disk. Protect application code through root ownership instead of declaring unsupported read-only startup.",
+        "behavioral_impact": "This is not a fully read-only root filesystem; the application user cannot replace the root-owned application directory or binaries.",
+        "validation": "passed-in-lab"
+      }
+    ],
+    "installer_profile": {
+      "volume_preparations": [
+        {
+          "container_path": "/app",
+          "remove_lost_found": false,
+          "owner_strategy": "mapped-root",
+          "mode": "0755"
+        },
+        {
+          "container_path": "/app/tokens",
+          "remove_lost_found": true,
+          "owner_strategy": "mapped-application-user",
+          "mode": "0700"
+        },
+        {
+          "container_path": "/tmp",
+          "remove_lost_found": true,
+          "owner_strategy": "mapped-application-user",
+          "mode": "1777"
+        }
+      ],
+      "volume_owner": {
+        "uid": 10001,
+        "gid": 10001
+      },
+      "generated_sensitive_environment": {
+        "WEBDAV_PASSWORD": {
+          "strategy": "token-hex",
+          "bytes": 16,
+          "prompt": true
+        },
+        "TOKENS_ENCRYPTION_KEY": {
+          "strategy": "token-hex",
+          "bytes": 32,
+          "prompt": false
+        }
+      },
+      "security": {
+        "options": {
+          "no_new_privileges": true
+        }
+      },
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 5000,
+        "path": "/health",
+        "timeout_seconds": 90,
+        "request_timeout_seconds": 5,
+        "stability_seconds": 4,
+        "verify_tls": false
+      },
+      "completion_notes": [
+        "Open the web dashboard and link your Movistar/O2 account using its SMS flow.",
+        "WebDAV is available on container port 8080. Account linking is required before cloud file operations."
+      ]
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "stop_signal",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "passed",
+    "service_health": "passed",
+    "restart_persistence": "passed",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}
@@ -82,22 +82,6 @@
          "backup": true,
          "default_size_gb": 8
        }
-      },
-      {
-        "id": "volume-1",
-        "container_path": "/dev/net/tun",
-        "compose_source_example": "/dev/net/tun",
-        "read_only": false,
-        "required": true,
-        "installation_choice": [
-          "managed-volume",
-          "host-bind"
-        ],
-        "default": "managed-volume",
-        "managed_volume": {
-          "backup": true,
-          "default_size_gb": 8
-        }
      }
    ],
    "ports": [],
@@ -180,17 +164,6 @@
        "shared_with_other_lxc": false,
        "source_path": null,
        "source_path_prompt": null
-      },
-      {
-        "id": "tailscale-volume-1",
-        "service": "tailscale",
-        "container_path": "/dev/net/tun",
-        "mode": "managed-volume",
-        "user_selectable": false,
-        "backup": true,
-        "shared_with_other_lxc": false,
-        "source_path": null,
-        "source_path_prompt": null
      }
    ],
    "orchestration": {
@@ -288,6 +261,23 @@
          "owner_strategy": "mapped-root",
          "only_when_mount_type": "managed-volume"
        }
+      ],
+      "device_requests": [
+        {
+          "id": "dev-net-tun",
+          "kind": "character-device",
+          "purpose": "tun",
+          "enable_prompt": "Pass /dev/net/tun to the LXC",
+          "enabled_default": true,
+          "required_by_compose": true,
+          "path_prompt": "Host device for /dev/net/tun",
+          "host_path_default": "/dev/net/tun",
+          "container_path": "/dev/net/tun",
+          "mode": "preserve-host",
+          "deny_write": false,
+          "gid_strategy": "host-device-gid",
+          "source_mapping": "/dev/net/tun:/dev/net/tun"
+        }
      ]
    },
    "adaptations": [
@@ -0,0 +1,585 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-airdcpp-webclient",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "AirDC++ Web Client",
+      "es_ES": "AirDC++ Web Client"
+    },
+    "tagline": {
+      "en_US": "Direct Connect file sharing with a web interface",
+      "es_ES": "Intercambio de archivos Direct Connect con interfaz web"
+    },
+    "description": {
+      "en_US": "AirDC++ Web Client using the community-maintained gangefors image. Configuration, downloads and shared content use separate persistent paths.",
+      "es_ES": "AirDC++ Web Client con la imagen comunitaria de gangefors. La configuración, las descargas y los archivos compartidos usan rutas persistentes separadas."
+    },
+    "category": "downloads",
+    "category_label": "Files & Downloads",
+    "author": "gangefors",
+    "developer": "AirDC++",
+    "icon": "https://raw.githubusercontent.com/airdcpp-web/airdcpp-webui/eeeea5025a5e720f38dac53ced8e002940f00a74/resources/images/logo.svg",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 5600,
+      "path": "/"
+    },
+    "website": "https://airdcpp-web.github.io/",
+    "documentation": "https://github.com/gangefors/docker-airdcpp-webclient",
+    "repository": "https://github.com/gangefors/docker-airdcpp-webclient",
+    "tips": [
+      "The upstream initial login is admin / password. Change it in Settings > System > Users before allowing access beyond a trusted LAN.",
+      "Configuration uses /.airdcpp on a managed Proxmox volume included in backups. /Downloads and /Share can use managed volumes or explicitly selected host directories.",
+      "Files under /Share are shared by AirDC++. Select the contents deliberately; router forwarding and hub configuration are separate administrator actions.",
+      "PUID and PGID default to 1000 and must be at least 101. The original entrypoint creates the application account; volume ownership follows these values.",
+      "Open HTTP port 5600 on the dedicated LXC address. HTTPS port 5601 uses the upstream self-signed certificate; use a trusted reverse proxy certificate for remote web access.",
+      "Incoming Direct Connect traffic uses TCP and UDP 21248 and TLS TCP 21249. ProxMenux keeps those native ports and does not configure your router."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": "2026-10-25"
+  },
+  "source": {
+    "provider": "gangefors",
+    "repository": "https://github.com/gangefors/docker-airdcpp-webclient",
+    "revision": "37f2e939c152fb2c0158bc83bc76cc972aed965e",
+    "image_repository_url": "https://hub.docker.com/r/gangefors/airdcpp-webclient",
+    "readme_pushed_at": "2026-10-25T11:51:53Z",
+    "compose_sha256": "4ce8aec542cfc3e7f5ca142e309a41f04aca444bd1724ca1741c96acb5c3d5bf",
+    "generated_at": "2026-11-03T11:47:04+00:00",
+    "default_branch": "master",
+    "readme_raw_url": "https://raw.githubusercontent.com/gangefors/docker-airdcpp-webclient/37f2e939c152fb2c0158bc83bc76cc972aed965e/docker-compose.yml"
+  },
+  "container_contract": {
+    "service_name": "airdcpp",
+    "container_name": "airdcpp",
+    "image": {
+      "reference": "docker.io/gangefors/airdcpp-webclient:latest",
+      "registry": "docker.io",
+      "repository": "docker.io/gangefors/airdcpp-webclient",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-written-reference-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "PUID",
+        "example": "1000",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-compose"
+      },
+      {
+        "name": "PGID",
+        "example": "1000",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-compose"
+      },
+      {
+        "name": "UMASK",
+        "example": "0022",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-compose"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "config",
+        "container_path": "/.airdcpp",
+        "compose_source_example": "./config",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 16
+        }
+      },
+      {
+        "id": "downloads",
+        "container_path": "/Downloads",
+        "compose_source_example": "./downloads",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 32
+        }
+      },
+      {
+        "id": "share",
+        "container_path": "/Share",
+        "compose_source_example": "./share",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 32
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 5600,
+        "published_example": 5600,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      },
+      {
+        "container_port": 5601,
+        "published_example": 5601,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      },
+      {
+        "container_port": 21248,
+        "published_example": 21248,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      },
+      {
+        "container_port": 21248,
+        "published_example": 21248,
+        "protocol": "udp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      },
+      {
+        "container_port": 21249,
+        "published_example": 21249,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "name: airdcpp-webclient\nservices:\n  airdcpp:\n    image: docker.io/gangefors/airdcpp-webclient:latest\n    restart: unless-stopped\n    environment:\n      PUID: '1000'\n      PGID: '1000'\n      UMASK: '0022'\n    ports:\n    - 5600:5600\n    - 5601:5601\n    - 21248:21248/tcp\n    - 21248:21248/udp\n    - 21249:21249/tcp\n    volumes:\n    - ./config:/.airdcpp\n    - ./downloads:/Downloads\n    - ./share:/Share\n"
+  },
+  "compose_stack": {
+    "project_name": "airdcpp-webclient",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "airdcpp",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "airdcpp",
+        "image": "docker.io/gangefors/airdcpp-webclient:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "docker.io/gangefors/airdcpp-webclient:latest",
+          "restart": "unless-stopped",
+          "environment": {
+            "PUID": "1000",
+            "PGID": "1000",
+            "UMASK": "0022"
+          },
+          "ports": [
+            "5600:5600",
+            "5601:5601",
+            "21248:21248/tcp",
+            "21248:21248/udp",
+            "21249:21249/tcp"
+          ],
+          "volumes": [
+            "./config:/.airdcpp",
+            "./downloads:/Downloads",
+            "./share:/Share"
+          ]
+        }
+      }
+    ],
+    "top_level": {
+      "name": "airdcpp-webclient"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "airdcpp-volume-0",
+        "service": "airdcpp",
+        "container_path": "/.airdcpp",
+        "mode": "managed-volume",
+        "user_selectable": false,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      },
+      {
+        "id": "airdcpp-volume-1",
+        "service": "airdcpp",
+        "container_path": "/Downloads",
+        "mode": "managed-volume",
+        "user_selectable": false,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      },
+      {
+        "id": "airdcpp-volume-2",
+        "service": "airdcpp",
+        "container_path": "/Share",
+        "mode": "managed-volume",
+        "user_selectable": false,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "airdcpp"
+      ],
+      "stop_order": [
+        "airdcpp"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": []
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Web UI",
+        "scheme": "http",
+        "port": 5600,
+        "path": "/",
+        "source": "https://github.com/gangefors/docker-airdcpp-webclient"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "AirDC++ administrator",
+        "type": "static-default",
+        "username": "admin",
+        "password": "password",
+        "change_required": true,
+        "source": "https://github.com/gangefors/docker-airdcpp-webclient#run-the-application"
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 30
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "volume_preparations": [
+        {
+          "container_path": "/.airdcpp",
+          "remove_lost_found": true,
+          "owner_strategy": "mapped-application-user",
+          "only_when_mount_type": "managed-volume"
+        },
+        {
+          "container_path": "/Downloads",
+          "remove_lost_found": true,
+          "owner_strategy": "mapped-application-user",
+          "only_when_mount_type": "managed-volume"
+        },
+        {
+          "container_path": "/Share",
+          "remove_lost_found": true,
+          "owner_strategy": "mapped-application-user",
+          "only_when_mount_type": "managed-volume"
+        }
+      ],
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 5600,
+        "path": "/index.html",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 5,
+        "stability_seconds": 4,
+        "verify_tls": true
+      }
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "stop_signal",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Community image and single-LXC contract reviewed against the publisher Compose and entrypoint; Linux amd64 confirmed in the registry manifest. Runtime lifecycle checks remain pending."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending",
+    "authenticated_login": "pending",
+    "advanced_install": "pending",
+    "host_bind_storage": "pending",
+    "managed_storage": "pending",
+    "removal": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}
@@ -0,0 +1,453 @@
+{
+  "schema_version": "0.4.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-authelia",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Authelia",
+      "es_ES": "Authelia"
+    },
+    "tagline": {
+      "en_US": "Single sign-on and multi-factor authentication",
+      "es_ES": "Inicio de sesión único y autenticación multifactor"
+    },
+    "description": {
+      "en_US": "An open-source authentication and authorization server for protecting web applications. This single-image profile provides a local SQLite database and file notifications; configure your domain, reverse proxy and access rules before protecting other services.",
+      "es_ES": "Servidor de autenticación y autorización de código abierto para proteger aplicaciones web. Este perfil de una sola imagen incluye una base de datos SQLite local y notificaciones en archivo; configura el dominio, el proxy inverso y las reglas de acceso antes de proteger otros servicios."
+    },
+    "category": "security",
+    "category_label": "Authentication & Security",
+    "author": "Authelia",
+    "developer": "Authelia",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/authelia.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 9091,
+      "path": "/"
+    },
+    "website": "https://www.authelia.com/",
+    "documentation": "https://www.authelia.com/integration/deployment/docker/",
+    "repository": "https://github.com/authelia/authelia",
+    "tips": [
+      "The installer creates a unique admin password and stores only its Argon2id hash in /config/users_database.yml. The password is shown in the installation result.",
+      "Authelia requires an HTTPS portal URL and a cookie domain matching that hostname. If you use Nginx Proxy Manager, follow the official integration guide and configure trusted proxies and forward-auth separately.",
+      "The default notifier writes messages to /config/notification.txt. Configure SMTP in /config/configuration.yml if you want email delivery.",
+      "The initial access-control policy is one_factor. Add explicit access-control rules before attaching Authelia to protected proxy hosts."
+    ],
+    "mini_changelog": [],
+    "display_version": "4.39.28",
+    "updated_at": "2026-09-17"
+  },
+  "source": {
+    "provider": "authelia",
+    "repository": "https://github.com/authelia/authelia",
+    "default_branch": "master",
+    "revision": "8da42b2348b0351c6284a2940a9c5eec3d4cd3fd",
+    "readme_raw_url": "https://raw.githubusercontent.com/authelia/authelia/v4.39.28/examples/compose/lite/compose.yml",
+    "readme_pushed_at": "2026-09-17T12:13:30Z",
+    "compose_sha256": "848ce0f70e502981a050ac200d9d1882978a6c3b0f9f0dfcc6d52ce66ca37fb5",
+    "generated_at": "2026-11-03T09:10:57+00:00",
+    "image_repository_url": "https://hub.docker.com/r/authelia/authelia"
+  },
+  "container_contract": {
+    "service_name": "authelia",
+    "container_name": "authelia",
+    "image": {
+      "reference": "docker.io/authelia/authelia:4.39.28",
+      "registry": "docker.io",
+      "repository": "docker.io/authelia/authelia",
+      "tag": "4.39.28",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "PROXMENUX_ADMIN_PASSWORD",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "proxmenux-first-start"
+      },
+      {
+        "name": "AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "proxmenux-generated"
+      },
+      {
+        "name": "AUTHELIA_SESSION_SECRET",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "proxmenux-generated"
+      },
+      {
+        "name": "AUTHELIA_STORAGE_ENCRYPTION_KEY",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "proxmenux-generated"
+      },
+      {
+        "name": "X_AUTHELIA_CONFIG_FILTERS",
+        "example": "template",
+        "required": true,
+        "sensitive": false,
+        "source": "authelia-container"
+      },
+      {
+        "name": "PROXMENUX_AUTHELIA_COOKIE_DOMAIN",
+        "example": "",
+        "prompt": "Authelia session cookie domain for this portal (for example example.com)",
+        "required": true,
+        "sensitive": false,
+        "source": "administrator"
+      },
+      {
+        "name": "PROXMENUX_AUTHELIA_URL",
+        "example": "",
+        "prompt": "Public HTTPS URL used to open this Authelia portal (for example https://auth.example.com)",
+        "required": true,
+        "sensitive": false,
+        "source": "administrator"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "config",
+        "container_path": "/config",
+        "compose_source_example": "./authelia",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 4
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 9091,
+        "published_example": 9091,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "services:\n  authelia:\n    entrypoint:\n    - /bin/sh\n    - /usr/local/bin/proxmenux-authelia-bootstrap\n    environment:\n      AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET: ${GENERATED_RESET_PASSWORD_JWT_SECRET}\n      AUTHELIA_SESSION_SECRET: ${GENERATED_SESSION_SECRET}\n      AUTHELIA_STORAGE_ENCRYPTION_KEY: ${GENERATED_STORAGE_ENCRYPTION_KEY}\n      PROXMENUX_ADMIN_PASSWORD: ${GENERATED_ADMIN_PASSWORD}\n      PROXMENUX_AUTHELIA_COOKIE_DOMAIN: ${AUTHELIA_COOKIE_DOMAIN}\n      PROXMENUX_AUTHELIA_URL: ${AUTHELIA_URL}\n      X_AUTHELIA_CONFIG_FILTERS: template\n    image: docker.io/authelia/authelia:4.39.28\n    ports:\n    - 9091:9091\n    restart: unless-stopped\n    volumes:\n    - ./authelia:/config\n"
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Authelia Web UI",
+        "scheme": "http",
+        "port": 9091,
+        "path": "/",
+        "source": "official-image"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "Authelia administrator",
+        "type": "configured-or-installer-generated",
+        "username": "admin",
+        "password": null,
+        "password_environment": "PROXMENUX_ADMIN_PASSWORD",
+        "change_required": false,
+        "source": "Generated on first start and stored as an Argon2id hash in the persistent users file."
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 512,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 60
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "installer_profile": {
+      "runtime": {
+        "compose_entrypoint": [
+          "/bin/sh",
+          "/usr/local/bin/proxmenux-authelia-bootstrap"
+        ]
+      },
+      "generated_sensitive_environment": {
+        "PROXMENUX_ADMIN_PASSWORD": {
+          "strategy": "token-hex",
+          "bytes": 24,
+          "prompt": false
+        },
+        "AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET": {
+          "strategy": "token-hex",
+          "bytes": 32,
+          "prompt": false
+        },
+        "AUTHELIA_SESSION_SECRET": {
+          "strategy": "token-hex",
+          "bytes": 32,
+          "prompt": false
+        },
+        "AUTHELIA_STORAGE_ENCRYPTION_KEY": {
+          "strategy": "token-hex",
+          "bytes": 32,
+          "prompt": false
+        }
+      },
+      "minimum_secret_length": {
+        "PROXMENUX_ADMIN_PASSWORD": 24,
+        "AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET": 32,
+        "AUTHELIA_SESSION_SECRET": 32,
+        "AUTHELIA_STORAGE_ENCRYPTION_KEY": 32
+      },
+      "generated_files": [
+        {
+          "container_path": "/config/configuration.yml",
+          "mode": "0600",
+          "owner": "mapped-root",
+          "only_if_missing": true,
+          "content": "---\nserver:\n  address: 'tcp://:9091'\n\nlog:\n  level: 'info'\n\ntotp:\n  issuer: 'Authelia'\n\nidentity_validation:\n  reset_password:\n    jwt_secret: 'configured-by-environment'\n\nauthentication_backend:\n  file:\n    path: '/config/users_database.yml'\n    watch: true\n\naccess_control:\n  default_policy: 'one_factor'\n\nsession:\n  secret: 'configured-by-environment'\n  cookies:\n    - name: 'authelia_session'\n      domain: '{{ env \"PROXMENUX_AUTHELIA_COOKIE_DOMAIN\" }}'\n      authelia_url: '{{ env \"PROXMENUX_AUTHELIA_URL\" }}'\n      expiration: '1 hour'\n      inactivity: '5 minutes'\n\nstorage:\n  encryption_key: 'configured-by-environment'\n  local:\n    path: '/config/db.sqlite3'\n\nnotifier:\n  filesystem:\n    filename: '/config/notification.txt'\n"
+        },
+        {
+          "container_path": "/usr/local/bin/proxmenux-authelia-bootstrap",
+          "mode": "0700",
+          "owner": "mapped-root",
+          "only_if_missing": false,
+          "content": "#!/bin/sh\nset -eu\numask 077\n\nusers_file=/config/users_database.yml\nif [ ! -s \"$users_file\" ]; then\n  : \"${PROXMENUX_ADMIN_PASSWORD:?ProxMenux did not provide an initial administrator password}\"\n  mkdir -p /config\n  hash_output=$(authelia crypto hash generate argon2 --password \"$PROXMENUX_ADMIN_PASSWORD\" --no-confirm)\n  password_hash=$(printf '%s\\n' \"$hash_output\" | sed -n 's/^Digest: //p')\n  case \"$password_hash\" in\n    '$argon2id$'*) ;;\n    *) printf '%s\\n' 'Authelia did not return an Argon2id password hash' >&2; exit 1 ;;\n  esac\n  temporary_file=\"${users_file}.tmp.$$\"\n  cat >\"$temporary_file\" <<EOF\nusers:\n  admin:\n    disabled: false\n    displayname: 'Authelia Administrator'\n    password: \"$password_hash\"\n    groups:\n      - 'admins'\nEOF\n  chmod 0600 \"$temporary_file\"\n  mv -f \"$temporary_file\" \"$users_file\"\nfi\nunset PROXMENUX_ADMIN_PASSWORD\nexec /app/entrypoint.sh \"$@\"\n"
+        }
+      ],
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 9091,
+        "path": "/api/health",
+        "timeout_seconds": 240,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      }
+    },
+    "adaptations": [
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "The application listens on the same container ports at its dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Users open the LXC address instead of the Proxmox host address.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-environment-overlay",
+        "upstream_behavior": "Compose environment values override OCI image environment values.",
+        "native_lxc_behavior": "ProxMenux merges the same values into lxc.environment.runtime while the CT is stopped.",
+        "reason": "PVE imports image Env automatically; Compose values still need to override it.",
+        "behavioral_impact": "None expected.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "stop-grace-period",
+        "upstream_behavior": "Docker waits for Compose stop_grace_period before forcing termination.",
+        "native_lxc_behavior": "ProxMenux records the same timeout for its pct shutdown lifecycle operations.",
+        "reason": "Proxmox has no equivalent per-CT persistent restart-policy field; startup.down is not a shutdown timeout.",
+        "behavioral_impact": "Normal Proxmox node shutdown remains governed by the node-wide shutdown policy.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ]
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "stop_signal",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "A single-image profile for the Authelia authentication portal. ProxMenux creates a unique initial administrator account; the local notifier and SQLite storage are kept in /config. Reverse-proxy trust and explicit access-control rules remain administrator settings."
+  },
+  "validation": {
+    "schema": "pending-local-validation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "replace-rootfs-from-new-oci-image-preserve-managed-volumes",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}
@@ -68,7 +68,7 @@
        "source": "docker-compose"
      },
      {
-        "name": "LLAMA_ARG_CONTEXT_SIZE",
+        "name": "LLAMA_ARG_CTX_SIZE",
        "example": "8192",
        "required": true,
        "sensitive": false,
@@ -142,7 +142,7 @@
          ],
          "environment": [
            "LLAMA_ARG_N_GPU_LAYERS=999",
-            "LLAMA_ARG_CONTEXT_SIZE=8192",
+            "LLAMA_ARG_CTX_SIZE=8192",
            "LLAMA_ARG_MODELS_DIR=/models"
          ],
          "devices": [
@@ -342,6 +342,28 @@
                  "0x1002"
                ]
              }
+            ],
+            "environment": [
+              {
+                "name": "LLAMA_ARG_FLASH_ATTN",
+                "value": "off"
+              },
+              {
+                "name": "LLAMA_ARG_UBATCH",
+                "value": "32"
+              },
+              {
+                "name": "LLAMA_ARG_BATCH",
+                "value": "128"
+              },
+              {
+                "name": "GGML_VK_DISABLE_F16",
+                "value": "1"
+              },
+              {
+                "name": "GGML_VK_DISABLE_ASYNC",
+                "value": "1"
+              }
            ]
          },
          {
@@ -0,0 +1,609 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-movistar-webdav-proxy",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Movistar / O2 Cloud WebDAV Proxy"
+    },
+    "tagline": {
+      "en_US": "Access Movistar and O2 Cloud from WebDAV clients and backup tools."
+    },
+    "description": {
+      "en_US": "Official uniextra image with a web dashboard for Movistar/O2 Cloud account linking. Persistent OAuth credentials, authenticated WebDAV and disk-backed temporary uploads."
+    },
+    "category": "backup",
+    "category_label": "Backup & Recovery",
+    "author": "uniextra",
+    "developer": "uniextra",
+    "icon": "https://raw.githubusercontent.com/uniextra/MovistarWebDAVProxy/main/static/favicon.svg",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 5000,
+      "path": "/"
+    },
+    "website": "https://github.com/uniextra/MovistarWebDAVProxy",
+    "documentation": "https://github.com/uniextra/MovistarWebDAVProxy#readme",
+    "repository": "https://github.com/uniextra/MovistarWebDAVProxy",
+    "tips": [
+      "Link your Movistar or O2 account from the dashboard after installation.",
+      "Use the container IP and port 8080 for WebDAV. Docker's published port 5050 is not used by native OCI LXC.",
+      "Temporary uploads use a separate disk volume, excluded from backups, to avoid filling RAM."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "uniextra",
+    "repository": "https://github.com/uniextra/MovistarWebDAVProxy",
+    "revision": "e48485bc8bdf9745caa6249fdc92db6d28214549",
+    "image_repository_url": "https://hub.docker.com/r/uniextra/movistar-webdav-proxy",
+    "readme_pushed_at": "",
+    "compose_sha256": "e51607e979c1a776ececda038caeffb4195f443ebc017eba753a4b4ff8fd5c28",
+    "generated_at": "2026-11-02T23:42:04+00:00",
+    "readme_raw_url": "https://raw.githubusercontent.com/uniextra/MovistarWebDAVProxy/e48485bc8bdf9745caa6249fdc92db6d28214549/README.md"
+  },
+  "container_contract": {
+    "service_name": "movistar-webdav-proxy",
+    "container_name": "movistar-webdav-proxy",
+    "image": {
+      "reference": "uniextra/movistar-webdav-proxy:latest",
+      "registry": "docker.io",
+      "repository": "uniextra/movistar-webdav-proxy",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-written-reference-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "WEBDAV_USER",
+        "example": "admin",
+        "required": true,
+        "sensitive": false,
+        "source": "docker-compose"
+      },
+      {
+        "name": "WEBDAV_PASSWORD",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "docker-compose",
+        "prompt": "WebDAV and dashboard password (leave empty to generate)"
+      },
+      {
+        "name": "REQUIRE_AUTH",
+        "example": "true",
+        "required": true,
+        "sensitive": false,
+        "source": "docker-compose"
+      },
+      {
+        "name": "TOKENS_ENCRYPTION_KEY",
+        "example": "",
+        "required": true,
+        "sensitive": true,
+        "source": "docker-compose"
+      },
+      {
+        "name": "MAX_UPLOAD_MB",
+        "example": "4096",
+        "required": false,
+        "sensitive": false,
+        "source": "docker-compose"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "tokens",
+        "container_path": "/app/tokens",
+        "compose_source_example": "./tokens",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 16
+        }
+      },
+      {
+        "id": "uploads",
+        "container_path": "/tmp",
+        "compose_source_example": "./tmp",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 16
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 5000,
+        "published_example": 5000,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      },
+      {
+        "container_port": 8080,
+        "published_example": 8080,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "services:\n  movistar-webdav-proxy:\n    image: uniextra/movistar-webdav-proxy:v2.1.0\n    container_name: movistar-webdav-proxy\n    restart: unless-stopped\n    read_only: true\n    tmpfs:\n      - /tmp\n    security_opt:\n      - no-new-privileges:true\n    environment:\n      - WEBDAV_USER=${WEBDAV_USER:-}\n      - WEBDAV_PASSWORD=${WEBDAV_PASSWORD:-}\n      - WEBUI_USER=${WEBUI_USER:-}\n      - WEBUI_PASSWORD=${WEBUI_PASSWORD:-}\n    ports:\n      - \"${BIND_IP:-0.0.0.0}:${WEB_PORT:-5000}:5000\"      # Panel Web de gestión y logs (usa BIND_IP=127.0.0.1 para acceso solo local)\n      - \"${BIND_IP:-0.0.0.0}:${WEBDAV_PORT:-5050}:8080\"   # Endpoint WebDAV (Duplicati / Synology HyperBackup)\n    volumes:\n      - movistar_tokens:/app/tokens\n\nvolumes:\n  movistar_tokens:\n    name: movistar_webdav_tokens\n"
+  },
+  "compose_stack": {
+    "project_name": "movistar-webdav-proxy",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "movistar-webdav-proxy",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "movistar-webdav-proxy",
+        "image": "uniextra/movistar-webdav-proxy:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "environment": {
+            "MAX_UPLOAD_MB": "4096",
+            "REQUIRE_AUTH": "true",
+            "TOKENS_ENCRYPTION_KEY": "${GENERATED_TOKENS_ENCRYPTION_KEY}",
+            "WEBDAV_PASSWORD": "${GENERATED_WEBDAV_PASSWORD}",
+            "WEBDAV_USER": "admin"
+          },
+          "image": "uniextra/movistar-webdav-proxy:latest",
+          "ports": [
+            "5000:5000",
+            "8080:8080"
+          ],
+          "volumes": [
+            "./tokens:/app/tokens",
+            "./tmp:/tmp"
+          ]
+        }
+      }
+    ],
+    "top_level": {
+      "name": "movistar-webdav-proxy"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "movistar-webdav-proxy-volume-0",
+        "service": "movistar-webdav-proxy",
+        "container_path": "/app/tokens",
+        "mode": "managed-volume",
+        "user_selectable": false,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      },
+      {
+        "id": "movistar-webdav-proxy-volume-1",
+        "service": "movistar-webdav-proxy",
+        "container_path": "/tmp",
+        "mode": "managed-volume",
+        "user_selectable": false,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "movistar-webdav-proxy"
+      ],
+      "stop_order": [
+        "movistar-webdav-proxy"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": [
+        {
+          "id": "tokens-encryption-key",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "movistar-webdav-proxy",
+              "environment_variable": "TOKENS_ENCRYPTION_KEY"
+            }
+          ]
+        },
+        {
+          "id": "webdav-password",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "movistar-webdav-proxy",
+              "environment_variable": "WEBDAV_PASSWORD"
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Web dashboard",
+        "scheme": "http",
+        "port": 5000,
+        "path": "/",
+        "source": "upstream-documentation"
+      },
+      {
+        "label": "WebDAV",
+        "scheme": "http",
+        "port": 8080,
+        "path": "/",
+        "source": "native-container-port"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "Web dashboard and WebDAV",
+        "type": "configured-or-installer-generated",
+        "username": "admin",
+        "username_environment": "WEBDAV_USER",
+        "password": null,
+        "password_environment": "WEBDAV_PASSWORD",
+        "change_required": false,
+        "source": "installer-generated",
+        "retrieval": null
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 1,
+      "memory_mb": 512,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 30
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "disk-backed-upload-scratch",
+        "upstream_behavior": "Compose mounts /tmp as a tmpfs.",
+        "native_lxc_behavior": "A separate managed disk volume provides /tmp and is excluded from backups.",
+        "reason": "Uploads can reach 4096 MB; a disk-backed scratch volume avoids consuming the LXC RAM limit.",
+        "behavioral_impact": "Scratch data uses disk and can survive a restart; the application removes completed temporary uploads.",
+        "validation": "passed-in-lab"
+      },
+      {
+        "id": "native-rootfs-permissions",
+        "upstream_behavior": "Docker Compose requests read_only for the root filesystem.",
+        "native_lxc_behavior": "Proxmox uses a writable native root disk; /app is owned by root, while the upstream entrypoint drops to UID 10001. Tokens and upload scratch have separate writable volumes.",
+        "reason": "The Proxmox pre-start setup requires a writable root disk. Protect application code through root ownership instead of declaring unsupported read-only startup.",
+        "behavioral_impact": "This is not a fully read-only root filesystem; the application user cannot replace the root-owned application directory or binaries.",
+        "validation": "passed-in-lab"
+      }
+    ],
+    "installer_profile": {
+      "volume_preparations": [
+        {
+          "container_path": "/app",
+          "remove_lost_found": false,
+          "owner_strategy": "mapped-root",
+          "mode": "0755"
+        },
+        {
+          "container_path": "/app/tokens",
+          "remove_lost_found": true,
+          "owner_strategy": "mapped-application-user",
+          "mode": "0700"
+        },
+        {
+          "container_path": "/tmp",
+          "remove_lost_found": true,
+          "owner_strategy": "mapped-application-user",
+          "mode": "1777"
+        }
+      ],
+      "volume_owner": {
+        "uid": 10001,
+        "gid": 10001
+      },
+      "generated_sensitive_environment": {
+        "WEBDAV_PASSWORD": {
+          "strategy": "token-hex",
+          "bytes": 16,
+          "prompt": true
+        },
+        "TOKENS_ENCRYPTION_KEY": {
+          "strategy": "token-hex",
+          "bytes": 32,
+          "prompt": false
+        }
+      },
+      "security": {
+        "options": {
+          "no_new_privileges": true
+        }
+      },
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 5000,
+        "path": "/health",
+        "timeout_seconds": 90,
+        "request_timeout_seconds": 5,
+        "stability_seconds": 4,
+        "verify_tls": false
+      },
+      "completion_notes": [
+        "Open the web dashboard and link your Movistar/O2 account using its SMS flow.",
+        "WebDAV is available on container port 8080. Account linking is required before cloud file operations."
+      ]
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "stop_signal",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "passed",
+    "service_health": "passed",
+    "restart_persistence": "passed",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}
@@ -9980,6 +9980,39 @@
      "hidden": false,
      "template_id": "image-motioneye"
    },
+    {
+      "id": "movistar-webdav-proxy",
+      "provider": "uniextra",
+      "template_family": "curated-profile",
+      "title": "Movistar / O2 Cloud WebDAV Proxy",
+      "repository": "https://github.com/uniextra/MovistarWebDAVProxy",
+      "description": "Official uniextra image with a web dashboard for Movistar/O2 Cloud account linking. Persistent OAuth credentials, authenticated WebDAV and disk-backed temporary uploads.",
+      "website": "https://github.com/uniextra/MovistarWebDAVProxy",
+      "icon": "https://raw.githubusercontent.com/uniextra/MovistarWebDAVProxy/main/static/favicon.svg",
+      "architectures": [
+        "amd64",
+        "arm64"
+      ],
+      "updated_at": null,
+      "main_image": "uniextra/movistar-webdav-proxy:latest",
+      "category": "backup",
+      "category_label": "Backup & Recovery",
+      "replaces_discovered_ids": [],
+      "curated_path": "catalog/curated/movistar-webdav-proxy.json",
+      "template_id": "image-movistar-webdav-proxy",
+      "template": "apps/movistar-webdav-proxy.json",
+      "template_status": "generated-unvalidated",
+      "hidden": false,
+      "automatic_install_candidate": true,
+      "untranslated_blockers": [],
+      "requires_privileged_lxc": false,
+      "optional_privileged_lxc": false,
+      "requires_host_pid_namespace": false,
+      "requires_relaxed_confinement": false,
+      "optional_relaxed_confinement": false,
+      "requires_security_confirmation": false,
+      "multi_container": false
+    },
    {
      "id": "msedge",
      "provider": "linuxserver.io",
@@ -18733,6 +18766,69 @@
      "requires_security_confirmation": false,
      "hidden": true,
      "template_id": "image-ztnet"
+    },
+    {
+      "id": "authelia",
+      "provider": "authelia",
+      "template_family": "curated-profile",
+      "title": "Authelia",
+      "repository": "https://github.com/authelia/authelia",
+      "description": "An open-source authentication and authorization server for protecting web applications. This single-image profile provides a local SQLite database and file notifications; configure your domain, reverse proxy and access rules before protecting other services.",
+      "website": "https://www.authelia.com/",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/authelia.webp",
+      "architectures": [
+        "amd64",
+        "arm64"
+      ],
+      "updated_at": "2026-09-17",
+      "main_image": "docker.io/authelia/authelia:4.39.28",
+      "category": "security",
+      "category_label": "Authentication & Security",
+      "replaces_discovered_ids": [],
+      "curated_path": "catalog/curated/authelia.json",
+      "template": "apps/authelia.json",
+      "template_status": "generated-unvalidated",
+      "automatic_install_candidate": true,
+      "untranslated_blockers": [],
+      "requires_privileged_lxc": false,
+      "optional_privileged_lxc": false,
+      "requires_host_pid_namespace": false,
+      "requires_relaxed_confinement": false,
+      "optional_relaxed_confinement": false,
+      "requires_security_confirmation": false,
+      "hidden": false,
+      "template_id": "image-authelia"
+    },
+    {
+      "id": "airdcpp-webclient",
+      "provider": "gangefors",
+      "template_family": "curated-profile",
+      "title": "AirDC++ Web Client",
+      "repository": "https://github.com/gangefors/docker-airdcpp-webclient",
+      "description": "AirDC++ Web Client using the community-maintained gangefors image. Configuration, downloads and shared content use separate persistent paths.",
+      "website": "https://airdcpp-web.github.io/",
+      "icon": "https://raw.githubusercontent.com/airdcpp-web/airdcpp-webui/eeeea5025a5e720f38dac53ced8e002940f00a74/resources/images/logo.svg",
+      "architectures": [
+        "amd64"
+      ],
+      "updated_at": "2026-10-25",
+      "main_image": "docker.io/gangefors/airdcpp-webclient:latest",
+      "category": "downloads",
+      "category_label": "Files & Downloads",
+      "replaces_discovered_ids": [],
+      "curated_path": "catalog/curated/airdcpp-webclient.json",
+      "template_id": "image-airdcpp-webclient",
+      "template": "apps/airdcpp-webclient.json",
+      "template_status": "generated-unvalidated",
+      "automatic_install_candidate": true,
+      "untranslated_blockers": [],
+      "requires_privileged_lxc": false,
+      "optional_privileged_lxc": false,
+      "requires_host_pid_namespace": false,
+      "requires_relaxed_confinement": false,
+      "optional_relaxed_confinement": false,
+      "requires_security_confirmation": false,
+      "hidden": false
    }
  ],
  "discovery": {
@@ -115,6 +115,10 @@
    ],
    "unpackerr": [
      "/data"
+    ],
+    "airdcpp-webclient": [
+      "/Downloads",
+      "/Share"
    ]
  },
  "sizes": {
@@ -239,6 +239,26 @@ def recover_untouched(root, journal):
        return False


+def recover_failed_update(root, journal):
+    """Attempt the guarded rollback after an update/Modify command fails.
+
+    Unlike recovery of an untouched guest, replacement failures may have
+    parked its volumes or removed its root disk. The existing recovery
+    journal validates ownership, configuration and backup before restoring.
+    Stack transactions remain the responsibility of their coordinator.
+    """
+    try:
+        with instances.locked(root):
+            state = json.loads(Path(journal).read_text())
+            if state.get('coordinated') or state.get('phase') in TERMINAL:
+                return False
+            recover(root, Path(journal))
+            return True
+    except (OSError, ValueError, KeyError, RuntimeError, subprocess.SubprocessError) as error:
+        log(f'automatic update recovery failed: {error}')
+        return False
+
+
 def fit(text):
    """A step line that is rewritten in place must not wrap."""
    width = max(shutil.get_terminal_size((80, 24)).columns - 8, 30)
@@ -289,7 +289,7 @@ def main():
    except (OSError, ValueError, KeyError, RuntimeError, subprocess.SubprocessError) as error:
        transaction.report_error(error, f'update-{args.vmid}')
        journal = transaction.pending_journal()
-        if journal and not transaction.recover_untouched(instances.ROOT, journal):
+        if journal and not transaction.recover_failed_update(instances.ROOT, journal):
            transaction.recovery_hint()
        return 1

@@ -187,6 +187,24 @@ def _split_short_mount(value: str) -> tuple[str | None, str, str | None]:
    return ":".join(parts[:-2]), parts[-2], parts[-1]


+# Host device nodes a Compose file may bind as a volume. They are passed to
+# the LXC as devices: a mount at that path would hide the device.
+DEVICE_NODE_BINDS = ("/dev/net/tun", "/dev/fuse", "/dev/kvm")
+
+
+def _device_bind(item: Any) -> str | None:
+    """The `source:target` of a volume that binds a host device node."""
+    if isinstance(item, dict):
+        if item.get("type", "bind") != "bind":
+            return None
+        source, target = item.get("source"), item.get("target")
+    else:
+        source, target, _ = _split_short_mount(str(item))
+    if str(source or "") in DEVICE_NODE_BINDS and str(target or "") == str(source):
+        return f"{source}:{target}"
+    return None
+
+
 def _mount_contract(value: Any, optional: set[str]) -> list[dict[str, Any]]:
    if value is None:
        return []
@@ -194,6 +212,8 @@ def _mount_contract(value: Any, optional: set[str]) -> list[dict[str, Any]]:
        raise ConversionError("volumes must be a list")
    result: list[dict[str, Any]] = []
    for index, item in enumerate(value):
+        if _device_bind(item):
+            continue
        if isinstance(item, dict):
            source = item.get("source")
            target = item.get("target")
@@ -606,6 +626,10 @@ def _device_installer_profile(
 ) -> tuple[dict[str, Any], list[str]]:
    optional = optional or set()
    raw_devices = service.get("devices")
+    volumes = service.get("volumes")
+    device_binds = [bind for bind in map(_device_bind, volumes) if bind] if isinstance(volumes, list) else []
+    if device_binds and (raw_devices is None or isinstance(raw_devices, list)):
+        raw_devices = [*(raw_devices or []), *device_binds]
    requests: list[dict[str, Any]] = []
    blockers: list[str] = []
    nvidia_requested = _nvidia_requested(service)
@@ -0,0 +1,61 @@
+"""The publisher contract survives native catalog composition and both wizards."""
+from pathlib import Path
+import json
+import sys
+import unittest
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path[:0] = [str(ROOT / 'src'), str(ROOT / 'remote'), str(ROOT / 'tests')]
+from proxmenux_oci.catalog import Catalog
+from proxmenux_oci.custom import template_from_oci_compose
+from proxmenux_oci.installer import build_deployment, DEFAULT_MODE, ADVANCED_MODE
+from test_advanced_flow_order import RecordingUI, storages, addresses
+
+
+class AirDCppRecipeTests(unittest.TestCase):
+    def test_import_roundtrip_keeps_udp_and_all_persistent_paths(self):
+        catalog = Catalog(ROOT)
+        template = catalog.compose('airdcpp-webclient')
+        restored = template_from_oci_compose(json.dumps(template))
+        catalog.validate(restored)
+        ports = {(p['container_port'], p['protocol']) for p in restored['container_contract']['ports']}
+        self.assertEqual(ports, {(5600,'tcp'),(5601,'tcp'),(21248,'tcp'),(21248,'udp'),(21249,'tcp')})
+        paths = {v['container_path']:v for v in restored['container_contract']['volumes']}
+        self.assertEqual(set(paths), {'/.airdcpp','/Downloads','/Share'})
+        self.assertEqual(paths['/.airdcpp']['installation_choice'], ['managed-volume'])
+        for path in ('/Downloads','/Share'):
+            self.assertIn('host-bind', paths[path]['installation_choice'])
+        self.assertEqual(restored['catalog_ui']['architectures'], ['amd64'])
+        self.assertEqual(restored['proxmox']['installer_profile']['startup_healthcheck']['path'], '/index.html')
+        self.assertEqual(restored['proxmox']['image_metadata_policy']['entrypoint'], 'import-from-oci-image')
+
+    def test_wizards_preserve_managed_configuration_and_use_selected_shared_directories(self):
+        from contextlib import ExitStack
+        with ExitStack() as stack:
+            for target, value in [
+                ('proxmenux_oci.installer.host.storages', storages),
+                ('proxmenux_oci.installer.access.ask_addresses', addresses)]:
+                stack.enter_context(patch(target, side_effect=value))
+            stack.enter_context(patch('proxmenux_oci.i18n.language', return_value='en'))
+            stack.enter_context(patch('proxmenux_oci.installer.host.bridges',return_value=[{'iface':'vmbr0','cidr':'192.0.2.10/24'}]))
+            stack.enter_context(patch('proxmenux_oci.installer.host.timezone',return_value='Europe/Madrid'))
+            stack.enter_context(patch('proxmenux_oci.installer.host.gpus',return_value={'intel':[],'amd':[],'nvidia':False}))
+            stack.enter_context(patch('proxmenux_oci.installer.access.ask_ipv4',return_value=('dhcp',None)))
+            for mode in (DEFAULT_MODE, ADVANCED_MODE):
+                with self.subTest(mode=mode):
+                    ui = RecordingUI({'Where to store /Downloads':'host-bind','Where to store /Share':'host-bind'})
+                    plan = build_deployment(Catalog(ROOT).compose('airdcpp-webclient'), ui, mode)
+                    mounts = {item['container_path']:item for item in plan['mounts']}
+                    self.assertEqual(mounts['/.airdcpp']['type'], 'managed-volume')
+                    self.assertTrue(mounts['/.airdcpp']['backup'])
+                    self.assertEqual(mounts['/Downloads']['type'], 'host-bind')
+                    self.assertEqual(mounts['/Share']['type'], 'host-bind')
+                    env = {item['name']:item['value'] for item in plan['environment']}
+                    self.assertEqual((env['PUID'],env['PGID']),('1000','1000'))
+                    self.assertEqual(plan['resources']['cores'],2)
+                    self.assertTrue(plan['security']['unprivileged'])
+
+
+if __name__ == '__main__':
+    unittest.main()
@@ -0,0 +1,99 @@
+"""The Authelia profile bootstraps a usable single-image authentication portal."""
+
+import json
+from pathlib import Path
+import sys
+import unittest
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "src"))
+
+from proxmenux_oci.catalog import Catalog
+
+
+class AutheliaRecipeTests(unittest.TestCase):
+    def setUp(self):
+        self.path = ROOT / "catalog/curated/authelia.json"
+        self.recipe = json.loads(self.path.read_text(encoding="utf-8"))
+        self.index_copy = json.loads(
+            (ROOT / "catalog/apps/authelia.json").read_text(encoding="utf-8")
+        )
+        self.profile = self.recipe["proxmox"]["installer_profile"]
+        self.generated = {
+            item["container_path"]: item
+            for item in self.profile["generated_files"]
+        }
+
+    def test_local_catalog_lists_and_loads_the_curated_recipe(self):
+        catalog = Catalog(ROOT)
+        item = catalog.find_item("authelia")
+        self.assertEqual(item["template_family"], "curated-profile")
+        self.assertEqual(catalog.compose("authelia")["id"], "image-authelia")
+        self.assertEqual(self.recipe, self.index_copy)
+
+    def test_official_image_tag_icon_and_supported_architectures_are_declared(self):
+        self.assertEqual(
+            self.recipe["container_contract"]["image"]["reference"],
+            "docker.io/authelia/authelia:4.39.28",
+        )
+        self.assertEqual(self.recipe["catalog_ui"]["architectures"], ["amd64", "arm64"])
+        self.assertEqual(
+            self.recipe["catalog_ui"]["icon"],
+            "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/authelia.webp",
+        )
+
+    def test_sensitive_secrets_are_generated_and_domain_settings_are_prompted(self):
+        environment = {
+            item["name"]: item
+            for item in self.recipe["container_contract"]["environment"]
+        }
+        for name in (
+            "PROXMENUX_ADMIN_PASSWORD",
+            "AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET",
+            "AUTHELIA_SESSION_SECRET",
+            "AUTHELIA_STORAGE_ENCRYPTION_KEY",
+        ):
+            self.assertTrue(environment[name]["sensitive"])
+            self.assertEqual(self.profile["generated_sensitive_environment"][name]["strategy"], "token-hex")
+        self.assertTrue(environment["PROXMENUX_AUTHELIA_COOKIE_DOMAIN"]["required"])
+        self.assertTrue(environment["PROXMENUX_AUTHELIA_URL"]["required"])
+        self.assertIn("cookie domain", environment["PROXMENUX_AUTHELIA_COOKIE_DOMAIN"]["prompt"])
+        self.assertIn("HTTPS URL", environment["PROXMENUX_AUTHELIA_URL"]["prompt"])
+        self.assertEqual(environment["PROXMENUX_AUTHELIA_COOKIE_DOMAIN"]["example"], "")
+        self.assertEqual(environment["PROXMENUX_AUTHELIA_URL"]["example"], "")
+        self.assertEqual(environment["X_AUTHELIA_CONFIG_FILTERS"]["example"], "template")
+
+    def test_config_is_persistent_and_has_a_working_initial_policy(self):
+        config = self.generated["/config/configuration.yml"]["content"]
+        self.assertIn("path: '/config/users_database.yml'", config)
+        self.assertIn("path: '/config/db.sqlite3'", config)
+        self.assertIn("filename: '/config/notification.txt'", config)
+        self.assertIn("default_policy: 'one_factor'", config)
+        self.assertIn('{{ env \"PROXMENUX_AUTHELIA_COOKIE_DOMAIN\" }}', config)
+        self.assertIn('{{ env \"PROXMENUX_AUTHELIA_URL\" }}', config)
+        self.assertTrue(self.generated["/config/configuration.yml"]["only_if_missing"])
+        volume = self.recipe["container_contract"]["volumes"][0]
+        self.assertEqual(volume["container_path"], "/config")
+        self.assertEqual(volume["installation_choice"], ["managed-volume"])
+        self.assertTrue(volume["managed_volume"]["backup"])
+
+    def test_bootstrap_hashes_initial_password_and_never_ships_a_default_password(self):
+        bootstrap = self.generated["/usr/local/bin/proxmenux-authelia-bootstrap"]["content"]
+        self.assertIn("authelia crypto hash generate argon2", bootstrap)
+        self.assertIn("unset PROXMENUX_ADMIN_PASSWORD", bootstrap)
+        self.assertIn("exec /app/entrypoint.sh", bootstrap)
+        self.assertNotIn("password: authelia", bootstrap)
+        self.assertEqual(
+            self.recipe["first_run"]["credentials"][0]["password_environment"],
+            "PROXMENUX_ADMIN_PASSWORD",
+        )
+
+    def test_healthcheck_uses_authelias_documented_endpoint_and_profile_remains_unvalidated(self):
+        healthcheck = self.profile["startup_healthcheck"]
+        self.assertEqual((healthcheck["port"], healthcheck["path"]), (9091, "/api/health"))
+        self.assertFalse(self.recipe["compatibility"]["validated"])
+        self.assertEqual(self.recipe["status"], "generated-unvalidated")
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -0,0 +1,39 @@
+"""A Compose volume that binds a host device node, such as /dev/net/tun for
+Tailscale, is passed to the LXC as a device: a mount there hides the device."""
+from pathlib import Path
+import sys
+import unittest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+from proxmenux_oci import converter
+
+
+class DeviceNodeBindTests(unittest.TestCase):
+    service = {"image": "tailscale/tailscale:latest", "volumes": [
+        {"type": "bind", "source": "/DATA/AppData/tailscale", "target": "/var/lib/tailscale"},
+        {"type": "bind", "source": "/dev/net/tun", "target": "/dev/net/tun"},
+        "/dev/fuse:/dev/fuse"]}
+
+    def test_device_nodes_are_not_volumes(self):
+        mounts = converter._mount_contract(self.service["volumes"], set())
+        self.assertEqual([m["container_path"] for m in mounts], ["/var/lib/tailscale"])
+
+    def test_device_nodes_become_device_requests(self):
+        profile, blockers = converter._device_installer_profile(self.service)
+        self.assertEqual(blockers, [])
+        self.assertEqual([(r["id"], r["container_path"]) for r in profile["device_requests"]],
+                         [("dev-net-tun", "/dev/net/tun"), ("dev-fuse", "/dev/fuse")])
+
+    def test_a_device_directory_is_left_to_its_own_handling(self):
+        self.assertIsNone(converter._device_bind("/dev/dri:/dev/dri"))
+        self.assertIsNone(converter._device_bind({"type": "volume", "source": "/dev/net/tun", "target": "/dev/net/tun"}))
+
+    def test_the_tailscale_recipe_passes_the_tun_device(self):
+        import json
+        recipe = json.loads((Path(__file__).resolve().parents[1] / "catalog/apps/tailscale.json").read_text())
+        self.assertNotIn("/dev/net/tun", [v["container_path"] for v in recipe["container_contract"]["volumes"]])
+        self.assertIn("dev-net-tun", [r["id"] for r in recipe["proxmox"]["installer_profile"]["device_requests"]])
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -11,7 +11,7 @@ import socket
 import sys
 import tempfile
 import unittest
-from unittest.mock import patch
+from unittest.mock import Mock, patch

 sys.path.insert(0,str(Path(__file__).resolve().parents[1]/'remote'))
 import oci_instances as instances
@@ -129,6 +129,37 @@ class UpdateRetainedDiskTests(unittest.TestCase):
        self.assertEqual(instances.read(self.root,115)['observed']['image'],self.saved['observed']['image'])
        self.assertEqual(json.loads(self.journal().read_text())['phase'],'rolled-back')

+    def test_update_command_recovers_a_failed_replacement_without_manual_recovery(self):
+        import oci_update_current as update
+        self.fail_install = True
+        with patch.object(update, 'update', side_effect=lambda *a: self.apply()), \
+                patch.object(instances, 'ROOT', self.root), \
+                patch.object(update, 'os', Mock(geteuid=lambda: 0)), \
+                patch.object(sys, 'argv', ['oci_update_current.py', '115']), \
+                patch.object(transaction, 'report_error'), \
+                patch.object(transaction, 'recovery_hint') as hint:
+            self.assertEqual(update.main(), 1)
+        self.assert_retained()
+        self.assertEqual(instances.read(self.root,115)['status'], 'installed')
+        self.assertEqual(instances.read(self.root,115)['observed']['image'],self.saved['observed']['image'])
+        self.assertEqual(json.loads(self.journal().read_text())['phase'],'rolled-back')
+        hint.assert_not_called()
+
+    def test_update_command_keeps_the_recovery_hint_when_rollback_is_blocked(self):
+        import oci_update_current as update
+        self.fail_install = True
+        with patch.object(update, 'update', side_effect=lambda *a: self.apply()), \
+                patch.object(instances, 'ROOT', self.root), \
+                patch.object(update, 'os', Mock(geteuid=lambda: 0)), \
+                patch.object(sys, 'argv', ['oci_update_current.py', '115']), \
+                patch.object(transaction, 'report_error'), \
+                patch.object(transaction, 'recover', side_effect=ValueError('configuration changed')), \
+                patch.object(transaction, 'recovery_hint') as hint:
+            self.assertEqual(update.main(), 1)
+        hint.assert_called_once_with()
+        self.assertEqual(instances.read(self.root,115)['status'], 'updating')
+        self.assertNotEqual(json.loads(self.journal().read_text())['phase'],'rolled-back')
+
    def test_recovery_after_parking_data_returns_the_original_unused_disks(self):
        with self.assertRaisesRegex(RuntimeError,'Lab interruption'):self.apply(interrupt_after='data-parked')
        transaction.recover(self.root,self.journal());self.assert_retained()
@@ -145,4 +176,31 @@ class UpdateRetainedDiskTests(unittest.TestCase):
        self.assert_retained()


+class AutomaticRecoveryGuardTests(unittest.TestCase):
+    def test_committed_rolled_back_and_coordinated_journals_are_not_recovered(self):
+        for state in ({'phase':'committed'}, {'phase':'rolled-back'},
+                      {'phase':'installing-candidate','coordinated':True}):
+            with self.subTest(state=state), tempfile.TemporaryDirectory() as directory:
+                root=Path(directory)/'instances'; journal=Path(directory)/'journal.json'
+                journal.write_text(json.dumps(state))
+                with patch.object(transaction,'recover') as recover:
+                    self.assertFalse(transaction.recover_failed_update(root,journal))
+                recover.assert_not_called()
+
+    def test_missing_and_malformed_journals_leave_recovery_pending(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root=Path(directory)/'instances'; journal=Path(directory)/'journal.json'
+            with patch.object(transaction,'recover') as recover, patch.object(transaction,'log'):
+                self.assertFalse(transaction.recover_failed_update(root,journal))
+                journal.write_text('{')
+                self.assertFalse(transaction.recover_failed_update(root,journal))
+            recover.assert_not_called()
+
+    def test_a_busy_registry_does_not_start_recovery(self):
+        with patch.object(instances,'locked',side_effect=BlockingIOError('busy')), \
+                patch.object(transaction,'recover') as recover, patch.object(transaction,'log'):
+            self.assertFalse(transaction.recover_failed_update(Path('/unused'),Path('/unused/journal')))
+        recover.assert_not_called()
+
+
 if __name__=='__main__':unittest.main()