From c83559643dc4ea8425178ba3bd0417c54a5f930f Mon Sep 17 00:00:00 2001 From: ProxMenuxBot Date: Sat, 17 Oct 2026 00:14:09 +0000 Subject: [PATCH] Update helpers_cache.json --- json/helpers_cache.json | 678 ++++++++++++++++++---------------------- 1 file changed, 300 insertions(+), 378 deletions(-) diff --git a/json/helpers_cache.json b/json/helpers_cache.json index 942d276a..f62254b9 100644 --- a/json/helpers_cache.json +++ b/json/helpers_cache.json @@ -37,7 +37,7 @@ { "name": "8mb.local", "slug": "8mblocal", - "desc": "8mb.local is a self-hosted video compressor inspired by 8mb.video. Drop in a video, pick a target size such as 8, 25 or 50 MB, and it calculates the bitrate and encodes to H.264, HEVC or AV1, with NVIDIA NVENC, Intel Quick Sync, VAAPI or CPU encoders, live progress, trimming, batch uploads, presets and a watched folder. This script builds the FastAPI backend, Celery worker and SvelteKit UI from source and runs them with Redis and FFmpeg.", + "desc": "8mb.local is a self-hosted video compressor inspired by 8mb.video, free for non-commercial use (CC BY-NC 4.0). Pick a target size such as 8, 25 or 50 MB and it works out the bitrate and encodes to H.264, HEVC or AV1, on the CPU or with NVENC, Quick Sync or VAAPI.", "script": "ct/8mblocal.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/8mblocal.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/8mblocal.sh", @@ -50,13 +50,11 @@ "Media & Streaming" ], "notes": [ - "The UI and API are protected by HTTP Basic auth. The user is admin, the generated password is AUTH_PASS in /opt/8mblocal_data/.env. It can be changed or switched off under Settings, Authentication.", - "Hardware encoding needs GPU passthrough. Intel Quick Sync, Intel and AMD VAAPI and NVIDIA NVENC are probed when the worker starts and only offered when a test encode passes; the CPU encoders x264, x265 and SVT-AV1 always work. For NVENC the NVIDIA libraries in the container must match the host driver version.", - "Uploads are written to disk (MEDIA_STORAGE=disk in /opt/8mblocal_data/.env). Upstream defaults to auto, which stages uploads in /dev/shm and counts them against the container RAM." + "The UI is behind HTTP Basic auth: user admin, password AUTH_PASS in /opt/8mblocal_data/.env. Change it under Settings > Authentication.", + "Hardware encoders are only offered when a test encode passes at startup. For NVENC, the NVIDIA libraries in the container must match the host driver version." ], "warnings": [ - "Uploads and compressed results are deleted after 1 hour, checked every 15 minutes. Download results right away, or raise the retention under Settings. Both live in /opt/8mblocal_data, so give the disk room for the largest video you compress.", - "8mb.local is licensed CC BY-NC 4.0: free for personal use, not for commercial use." + "Uploads and results are deleted after 1 hour. Download results right away or raise the retention under Settings." ], "port": 8001, "website": "https://github.com/JMS1717/8mb.local", @@ -79,7 +77,7 @@ { "name": "Activepieces", "slug": "activepieces", - "desc": "Activepieces is an open-source workflow automation platform and Zapier alternative. Flows are built in a visual editor from several hundred integrations (pieces), branches, loops, human approvals and TypeScript code steps, run on schedules, webhooks or app events, and can call AI agents; every piece is also available as an MCP tool for LLM clients. This script builds the server, worker and web UI from source and runs them with PostgreSQL and Redis.", + "desc": "Activepieces is an open-source workflow automation platform and Zapier alternative. Flows are built visually from hundreds of integrations, branches, loops, approvals and TypeScript code steps, run on schedules, webhooks or app events, and every integration is also available as an MCP tool.", "script": "ct/activepieces.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/activepieces.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/activepieces.sh", @@ -92,14 +90,11 @@ "Automation & Scheduling" ], "notes": [ - "Webhook URLs and OAuth2 redirects are built from AP_FRONTEND_URL in /opt/activepieces_data/.env, which points at the container IP. Change it when the IP changes or Activepieces sits behind a reverse proxy or domain, then run systemctl restart activepieces (the worker restarts with it).", - "Code steps run with AP_EXECUTION_MODE=UNSANDBOXED, the upstream default: they get network access and npm packages, but are not isolated from the container, so anyone who can edit flows can run code in it. Only give flow access to people you trust with that.", - "Activepieces is open-core: the code is MIT except packages/ee and packages/server/api/src/app/ee, which fall under the Activepieces Enterprise License. Like the official image, this build runs the Community Edition (the default AP_EDITION); enterprise features stay off without a license key.", - "Install and every update compile Activepieces from source (bun install of the whole monorepo, then turbo builds the API, worker, engine and React UI). That takes about 15 to 20 minutes on 4 cores and peaks at about 3.5 GB RAM and 6 GB disk. The running instance needs about 1 GB, so the RAM can be lowered after the install and raised to at least 4 GB again before an update." + "Webhook and OAuth2 URLs come from AP_FRONTEND_URL in /opt/activepieces_data/.env. Behind a reverse proxy or domain, change it and run systemctl restart activepieces." ], "warnings": [ - "There is no default account. Open http:// and sign up: the first account becomes the platform admin and closes sign-up, further users have to be invited. Anyone who reaches the port can claim it until then, so create the account right after the install.", - "Back up AP_ENCRYPTION_KEY from /opt/activepieces_data/.env together with the database. It encrypts the stored connection credentials, so a database restored without it is useless for them." + "There is no default account: the first sign-up becomes the platform admin and closes sign-up. Anyone who reaches the port can claim it, so create it right after the install.", + "Code steps are not sandboxed, so anyone who can edit flows can run code in the container. Only give flow access to people you trust." ], "port": 80, "website": "https://www.activepieces.com/", @@ -546,13 +541,11 @@ "Media & Streaming" ], "notes": [ - "Uses SQLite by default (stored under /opt/aiostreams_data, along with every other on-disk cache the addon keeps - all derived from DATABASE_URI's directory). Edit DATABASE_URI in /opt/aiostreams_data/.env to use PostgreSQL instead.", - "Most configuration (addons, presets, formatting, proxying) is done from the dashboard Settings page after deployment, not via the .env file.", - "The optional \"mount the library as a local folder\" share (Shares > FUSE) needs /dev/fuse, which this container doesn't have by default. It's not required for normal use - the WebDAV and NFS shares work without it - but if you want it, set var_fuse=yes (or answer yes to \"Enable FUSE support?\" in the advanced install) before creating the container; this stays a safe, unprivileged container the whole time." + "The FUSE share (Shares > FUSE) needs /dev/fuse: set var_fuse=yes or enable FUSE in the advanced install before creating the container. WebDAV and NFS shares work without it." ], "warnings": [ "No authentication is enabled by default. Set AIOSTREAMS_AUTH in /opt/aiostreams_data/.env to secure the dashboard.", - "SECRET_KEY is generated automatically and cannot be changed after first run without invalidating existing encrypted configs. Back up /opt/aiostreams_data/.env." + "Keep SECRET_KEY in /opt/aiostreams_data/.env: changing it after the first run invalidates all saved encrypted configs. Back up the .env file." ], "port": 3000, "website": "https://github.com/Viren070/AIOStreams", @@ -1094,13 +1087,11 @@ "Authentication & Security" ], "notes": [ - "The container is configured for direct exposure over plain HTTP (COOKIE_SECURE=false, USE_REMOTE_ADDRESS=true). When you put a TLS reverse proxy in front of it, set COOKIE_SECURE=true and remove USE_REMOTE_ADDRESS so client IPs come from X-Forwarded-For.", - "One Anubis instance protects one TARGET. For another service, copy /etc/anubis/main.env to /etc/anubis/.env with its own BIND, METRICS_BIND and TARGET and run `systemctl enable --now anubis@`. Alternatively point TARGET at a reverse proxy that routes by Host header and a single instance covers all its sites.", - "Bot policies live in /etc/anubis/main.botPolicies.yaml (a copy of the upstream default). Prometheus metrics are exposed on port 9090." - ], - "warnings": [ - "Set TARGET in /etc/anubis/main.env to the service you want to protect, then run `systemctl restart anubis@main`. Point your reverse proxy or DNS at this container on port 8923." + "Anubis forwards to TARGET in /etc/anubis/main.env. Set it to the service you want to protect, run systemctl restart anubis@main and point your reverse proxy or DNS at port 8923.", + "Behind a TLS reverse proxy, set COOKIE_SECURE=true and remove USE_REMOTE_ADDRESS in main.env so client IPs come from X-Forwarded-For.", + "One instance protects one TARGET. For another service, copy main.env to /etc/anubis/.env with its own BIND, METRICS_BIND and TARGET, then run systemctl enable --now anubis@." ], + "warnings": [], "port": 8923, "website": "https://anubis.techaro.lol/", "documentation": "https://anubis.techaro.lol/docs/", @@ -2485,7 +2476,7 @@ { "name": "Blinko", "slug": "blinko", - "desc": "Blinko is a self-hosted, open-source AI note-taking tool. Short \"blinkos\" capture fleeting ideas, longer notes hold everything else, both written in Markdown with tags, todos, attachments and references between notes. With an AI provider of your choice (OpenAI, Anthropic, Ollama and others) it adds RAG search and a chat over your own notes. This script builds the server and web app from source and runs them with PostgreSQL.", + "desc": "Blinko is a self-hosted, open-source AI note-taking tool. Short \"blinkos\" capture quick ideas and longer notes hold the rest, all in Markdown with tags and todos. With an AI provider such as OpenAI, Anthropic or Ollama it adds RAG search and a chat over your notes.", "script": "ct/blinko.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/blinko.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/blinko.sh", @@ -2498,12 +2489,10 @@ "Documents & Notes" ], "notes": [ - "AI features (RAG search, chat, AI tagging) stay off until you add a model provider under Settings > AI. Blinko works as a plain note app without one.", - "Uploads, the vector index and Blinko's own backups live in /opt/blinko_data/storage (Blinko sees it as /opt/blinko/.blinko). Back it up together with the PostgreSQL database.", - "Install and every update build Blinko from source, which peaks at about 3.6 GB of RAM. The running server needs around 500 MB, so the RAM can be lowered after the install and raised again before an update." + "AI search, chat and tagging stay off until you add a model provider under Settings > AI." ], "warnings": [ - "There is no default account. Open http://:1111 and sign up: the first account becomes the administrator and sign-up closes after it (more users are added from the Settings user list, or by switching on Allow Registration). Anyone who reaches the port can claim it until then, so create the account right after the install." + "There is no default account: the first sign-up becomes the administrator and closes sign-up. Anyone who reaches the port can claim it, so create it right after the install." ], "port": 1111, "website": "https://blinko.space/", @@ -2531,12 +2520,10 @@ "categories": [], "category_names": [], "notes": [ - "Without a passed-through GPU everything renders in software, which works but is slow. For Android apps on a Linux host instead, waydroid-vm is the lighter option.", - "This VM boots an installer. Open the console, choose Installation, create and format a partition on sda, and say yes to GRUB and a writable /system.", - "This is the FOSS build, without Google apps. The Gapps tree sits beside it on SourceForge." + "Without a passed-through GPU everything renders in software, which works but is slow. For Android apps on a Linux host, waydroid-vm is the lighter option." ], "warnings": [ - "The last official x86 release is from October 2024 (BlissOS 16, Android 13). The BlissOS17 directories exist on SourceForge but contain no builds." + "The last official x86 release is BlissOS 16 (Android 13) from October 2024. There are no newer builds." ], "port": 0, "website": "https://blissos.org/", @@ -2799,7 +2786,7 @@ { "name": "Budibase", "slug": "budibase", - "desc": "Budibase is a low-code platform for building internal tools: forms, portals, admin panels and approval apps on top of its built-in database or external sources such as PostgreSQL, MySQL, REST APIs and Google Sheets, plus automations triggered by events, schedules or webhooks. This script builds the app server and worker from source and runs them with CouchDB, Clouseau, SQS, Redis, Silo object storage and nginx, without Docker.", + "desc": "Budibase is a low-code platform for building internal tools such as forms, portals, admin panels and approval apps. Apps run on its built-in database or on PostgreSQL, MySQL, REST APIs and Google Sheets, with automations triggered by events, schedules or webhooks.", "script": "ct/budibase.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/budibase.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/budibase.sh", @@ -2812,15 +2799,11 @@ "AI / Coding & Dev-Tools" ], "notes": [ - "Without a license key Budibase runs its free self-hosted plan: one workspace, unlimited users and rows, no user groups and no custom AI providers. The paid features live in the source-available @budibase/pro package (Business Source License) and are unlocked with a key from account.budibase.app.", - "Budibase itself is GPLv3. Its internal tables are queried through SQS, a proprietary binary by The Neighbourhoodie Software that Budibase ships in every release and licenses for your own internal business use only (SQS_LICENSE in the repository).", - "The official image also bundles a LiteLLM proxy for AI agents and custom AI providers, which need a paid plan. It is not installed here; point LITELLM_URL and LITELLM_MASTER_KEY in /opt/budibase_data/.env at your own LiteLLM and run systemctl restart budibase-server to use one.", - "Install and every update download about 4 GB of npm packages and compile Budibase from source: expect 15 to 30 minutes, mostly downloading, up to about 3.3 GB of RAM and 9 GB of disk. The running stack uses about 2.5 GB of RAM.", - "Services: nginx on port 80 in front of budibase-server (4001) and budibase-worker (4002), plus couchdb, budibase-clouseau (search), budibase-sqs, budibase-silo (S3 object storage, a maintained MinIO fork) and redis-server." + "Without a license key Budibase runs the free self-hosted plan: one workspace, unlimited users and rows, no user groups and no custom AI providers.", + "AI agents and custom AI providers also need your own LiteLLM proxy: set LITELLM_URL and LITELLM_MASTER_KEY in /opt/budibase_data/.env and run systemctl restart budibase-server." ], "warnings": [ - "There is no default account. Open http:// right after the install and create the admin account on the setup page: until then anyone who reaches port 80 can claim it.", - "Back up /opt/budibase_data as a whole: it holds the CouchDB databases, the object storage with uploads and app assets, the search and SQS indexes, and the .env whose JWT_SECRET, API_ENCRYPTION_KEY and ENCRYPTION_KEY sign sessions and encrypt API keys and stored secrets." + "There is no default account: create the admin on the setup page right after the install. Until then anyone who reaches port 80 can claim it." ], "port": 80, "website": "https://budibase.com/", @@ -2905,7 +2888,7 @@ { "name": "ByteChef", "slug": "bytechef", - "desc": "ByteChef is an open-source API integration and workflow automation platform. Workflows are built in a visual editor from 170+ connectors, flow controls such as conditions, loops and branches, and JavaScript, Python or Ruby code steps, and run manually, on a schedule or from webhooks. This script builds the server and web client from source and runs them with PostgreSQL.", + "desc": "ByteChef is an open-source API integration and workflow automation platform. Workflows are built visually from 170+ connectors, conditions, loops and JavaScript, Python or Ruby code steps, and run manually, on a schedule or from webhooks.", "script": "ct/bytechef.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/bytechef.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/bytechef.sh", @@ -2918,14 +2901,11 @@ "Automation & Scheduling" ], "notes": [ - "Webhook triggers and OAuth2 connection redirects are built from BYTECHEF_PUBLIC_URL in /opt/bytechef_data/.env, which points at the container IP. Change it when the IP changes or ByteChef sits behind a reverse proxy or domain, then run systemctl restart bytechef.", - "ByteChef is open-core. Like the official image, this build runs the Enterprise Edition (BYTECHEF_EDITION=EE, the default; CE mode does not start in 0.34.x): the modules under the ByteChef Enterprise License (embedded iPaaS, API platform, AI gateway, SSO and SCIM, custom components, audit log) are free for development and testing, production use of them needs a subscription.", - "Install and every update compile ByteChef from source (Gradle, around 650 modules, plus the React client), which takes about 15 minutes on 4 cores and needs the 6 GB of RAM. The running server is fine with 2 GB, so the RAM can be lowered after the install and raised again before an update.", - "Code steps (JavaScript, Python, Ruby) run on the Temurin JDK in GraalVM's interpreter mode, not with the GraalVM JIT of the official image, so they work but run slower." + "Webhook and OAuth2 URLs come from BYTECHEF_PUBLIC_URL in /opt/bytechef_data/.env. Behind a reverse proxy or domain, change it and run systemctl restart bytechef.", + "This build runs the Enterprise Edition. Its enterprise modules (embedded iPaaS, API platform, AI gateway, SSO, audit log) are free for development and testing; production use needs a subscription." ], "warnings": [ - "There is no default account. Open http://:8080/login and click Create account: the first sign-up becomes the administrator and closes sign-up, further users are invited from the settings. Anyone who reaches the port can claim it until then, so create the account right after the install.", - "Back up BYTECHEF_ENCRYPTION_PROPERTY_KEY from /opt/bytechef_data/.env together with the database. It encrypts the stored connection credentials, so a database restored without it is useless for them." + "There is no default account: the first sign-up (Create account on the login page) becomes the administrator and closes sign-up. Anyone who reaches the port can claim it, so do it right away." ], "port": 8080, "website": "https://www.bytechef.io/", @@ -3181,7 +3161,7 @@ { "name": "Casdoor", "slug": "casdoor", - "desc": "Casdoor is an open-source identity and access management (IAM) and single sign-on platform with a web UI. It acts as an OAuth 2.0, OIDC, SAML and CAS provider, adds LDAP, RADIUS and SCIM endpoints, social and enterprise login providers, MFA and WebAuthn, and manages organizations, users, roles and Casbin-based permissions. This script installs the prebuilt release with a local PostgreSQL database.", + "desc": "Casdoor is an open-source identity and access management (IAM) and single sign-on platform. It acts as an OAuth 2.0, OIDC, SAML and CAS provider with LDAP, RADIUS and SCIM endpoints, social logins, MFA and WebAuthn, and Casbin-based permissions.", "script": "ct/casdoor.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/casdoor.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/casdoor.sh", @@ -3194,11 +3174,11 @@ "Authentication & Security" ], "notes": [ - "origin in /opt/casdoor_data/conf/app.conf is the OIDC issuer and the base of the links Casdoor mails out, and points at the container IP. Change it before connecting applications when the IP changes or Casdoor sits behind a reverse proxy or domain, then run systemctl restart casdoor.", - "Besides the web UI on port 8000, Casdoor serves its built-in LDAP server on port 389 and a RADIUS server on UDP port 1812. The RADIUS shared secret is generated during the install and stored as radiusSecret in /opt/casdoor_data/conf/app.conf." + "origin in /opt/casdoor_data/conf/app.conf is the OIDC issuer. Behind a reverse proxy or domain, change it before connecting applications and run systemctl restart casdoor.", + "Casdoor also serves LDAP on port 389 and RADIUS on UDP port 1812. The RADIUS secret is radiusSecret in /opt/casdoor_data/conf/app.conf." ], "warnings": [ - "Log in at http://:8000 as admin with password 123 (organization built-in). These defaults are public and give full control over every user and application, so change the password right after the install: the user menu in the top right, My Account, Password." + "The default admin login (organization built-in) is public and controls every user and application. Change the password right away under the user menu > My Account." ], "port": 8000, "website": "https://casdoor.ai/", @@ -3432,7 +3412,7 @@ { "name": "ChartDB", "slug": "chartdb", - "desc": "ChartDB is a database diagram editor that runs in the browser. A single query run against PostgreSQL, MySQL, MariaDB, SQL Server, SQLite, ClickHouse or CockroachDB returns the schema as JSON, which ChartDB turns into an editable entity-relationship diagram; diagrams can also be built from scratch, imported from DBML or SQL, and exported as SQL, DBML or images. This script builds the web app from source and serves it with nginx.", + "desc": "ChartDB is a database diagram editor that runs in the browser. One query against PostgreSQL, MySQL, MariaDB, SQL Server, SQLite, ClickHouse or CockroachDB returns the schema, which ChartDB turns into an editable ER diagram that can be exported as SQL, DBML or an image.", "script": "ct/chartdb.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/chartdb.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/chartdb.sh", @@ -3447,13 +3427,11 @@ "AI / Coding & Dev-Tools" ], "notes": [ - "ChartDB is served over HTTPS with a self-signed certificate (http:// redirects to it): accept the certificate warning on first visit. HTTPS is needed because the AI export and the copy buttons only work in a secure context.", - "AI-assisted SQL export to another database dialect is optional. In /opt/chartdb_data/config.js, uncomment OPENAI_API_KEY and fill in the key for OpenAI, or uncomment all three lines for an OpenAI-compatible server such as Ollama or vLLM (set its URL and model, and leave the key empty if the server needs none), then reload the page; no rebuild or restart is needed. The browser calls the endpoint directly, so it has to be reachable from the browser over HTTPS and allow requests from the ChartDB address (CORS).", - "Fathom analytics are switched off by DISABLE_ANALYTICS in /opt/chartdb_data/config.js. Install and every update build ChartDB from source and need the 6 GB of RAM; the running site is static files served by nginx, so the RAM can be lowered to 512 MB after the install and raised again before an update." + "ChartDB uses a self-signed certificate: accept the browser warning on the first visit." ], "warnings": [ - "Diagrams are stored in the browser (IndexedDB), not in the container. Another browser or device, cleared site data or a different address (new IP, hostname or reverse proxy) shows an empty diagram list, and container backups do not include them. Export diagrams you want to keep (JSON, DBML or SQL).", - "An OPENAI_API_KEY in config.js is sent to every browser that opens ChartDB, so anyone who can reach the container can read it. Use a key with a spending limit and keep ChartDB off the public internet when one is set." + "Diagrams are stored in your browser, not in the container. Another browser, cleared site data or a new address shows an empty list, so export the diagrams you want to keep.", + "For the optional AI SQL export, set OPENAI_API_KEY or an OpenAI-compatible endpoint in /opt/chartdb_data/config.js. The key is sent to every browser that opens ChartDB, so use one with a spending limit." ], "port": 443, "website": "https://chartdb.io/", @@ -3472,7 +3450,7 @@ { "name": "Chatto", "slug": "chatto", - "desc": "Chatto is a fully-featured, privacy-first team and group chat application that is free and easy to self-host. It ships as a single binary with an embedded NATS/JetStream store (no external database) and supports voice/video calls and screensharing via an optional LiveKit server.", + "desc": "Chatto is a privacy-first team and group chat app built for self-hosting. It runs as a single binary with an embedded NATS/JetStream store, so it needs no external database, and supports voice and video calls and screensharing through an optional LiveKit server.", "script": "ct/chatto.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/chatto.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/chatto.sh", @@ -3485,14 +3463,11 @@ "Communication & Community" ], "notes": [ - "Create the first account with `cd /opt/chatto && ./chatto operator user create --login ` (the operator API is enabled by default), or register via the web UI at http://IP:4000. Pick your own login: root, admin, superuser, op, operator and support are blocked by default and fail with 'this username is not available'.", - "Uploads go through the embedded NATS/JetStream store, which gets slow with many or large files. Testers report it becomes noticeably more usable with more CPU cores assigned to the container.", - "Voice and video calls require a separately deployed LiveKit server; configure the [livekit] section in chatto.toml to enable them." - ], - "warnings": [ - "Review /opt/chatto_data/chatto.toml and configure SMTP credentials and a public webserver.url before using Chatto in production.", - "All persistent data (embedded NATS/JetStream store and chatto.toml with its secrets) lives in /opt/chatto_data, kept outside the app directory so it survives updates. Include /opt/chatto_data in regular backups." + "Register the first account in the web UI, or run cd /opt/chatto && ./chatto operator user create --login . Logins such as root, admin, op and operator are blocked.", + "Set SMTP credentials and a public webserver.url in /opt/chatto_data/chatto.toml before using Chatto in production.", + "Voice and video calls need a separately deployed LiveKit server, configured in the [livekit] section of chatto.toml." ], + "warnings": [], "port": 4000, "website": "https://chatto.run", "documentation": "https://docs.chatto.run", @@ -4037,28 +4012,22 @@ { "name": "Colanode", "slug": "colanode", - "desc": "Open-source, local-first collaboration workspace — a self-hosted Slack and Notion alternative with real-time chat, rich text pages, customizable databases, and file management.", + "desc": "Colanode is an open-source, local-first collaboration workspace and a self-hosted alternative to Slack and Notion, with real-time chat, rich text pages, customizable databases and file management.", "script": "ct/colanode.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/colanode.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/colanode.sh", "type": "lxc", "type_id": "nm9bra8mzye2scg", "categories": [ - "scriptcat00012", - "scriptcat000026" + "scriptcat00012" ], "category_names": [ - "Documents & Notes", - "Productivity & Workflows" + "Documents & Notes" ], "notes": [ - "Access the web interface at https://YOUR_IP:4000. When adding a server in the desktop or mobile app, enter https://YOUR_IP:4000 as the server URL.", - "No default credentials — open the web UI and register a new account on first access." - ], - "warnings": [ - "Before using the app: download and import the self-signed certificate into your browser. Navigate to https://YOUR_IP:4000/colanode.crt and install it as a trusted CA. This is required for Service Worker and OPFS storage to work.", - "Requires at least 4 GB RAM for the build process." + "There is no default account: register one in the web UI on first access." ], + "warnings": [], "port": 4000, "website": "https://colanode.com/", "documentation": "https://github.com/colanode/colanode/blob/main/hosting/docker", @@ -4769,7 +4738,7 @@ { "name": "Databasement", "slug": "databasement", - "desc": "Databasement is a self-hosted database backup manager with a web UI. It registers MySQL, MariaDB, PostgreSQL, MongoDB, SQLite and Redis/Valkey servers, optionally through an SSH tunnel, runs scheduled or on-demand backups with retention and compression or encryption, stores them on local disk, S3, SFTP, FTP, Samba or Azure Blob storage, and restores snapshots to any registered server. This script runs it with PHP-FPM, nginx and SQLite.", + "desc": "Databasement is a self-hosted backup manager for MySQL, MariaDB, PostgreSQL, MongoDB, SQLite and Redis/Valkey. It runs scheduled or on-demand backups, optionally through an SSH tunnel, stores them locally or on S3, SFTP, FTP, Samba or Azure, and restores them to any registered server.", "script": "ct/databasement.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/databasement.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/databasement.sh", @@ -4782,14 +4751,11 @@ "Backup & Recovery" ], "notes": [ - "Backup and restore jobs run as www-data, so a local volume needs a path www-data can write to. /opt/databasement_data/backups is prepared for that and is also reachable as /data/backups, the path of upstream's sign-up demo backup.", - "Installed backup clients: mariadb-dump (used for MySQL as well), pg_dump 18 plus 16 for older servers, mongodump, redis-cli and sqlite3. Microsoft SQL Server and Firebird are not supported by this script: SQL Server needs Microsoft's ODBC driver and sqlpackage, Firebird the upstream gbak and isql tools.", - "Schedules run in UTC. Set APP_DISPLAY_TIMEZONE in /opt/databasement_data/.env (e.g. Europe/Berlin) for local times, then run: cd /opt/databasement && php artisan optimize && systemctl restart php8.5-fpm databasement-worker databasement-scheduler", - "A lost password is reset with: cd /opt/databasement && runuser -u www-data -- php artisan user:reset-password you@example.com" + "Backup jobs run as www-data, so a local volume needs a path www-data can write to, such as /opt/databasement_data/backups." ], "warnings": [ - "There is no default account. The first account created at http:///register becomes the administrator and closes sign-up; further users are invited from the UI. Anyone who reaches the page can claim it until then, so create it right after the install.", - "Back up APP_KEY from /opt/databasement_data/.env together with /opt/databasement_data/database.sqlite. It encrypts the stored database server passwords and, unless BACKUP_ENCRYPTION_KEY is set, the encrypted backups, so neither can be read without it." + "There is no default account: the first account created at /register becomes the administrator and closes sign-up. Anyone who reaches the page can claim it, so create it right after the install.", + "Back up APP_KEY from /opt/databasement_data/.env. It encrypts the stored server passwords and, unless BACKUP_ENCRYPTION_KEY is set, the backups, so neither can be read without it." ], "port": 80, "website": "https://david-crty.github.io/databasement/", @@ -5089,7 +5055,7 @@ { "name": "Deemix", "slug": "deemix", - "desc": "Deemix is a Deezer music downloader with a web interface. It searches the Deezer catalogue and downloads tracks, albums, playlists and artist discographies with tags and cover art, in MP3 or FLAC depending on the account. This is the maintained community fork by bambanah, which revived the discontinued original.", + "desc": "Deemix is a Deezer music downloader with a web interface, in the maintained community fork by bambanah. It downloads tracks, albums, playlists and discographies from Deezer with tags and cover art, in MP3 or FLAC depending on the account.", "script": "ct/deemix.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/deemix.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/deemix.sh", @@ -5102,13 +5068,11 @@ "Media & Streaming" ], "notes": [ - "Downloading requires the ARL cookie of your Deezer account. Log in at deezer.com in a browser, copy the value of the arl cookie from the developer tools (Application or Storage tab), then paste it in Deemix under Settings > Login > Log in with ARL. An ARL expires after about three months.", - "Music is saved to /opt/deemix_data/music. To store it on a NAS or media share, bind-mount that share onto the same path, e.g. pct set -mp0 /mnt/media/music,mp=/opt/deemix_data/music. In an unprivileged container the host directory must be writable by UID 100000.", - "Settings, the saved ARL and logs live in /opt/deemix_data/config, outside the app directory, so updates keep them.", - "Deemix downloads through your own Deezer account. Whether that is allowed depends on Deezer's terms of use and the law where you live." + "Downloading needs your Deezer ARL: copy the arl cookie from deezer.com in your browser's developer tools and paste it under Settings > Login > Log in with ARL. It expires after about three months.", + "Music is saved to /opt/deemix_data/music. For a NAS, bind-mount the share there with pct set -mp0; in an unprivileged container the host directory must be writable by UID 100000." ], "warnings": [ - "Deemix has no login of its own, and the saved ARL is used for every visitor. Anyone who can reach port 6595 can download with your Deezer account, so keep it on a trusted network or behind an authenticating reverse proxy." + "Deemix has no login and uses the saved ARL for every visitor. Keep port 6595 on a trusted network or behind an authenticating reverse proxy." ], "port": 6595, "website": "https://github.com/bambanah/deemix", @@ -6034,7 +5998,7 @@ "updateable": true, "privileged": false, "has_arm": false, - "is_dev": true, + "is_dev": false, "execute_in": [ "lxc" ], @@ -6048,7 +6012,7 @@ { "name": "Dragonfly", "slug": "dragonfly", - "desc": "Dragonfly is an in-memory data store compatible with the Redis and Memcached APIs, so existing Redis clients, libraries and tools work against it unchanged. It is multi-threaded with a shared-nothing design that uses every core it is given, and it takes snapshots without forking, which keeps the memory overhead of a save low. This script installs the official package with a generated password and periodic snapshots.", + "desc": "Dragonfly is an in-memory data store compatible with the Redis and Memcached APIs, so existing Redis clients and tools work against it unchanged. It is multi-threaded, uses every core it is given and takes snapshots without forking.", "script": "ct/dragonfly.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/dragonfly.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/dragonfly.sh", @@ -6061,13 +6025,10 @@ "Databases" ], "notes": [ - "Once the memory limit is reached, writes fail with 'Out of memory' and nothing is evicted. To use Dragonfly as a cache that drops old keys instead, add --cache_mode=true to /etc/dragonfly/dragonfly.conf and run `systemctl restart dragonfly`.", - "Data is snapshotted to /var/lib/dragonfly every 30 minutes (--snapshot_cron) and on every clean stop, and loaded again at start. Back up that directory; updates leave it and the config in place.", - "Dragonfly is source-available under the Business Source License 1.1: free to self-host and to use in your own products, but not to offer as a hosted or managed in-memory data store service." + "When memory is full, writes fail instead of evicting old keys. For cache use, add --cache_mode=true to /etc/dragonfly/dragonfly.conf and run systemctl restart dragonfly." ], "warnings": [ - "Dragonfly listens on port 6379 on all interfaces and requires a password. It is generated at install and stored as --requirepass in /etc/dragonfly/dragonfly.conf. Connect with `redis-cli -h -a `; redis-cli is also installed inside the container.", - "Dragonfly sets its memory limit at every start to 80% of the RAM free in the container and needs at least 256 MiB of that per CPU core, otherwise it refuses to start. Add RAM when you add cores (4 cores need more than 1.25 GB), or pin a limit with --maxmemory= in the config." + "Dragonfly refuses to start with less than 256 MiB of free RAM per CPU core. Add RAM when you add cores, or set --maxmemory= in /etc/dragonfly/dragonfly.conf." ], "port": 6379, "website": "https://www.dragonflydb.io/", @@ -6152,7 +6113,7 @@ { "name": "Dreeve", "slug": "dreeve", - "desc": "Dreeve is a self-hosted dashboard for sports and fitness data. It imports your Strava activities and turns them into statistics, heatmaps, gear tracking, training analysis and yearly overviews - formerly known as Statistics for Strava.", + "desc": "Dreeve, formerly Statistics for Strava, is a self-hosted dashboard for sports and fitness data. It imports your Strava activities and turns them into statistics, heatmaps, gear tracking, training analysis and yearly overviews.", "script": "ct/dreeve.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/dreeve.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/dreeve.sh", @@ -6165,12 +6126,11 @@ "Monitoring & Analytics" ], "notes": [ - "Activity data is stored in a SQLite database under /opt/dreeve_data via DATABASE_DIRECTORY. Back up that directory.", - "Not included: the Go-based fit-tool and shoutrrr notification binary that the official image bundles. FIT file import and push notifications are therefore unavailable." + "Create a Strava API application at https://www.strava.com/settings/api, put STRAVA_CLIENT_ID, STRAVA_CLIENT_SECRET and STRAVA_REFRESH_TOKEN into /opt/dreeve/.env.local and run systemctl restart dreeve.", + "FIT file import and push notifications are unavailable: the fit-tool and shoutrrr binaries of the official image are not included." ], "warnings": [ - "Dreeve does nothing without Strava credentials. Create an API application at https://www.strava.com/settings/api and put STRAVA_CLIENT_ID, STRAVA_CLIENT_SECRET and STRAVA_REFRESH_TOKEN into /opt/dreeve/.env.local, then restart the service.", - "Upstream only documents a Docker deployment. This script reproduces that setup natively - FrankenPHP as the server (the same one their image is based on) plus composer install - but it is not a path the project supports, so an upstream change can break it." + "Upstream only supports Docker. This script runs the same FrankenPHP setup natively, so an upstream change can break it." ], "port": 8080, "website": "https://dreeve.app/", @@ -6439,7 +6399,7 @@ { "name": "EmDash", "slug": "emdash", - "desc": "EmDash is a full-stack TypeScript CMS built on Astro and meant as a modern successor to WordPress. It brings an admin panel with a visual schema builder, a media library, menus, widgets, revisions and scheduled publishing, stores rich text as structured Portable Text, runs plugins in sandboxes with declared capabilities, imports WordPress sites and ships an MCP server for AI tools. This script creates a site from one of the Node.js templates with upstream's create-emdash, builds it against the published packages and runs it on Node.js with SQLite and local media storage.", + "desc": "EmDash is a full-stack TypeScript CMS built on Astro and meant as a modern successor to WordPress. It has a visual schema builder, a media library, revisions and scheduled publishing, sandboxed plugins, WordPress import and an MCP server for AI tools.", "script": "ct/emdash.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/emdash.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/emdash.sh", @@ -6452,17 +6412,11 @@ "Webservers & Proxies" ], "notes": [ - "To set EmDash up for real, put it behind a reverse proxy or tunnel with a trusted certificate (Caddy, Nginx Proxy Manager, Traefik, Cloudflare Tunnel) that forwards to http://:4321, set EMDASH_SITE_URL in /opt/emdash_data/.env to that address (e.g. https://blog.example.com), then rebuild: cd /opt/emdash && set -a && . /opt/emdash_data/.env && set +a && pnpm build && systemctl restart emdash. Open https://blog.example.com/_emdash/admin and create your account; the first one becomes the administrator. Setting var_emdash_url at install time skips the rebuild.", - "To try EmDash without a domain, set EMDASH_SITE_URL=http://localhost:4321, rebuild as above, run ssh -L 4321:localhost:4321 root@ on your computer and open http://localhost:4321/_emdash/admin. While the site URL is localhost, links and images on the public site point there too. Passkeys made there only work at localhost: when you move to a domain, stay signed in at localhost, switch EMDASH_SITE_URL and rebuild, then use Settings > General > Continue on to add a passkey for the new address.", - "EMDASH_SITE_URL must be exactly the address in the browser bar, because passkeys are bound to its hostname. Extra hostnames under the same domain go in EMDASH_ALLOWED_ORIGINS (comma-separated). Behind a reverse proxy, also set EMDASH_TRUSTED_PROXY_HEADERS=x-forwarded-for once only the proxy can reach port 4321: without it EmDash on Node.js cannot see client addresses and skips the per-IP rate limits on sign-in, magic-link and signup requests.", - "/opt/emdash is your Astro project: the template's layouts, components and astro.config.mjs are yours to change, and a rebuild (command above) applies the changes. Updates only move the emdash package to the new release and rebuild; they never replace template files, so new template designs do not reach existing sites.", - "The SQLite database, the uploaded media and the .env with EMDASH_ENCRYPTION_KEY live in /opt/emdash_data, outside the site; back up that folder. Without the key, plugin secrets saved in the database cannot be decrypted.", - "Magic-link sign-in, invitations and account recovery need an email provider plugin (e.g. emdash-smtp, see the Email Setup guide). Without one, invitation links have to be copied from the Users page.", - "Install and every update build the site with Astro, which peaks at about 2.3 GB of RAM; with 2 GB the build only fits by swapping. The running site needs about 160 MB." + "Behind a reverse proxy with a trusted certificate, set EMDASH_SITE_URL in /opt/emdash_data/.env to its exact address and rebuild: cd /opt/emdash && set -a && . /opt/emdash_data/.env && set +a && pnpm build && systemctl restart emdash", + "To try it without a domain, set EMDASH_SITE_URL=http://localhost:4321, rebuild, run ssh -L 4321:localhost:4321 root@ and open http://localhost:4321/_emdash/admin." ], "warnings": [ - "The admin at /_emdash/admin signs in with passkeys only; there are no passwords. Browsers offer passkeys only on HTTPS under a hostname or on localhost, never on an IP address, with or without a self-signed certificate. http://:4321 serves the public site, but the setup wizard cannot create the first account there.", - "Updates follow the emdash@x.y.z releases; the repository tags every plugin as well. Core database migrations run on the first request after the update. Before an update across a major version, take a backup or snapshot and read the release notes: they can require changes to your site's own code, which the update does not make." + "The admin at /_emdash/admin signs in with passkeys only, which browsers allow on HTTPS with a domain or on localhost, never on an IP. The first account cannot be created at http://:4321." ], "port": 4321, "website": "https://emdashcms.com/", @@ -6927,7 +6881,7 @@ { "name": "FalkorDB", "slug": "falkordb", - "desc": "FalkorDB is a low-latency property graph database built on sparse matrices and linear algebra (GraphBLAS), aimed at knowledge graphs and GraphRAG for LLM applications. It runs as a Redis module, is queried with OpenCypher through the GRAPH.* commands from any Redis client, and comes with FalkorDB Browser, a web UI for running queries and exploring graphs.", + "desc": "FalkorDB is a low-latency property graph database built on sparse matrices (GraphBLAS), aimed at knowledge graphs and GraphRAG. It runs as a Redis module queried with OpenCypher from any Redis client, and FalkorDB Browser adds a web UI for queries and exploring graphs.", "script": "ct/falkordb.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/falkordb.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/falkordb.sh", @@ -6940,14 +6894,10 @@ "Databases" ], "notes": [ - "Try it from the container: redis-cli -a GRAPH.QUERY social \"CREATE (:Person {name:'Alice'})-[:KNOWS]->(:Person {name:'Bob'})\", then redis-cli -a GRAPH.QUERY social \"MATCH (a)-[:KNOWS]->(b) RETURN a.name, b.name\".", - "FalkorDB Browser runs on port 3000. Log in with host localhost, port 6379, an empty username and the requirepass password. If you reach it under another address (new IP, hostname, reverse proxy), set NEXTAUTH_URL in /opt/falkordb-browser_data/.env and restart falkordb-browser.", - "FalkorDB is loaded as a module into Redis 8 from packages.redis.io (service redis-server). Module arguments sit on the loadmodule line in /etc/redis/falkordb.conf; graph data (RDB and AOF) lives in /var/lib/redis, and LOAD CSV reads from /var/lib/FalkorDB/import.", - "The 4 GB RAM are for building FalkorDB Browser during install and browser updates (peak about 3.4 GB). At runtime FalkorDB and the browser use about 200 MB plus your graph data." - ], - "warnings": [ - "The Redis password is generated at install and stored as requirepass in /etc/redis/falkordb.conf. FalkorDB itself listens on port 6379." + "Log in to FalkorDB Browser with host localhost, port 6379, an empty username and the requirepass password from /etc/redis/falkordb.conf.", + "If you open the browser under another address (new IP, hostname, reverse proxy), set NEXTAUTH_URL in /opt/falkordb-browser_data/.env and run systemctl restart falkordb-browser." ], + "warnings": [], "port": 3000, "website": "https://www.falkordb.com/", "documentation": "https://docs.falkordb.com/", @@ -7098,7 +7048,7 @@ { "name": "Figranium", "slug": "figranium", - "desc": "Figranium is a self-hosted browser automation platform. Workflows are stacked from blocks such as navigate, click, type, wait, loops, conditions, JavaScript and extraction in a visual editor, run in a headless Chromium driven by Playwright, and are triggered from the UI, on a schedule or through the REST API with runtime variables. A built-in noVNC viewer shows a visible browser for picking selectors and debugging runs.", + "desc": "Figranium is a self-hosted browser automation platform. You build workflows from blocks such as navigate, click, type and extract in a visual editor, run them in headless Chromium, and trigger them from the UI, on a schedule or through the REST API.", "script": "ct/figranium.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/figranium.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/figranium.sh", @@ -7111,12 +7061,11 @@ "Automation & Scheduling" ], "notes": [ - "Tasks are run over the API with POST /api/tasks//api and the x-api-key header. Generate the key under Settings > API Keys.", - "Workflows cannot open private or local network addresses by default (SSRF protection). To automate services in your LAN, set ALLOW_PRIVATE_NETWORKS=true in /opt/figranium_data/.env and run systemctl restart figranium.", - "On first start Figranium downloads a local CAPTCHA model (OWL-ViT, about 150 MB; Florence-2 with 8 GB RAM or more) into /opt/figranium_data/data/captcha-model. Set SKIP_LOCAL_CAPTCHA_MODEL=true in /opt/figranium_data/.env to turn it off." + "Workflows cannot open LAN addresses by default. To automate local services, set ALLOW_PRIVATE_NETWORKS=true in /opt/figranium_data/.env and run systemctl restart figranium.", + "To run tasks over the REST API, generate a key under Settings > API Keys and send it in the x-api-key header." ], "warnings": [ - "There is no default account. The first visitor to http://:11345 creates the administrator, and anyone who reaches the port can claim it until then, so create the account right after the install." + "There is no default account: the first visitor becomes the administrator. Create the account right after the install." ], "port": 11345, "website": "https://figranium.dev/", @@ -7388,7 +7337,7 @@ { "name": "Firefox Syncserver", "slug": "firefox-syncserver", - "desc": "Firefox Syncserver (syncstorage-rs) is Mozilla's own Rust server behind Firefox Sync, combining the sync storage and the tokenserver in one binary. Self-hosted, it keeps your Firefox bookmarks, history, passwords, open tabs, add-ons and form data on your own infrastructure, while you still sign in with a regular Mozilla account. Firefox encrypts every record before upload, so the server never sees their contents.", + "desc": "Firefox Syncserver (syncstorage-rs) is Mozilla's server behind Firefox Sync. It keeps your bookmarks, history, passwords, tabs and add-ons on your own hardware, encrypted by Firefox before upload, while you still sign in with a regular Mozilla account.", "script": "ct/firefox-syncserver.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/firefox-syncserver.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/firefox-syncserver.sh", @@ -7401,13 +7350,11 @@ "Backup & Recovery" ], "notes": [ - "There is no web interface. In Firefox open about:config, set identity.sync.tokenserver.uri to http://:8000/1.0/sync/1.5, restart Firefox, then sign in to Sync. about:sync-log only lists failed syncs; set services.sync.log.appender.file.logOnSuccess to true to see successful ones too. Health check: http://:8000/__heartbeat__", - "Sign-in still goes through your Mozilla account at accounts.firefox.com. Only the sync data is stored on this server.", - "Firefox for Android: in Settings > About Firefox tap the logo repeatedly to unlock the debug menu, set the custom Sync server to the same /1.0/sync/1.5 URL and stop Firefox from that menu. Do this before signing in.", - "Install and every update compile the server from source with Rust. The 3 GB RAM is sized for that build; the running server itself uses under 100 MB." + "There is no web interface. Before signing in to Sync, set identity.sync.tokenserver.uri in about:config to http://:8000/1.0/sync/1.5 and restart Firefox.", + "On Android, tap the logo in Settings > About Firefox until the debug menu appears, then set the custom Sync server there before signing in." ], "warnings": [ - "Firefox syncs to the storage URL this server hands out, set by SYNC_TOKENSERVER__INIT_NODE_URL in /opt/firefox-syncserver_data/.env (default http://:8000). If you use HTTPS through a reverse proxy, or the container IP changes, set it to the public origin (e.g. https://sync.example.com), run systemctl restart firefox-syncserver and point identity.sync.tokenserver.uri at that origin." + "Behind an HTTPS reverse proxy or after an IP change, set SYNC_TOKENSERVER__INIT_NODE_URL in /opt/firefox-syncserver_data/.env to the new origin, restart firefox-syncserver and update the URL in Firefox." ], "port": 8000, "website": "https://www.mozilla.org/firefox/features/sync/", @@ -7889,7 +7836,7 @@ { "name": "Formbricks", "slug": "formbricks", - "desc": "Formbricks is an open-source survey and experience management platform and an alternative to Qualtrics. It runs link, website and in-app surveys with logic, multiple languages, hidden fields and partial responses, and passes responses on through webhooks, the API and integrations such as Slack, Notion and Zapier. This script builds the web app from source and runs it with PostgreSQL, Valkey and SpiceDB, which Formbricks 6 uses for authorization.", + "desc": "Formbricks is an open-source survey and experience management platform and an alternative to Qualtrics. It runs link, website and in-app surveys with logic and multiple languages, and passes responses on through webhooks, the API and integrations such as Slack, Notion and Zapier.", "script": "ct/formbricks.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/formbricks.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/formbricks.sh", @@ -7902,14 +7849,11 @@ "Business & ERP" ], "notes": [ - "WEBAPP_URL and NEXTAUTH_URL in /opt/formbricks_data/.env point at the container IP, and logins, survey links and emails are built from them. Change both when the IP changes or Formbricks sits behind a reverse proxy or domain, then run systemctl restart formbricks. Upstream expects HTTPS for production use.", - "Install and every update compile Formbricks from source with Turbopack, which takes 15 to 30 minutes on 4 cores and peaks at about 9.5 GB of RAM, hence the 12 GB. The running stack needs about 1.5 GB, so the RAM can be lowered to 3 GB after the install and has to be raised again before an update.", - "File uploads (images in surveys, file upload and picture selection questions, logos) need S3-compatible storage: add the S3_* settings to /opt/formbricks_data/.env. Email verification, password reset and invitation emails need the SMTP_* and MAIL_FROM settings; set EMAIL_VERIFICATION_DISABLED and PASSWORD_RESET_DISABLED to 0 once mail works.", - "Formbricks is open-core: the core is AGPLv3, apps/web/modules/ee is under the Formbricks Enterprise License. Teams and roles, SSO, contacts and segments, workflows, audit logs, Unify Feedback and dashboards need a license key in ENTERPRISE_LICENSE_KEY. Formbricks Hub and Cube, the extra services behind Unify Feedback, feedback datasets and dashboards, are not installed." + "Logins and survey links are built from WEBAPP_URL and NEXTAUTH_URL in /opt/formbricks_data/.env. Change both behind a reverse proxy or after an IP change, then run systemctl restart formbricks.", + "File uploads need S3-compatible storage (S3_* settings) and emails need SMTP (SMTP_* and MAIL_FROM). Add them to /opt/formbricks_data/.env." ], "warnings": [ - "There is no default account. Open http://:3000 right after the install: the first sign-up creates the administrator and closes public sign-up, further users are invited from the organization settings. Anyone who reaches the port can claim the instance until then.", - "Authorization lives in SpiceDB, backed by its own spicedb database. Back up both PostgreSQL databases (formbricks and spicedb) together with /opt/formbricks_data; a restore without ENCRYPTION_KEY and AUTHZED_TOKEN from the .env files does not work." + "There is no default account: the first sign-up becomes the administrator and closes public sign-up. Create it right after the install." ], "port": 3000, "website": "https://formbricks.com/", @@ -8480,10 +8424,8 @@ "AI / Coding & Dev-Tools" ], "notes": [ - "Supports both Debian 13 and Alpine 3.24. The installer prompts for the OS or accepts var_os=alpine / var_os=debian.", - "To register the runner, obtain a registration token in Gitea under Site Administration > Actions > Runners, then run: `gitea-runner -c /etc/gitea-runner/config.yaml register --instance --token `.", - "After registering, start the runner daemon service with `systemctl start gitea-runner` (Debian) or `rc-service gitea-runner start` (Alpine).", - "Docker is installed and enabled by default for containerized workflow execution. Ensure nested virtualization is enabled on the LXC." + "Create a registration token in Gitea under Site Administration > Actions > Runners and enter it with your Gitea URL during setup, so the runner registers and starts on its own.", + "Skipped that step? Run the register command the install prints, then start the gitea-runner service." ], "warnings": [], "port": 0, @@ -8516,10 +8458,8 @@ "AI / Coding & Dev-Tools" ], "notes": [ - "Supports both Debian 13 and Alpine 3.24. The installer prompts for the OS or accepts var_os=alpine / var_os=debian.", - "To register the runner, obtain a registration token in Gitea under Site Administration > Actions > Runners, then run: `gitea-runner -c /etc/gitea-runner/config.yaml register --instance --token `.", - "After registering, start the runner daemon service with `systemctl start gitea-runner` (Debian) or `rc-service gitea-runner start` (Alpine).", - "Docker is installed and enabled by default for containerized workflow execution. Ensure nested virtualization is enabled on the LXC." + "Create a registration token in Gitea under Site Administration > Actions > Runners and enter it with your Gitea URL during setup, so the runner registers and starts on its own.", + "Skipped that step? Run the register command the install prints, then start the gitea-runner service." ], "warnings": [], "port": 0, @@ -8939,7 +8879,7 @@ { "name": "Gopeed", "slug": "gopeed", - "desc": "Gopeed is a fast, modern download manager for HTTP(S), BitTorrent, Magnet links and ed2k, written in Go and Flutter. It adds JavaScript extensions, a REST API, webhooks, post-download scripts and browser integration. This script installs the headless web edition, a single binary that serves the web UI and the API on port 9999 with login enabled.", + "desc": "Gopeed is a fast download manager for HTTP(S), BitTorrent, Magnet links and ed2k, written in Go and Flutter. It supports JavaScript extensions, a REST API, webhooks, post-download scripts and browser integration.", "script": "ct/gopeed.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/gopeed.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/gopeed.sh", @@ -8952,14 +8892,11 @@ "Files & Downloads" ], "notes": [ - "Sign in with the username gopeed and the password generated during the install. Both are in /opt/gopeed_data/config.json (username, password); after changing them run systemctl restart gopeed.", - "The REST API and the browser extension's remote mode authenticate with apiToken from /opt/gopeed_data/config.json, sent as the X-Api-Token header.", - "Downloads land in /opt/gopeed_data/downloads. To keep them on host storage, bind-mount a host directory there, e.g. pct set -mp0 /path/on/host,mp=/opt/gopeed_data/downloads; in an unprivileged container the host directory must be writable by UID 100000. config.json only sets this directory on the first start, later changes are made in the Gopeed settings.", - "Settings, the task database, extensions and logs live in /opt/gopeed_data/storage, outside /opt/gopeed, which an update replaces.", - "The web UI sends an anonymous usage statistic (Google Analytics) from the browser when it opens. Turn it off per browser under Settings > About > Upload Statistics." + "The login password is generated during the install and stored in /opt/gopeed_data/config.json. Run systemctl restart gopeed after changing it.", + "The REST API and the browser extension's remote mode use the apiToken from the same file, sent as the X-Api-Token header." ], "warnings": [ - "Keep /opt/gopeed_data/config.json valid JSON. Gopeed silently ignores a file it cannot parse and then starts without any authentication, on an empty database inside /opt/gopeed." + "Keep /opt/gopeed_data/config.json valid JSON. If Gopeed cannot parse it, it starts without any login on an empty database." ], "port": 9999, "website": "https://gopeed.com/", @@ -9432,7 +9369,7 @@ { "name": "Hanko", "slug": "hanko", - "desc": "Hanko is an open-source authentication and user management backend, an alternative to Auth0 or Clerk. It provides passkeys, passwords, email passcodes, TOTP and security-key MFA, OAuth/OIDC and SAML single sign-on, sessions and JWTs, and web apps add the login through the Hanko Elements web components or SDKs. This script runs the Hanko backend (public and admin API) with PostgreSQL.", + "desc": "Hanko is an open-source authentication and user management backend, an alternative to Auth0 or Clerk. It provides passkeys, passwords, email passcodes, MFA and single sign-on, and web apps add the login through the Hanko Elements web components or SDKs.", "script": "ct/hanko.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/hanko.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/hanko.sh", @@ -9445,14 +9382,11 @@ "Authentication & Security" ], "notes": [ - "Hanko is a headless authentication API, not a web app. Port 8000 is the public API that your own application's login talks to through Hanko Elements or the SDKs; opened in a browser it only shows an API status page. The self-hosted backend has no admin UI, the Hanko Console is part of the closed-source Hanko Cloud." + "Hanko is an API, not a web app: port 8000 only shows a status page and there is no admin UI. Your own app's login talks to it through Hanko Elements or the SDKs." ], "warnings": [ - "Before an app can use Hanko, replace the example.com placeholders in /opt/hanko_data/config.yaml: webauthn.relying_party.id is your domain, webauthn.relying_party.origins and cors.allow_origins the https:// URL of the app that embeds the login. Then run systemctl restart hanko. Hanko 3 reads the top-level cors key and ignores the server.public.cors of older upstream examples.", - "Passkeys only work over HTTPS on a domain name: browsers refuse WebAuthn on an IP address, and the session cookie is marked Secure. Publish port 8000 through a TLS reverse proxy (e.g. https://auth.example.com) instead of using http://:8000 directly.", - "Sign-up, email verification and passcode login send emails. Set email_delivery (from_address and the smtp host, port, user and password) in /opt/hanko_data/config.yaml to your mail server; until then these flows fail. Users created through the admin API with a password can still sign in.", - "The admin API (users, sessions, webhooks) has no authentication of its own, so it only listens on 127.0.0.1:8001, e.g. curl http://127.0.0.1:8001/users inside the container. Change server.admin.address only behind a firewall or an authenticating proxy: anyone who reaches it can create sessions for any user.", - "Back up secret_keys from /opt/hanko_data/config.yaml together with the database. It encrypts the JWT signing key stored in PostgreSQL, and without it Hanko can no longer issue session tokens." + "Passkeys need HTTPS on a domain name. Publish port 8000 through a TLS reverse proxy, put that domain and your SMTP server in /opt/hanko_data/config.yaml and run systemctl restart hanko.", + "The admin API on 127.0.0.1:8001 has no authentication. Anyone who reaches it can sign in as any user, so never expose it without a firewall or an authenticating proxy." ], "port": 8000, "website": "https://www.hanko.io/", @@ -9630,12 +9564,11 @@ "Documents & Notes" ], "notes": [ - "There is no default account. Use Sign In to register the first user with an email address and password. Guests can read notes but cannot create them.", - "Configuration, the session secret and uploaded images live in /opt/hedgedoc_data and survive updates. Notes are stored in the PostgreSQL database hedgedoc." + "There is no default account. Register the first user under Sign In with an email address and password." ], "warnings": [ - "Registration is open to anyone who can reach the instance. Once your accounts exist, set \"allowEmailRegister\": false in /opt/hedgedoc_data/config.json and run systemctl restart hedgedoc. Further users can then be added from the shell: cd /opt/hedgedoc && NODE_ENV=production CMD_CONFIG_FILE=/opt/hedgedoc_data/config.json bin/manage_users --add user@example.com", - "The domain in config.json must match the address in the browser, otherwise the page loads without scripts. It is set to the container IP with urlAddPort. Behind a reverse proxy set domain to your hostname, urlAddPort to false and protocolUseSSL to true for HTTPS, then restart hedgedoc." + "Anyone who reaches the instance can register. Once your accounts exist, set \"allowEmailRegister\": false in /opt/hedgedoc_data/config.json and run systemctl restart hedgedoc.", + "Behind a reverse proxy, set domain to your hostname, urlAddPort to false and protocolUseSSL to true in config.json, then restart hedgedoc. Otherwise the page loads without scripts." ], "port": 3000, "website": "https://hedgedoc.org/", @@ -10102,7 +10035,7 @@ { "name": "HomeTube", "slug": "hometube", - "desc": "HomeTube is a web UI for yt-dlp that downloads single videos or whole playlists into a clean folder structure for Plex, Jellyfin or Emby. It picks the best AV1/VP9 quality profile automatically, embeds subtitles, chapters and metadata, marks or removes sponsor segments with SponsorBlock, cuts clips, keeps playlists in sync and can trigger a Jellyfin library refresh after each download.", + "desc": "HomeTube is a web UI for yt-dlp that downloads single videos or whole playlists into a clean folder structure for Plex, Jellyfin or Emby. It embeds subtitles, chapters and metadata, skips sponsor segments with SponsorBlock and keeps playlists in sync.", "script": "ct/hometube.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/hometube.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/hometube.sh", @@ -10115,13 +10048,11 @@ "Media & Streaming" ], "notes": [ - "Videos are saved to /opt/hometube_data/videos (VIDEOS_FOLDER), into the destination folder chosen in the UI; playlists get a folder of their own. To write straight into a Plex, Jellyfin or Emby library, bind-mount it there, e.g. pct set -mp0 /mnt/media/youtube,mp=/opt/hometube_data/videos, then restart the container. In an unprivileged container the host folder must be writable by UID 100000.", - "YouTube increasingly needs cookies, even for public videos. Export them with a cookies.txt browser extension and copy the file to /opt/hometube_data/cookies/youtube_cookies.txt, then reload the HomeTube page so it switches to file cookies.", - "Settings such as LANGUAGE_PRIMARY, VIDEO_QUALITY_MAX, YTDLP_CUSTOM_ARGS or JELLYFIN_BASE_URL/JELLYFIN_API_KEY go in /opt/hometube_data/.env, then run systemctl restart hometube. Temporary files are removed after each download (REMOVE_TMP_FILES_AFTER_DOWNLOAD=true) so videos are not stored twice; set it to false to keep them as a re-download cache.", - "yt-dlp updates itself on every HomeTube restart and with every update run, since YouTube breaks older versions regularly. YouTube challenges are solved with the installed deno." + "Videos are saved to /opt/hometube_data/videos. Bind-mount your Plex, Jellyfin or Emby library there to download straight into it.", + "YouTube often needs cookies, even for public videos. Export a cookies.txt from your browser to /opt/hometube_data/cookies/youtube_cookies.txt and reload the page." ], "warnings": [ - "HomeTube has no login. Anyone who can reach port 8501 can download to your media folder, so keep it on a trusted network or put it behind a reverse proxy with authentication." + "HomeTube has no login. Anyone who reaches port 8501 can download to your media folder, so keep it on a trusted network or behind a reverse proxy with authentication." ], "port": 8501, "website": "https://hometube.latentnoise.dev/", @@ -10137,6 +10068,42 @@ "config_path": "", "os": "debian" }, + { + "name": "Honcho", + "slug": "honcho", + "desc": "Honcho is an open-source memory server for building stateful AI agents. Apps store the messages of users and agents through a REST API or the Python and TypeScript SDKs, and an LLM derives conclusions about each peer that agents can then query in natural language.", + "script": "ct/honcho.sh", + "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/honcho.sh", + "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/honcho.sh", + "type": "lxc", + "type_id": "nm9bra8mzye2scg", + "categories": [ + "scriptcat00020" + ], + "category_names": [ + "AI / Coding & Dev-Tools" + ], + "notes": [ + "There is no web interface. Every API request needs a key sent as Authorization: Bearer ; the install prints an admin key." + ], + "warnings": [ + "Honcho needs an API key for OpenAI, Anthropic or Gemini, or an OpenAI-compatible endpoint such as Ollama. Without one the install leaves it stopped.", + "Port 8000 is plain HTTP, and /docs and /health answer without a key. Put a reverse proxy with TLS in front before exposing Honcho beyond your LAN." + ], + "port": 8000, + "website": "https://honcho.dev/", + "documentation": "https://honcho.dev/docs/v3/contributing/self-hosting", + "logo": "https://cdn.jsdelivr.net/gh/plastic-labs/honcho@main/docs/favicon.svg", + "updateable": true, + "privileged": false, + "has_arm": false, + "is_dev": true, + "execute_in": [ + "lxc" + ], + "config_path": "", + "os": "debian" + }, { "name": "HortusFox", "slug": "hortusfox", @@ -10269,7 +10236,7 @@ { "name": "Ideon", "slug": "ideon", - "desc": "Ideon is a self-hosted visual workspace that maps a project on an infinite canvas. Notes, files, links, tasks, kanban boards, sketches and live Git repository blocks (GitHub, GitLab, Gitea, Forgejo) sit side by side, are edited together in real time and can be rewound to earlier snapshots. This script builds Ideon from source and runs it with PostgreSQL.", + "desc": "Ideon is a self-hosted visual workspace that maps a project on an infinite canvas. Notes, files, links, tasks, kanban boards, sketches and live Git repository blocks sit side by side, are edited together in real time and can be rewound to earlier snapshots.", "script": "ct/ideon.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/ideon.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/ideon.sh", @@ -10282,14 +10249,11 @@ "Documents & Notes" ], "notes": [ - "Redirects, invitation and share links are built from APP_URL in /opt/ideon_data/.env, which points at the container IP. Change it when the IP changes or Ideon sits behind a reverse proxy or domain, then run systemctl restart ideon.", - "Ideon connects to PostgreSQL as a regular role that is subject to its row-level security, unlike the upstream Docker setup whose database user is a superuser. Canvases, blocks, files and collaboration work, but a few features expect to bypass it: Shell blocks are refused, MCP/API-key clients and access requests to other users' projects report the project as missing, and the admin audit log only lists the admin's own entries.", - "Install and every update build Ideon from source (Next.js), which takes about 10 minutes on 2 cores and needs the 4 GB of RAM. The running app uses around 300 MB, so the RAM can be lowered after the install and raised again before an update.", - "Email (invitations, password reset, magic links) needs the SMTP_* values in /opt/ideon_data/.env, followed by systemctl restart ideon." + "Links and redirects use APP_URL in /opt/ideon_data/.env. Change it behind a reverse proxy or after an IP change, add the SMTP_* values for email, then run systemctl restart ideon.", + "Shell blocks, MCP and API-key clients, and access requests to other users' projects do not work here, as the database user is not a superuser like in upstream's Docker setup." ], "warnings": [ - "There is no default account. The first visit to http://:3000 opens the setup page that creates the super-admin; anyone who reaches the port can claim it until then, so finish the setup right after the install. Public registration is off afterwards, further users are invited from the Team page.", - "Back up SECRET_KEY from /opt/ideon_data/.env together with the database and /opt/ideon_data/storage (uploads, avatars and the canvas documents). Sessions and encrypted values such as Git tokens depend on it." + "There is no default account: the first visit opens the setup page that creates the super-admin. Finish it right after the install." ], "port": 3000, "website": "https://www.theideon.com/", @@ -12103,7 +12067,7 @@ { "name": "Kyoo", "slug": "kyoo", - "desc": "Kyoo is a self-hosted media server for movies, series and anime, an alternative to Jellyfin or Plex. It identifies files without a required folder structure, pulls metadata from TheMovieDB and TheTVDB, transcodes on the fly with automatic quality switching and hardware acceleration, detects intros and credits, and renders ASS and PGS subtitles in the browser. This script builds its auth, API, scanner, transcoder and web app from source and runs them with PostgreSQL behind nginx.", + "desc": "Kyoo is a self-hosted media server for movies, series and anime, an alternative to Jellyfin or Plex. It identifies files without a required folder structure, pulls metadata from TheMovieDB and TheTVDB, and transcodes on the fly with hardware acceleration.", "script": "ct/kyoo.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/kyoo.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/kyoo.sh", @@ -12116,17 +12080,11 @@ "Media & Streaming" ], "notes": [ - "Kyoo is served over HTTPS with a self-signed certificate (http:// redirects to it): open https:// and accept the certificate warning. HTTPS is needed because the player's subtitle renderer uses SharedArrayBuffer, which browsers only allow on a secure page.", - "Until the first video has been scanned and matched, the home page shows only \"Resource not found.\". That, and a 403 on /auth/users/me in the browser console when the settings page is opened while logged out, is how upstream Kyoo behaves with an empty library and guest access.", - "A login that answers \"Field validation for 'Login' failed on the 'required' tag\" reached Kyoo with empty fields, which happens when the browser autofills the form without the page noticing. Type or edit the username and password, then log in again.", - "Visitors who are not logged in can browse the library but not play it (GUEST_CLAIMS in /opt/kyoo_data/.env). Set GUEST_CLAIMS= to require a login for everything, then run systemctl restart kyoo-auth.", - "The library is read from /opt/kyoo_data/media. Bind-mount your media there from the host, e.g. pct set -mp0 /path/to/media,mp=/opt/kyoo_data/media, and make it readable for the container's root user. New files are picked up automatically; files on a network share that sends no change events show up after systemctl restart kyoo-scanner.", - "PUBLIC_URL and JWT_ISSUER in /opt/kyoo_data/.env (https://) must stay identical. Change both when Kyoo is reached under another address, e.g. a domain behind a reverse proxy (needed for OIDC logins), then run systemctl restart kyoo-auth kyoo-api kyoo-scanner.", - "Hardware transcoding is configured from the GPU passed through at install time (GOCODER_HWACCEL=vaapi for Intel/AMD, nvidia for NVIDIA, disabled otherwise). Change it in /opt/kyoo_data/.env (qsv is also valid) and run systemctl restart kyoo-transcoder.", - "Install and every update compile Kyoo from source (Go, Bun, Python and the Expo web app). The first install takes about 6 minutes on 4 idle cores (much longer on a busy host) and the build peaks at about 2.5 GB of RAM; updates take a few minutes because the build caches are kept." + "Kyoo uses HTTPS with a self-signed certificate, so accept the browser warning. Until the first video is scanned, the home page only shows \"Resource not found.\".", + "Behind a reverse proxy or under another address, set PUBLIC_URL and JWT_ISSUER in /opt/kyoo_data/.env to the same new URL, then run systemctl restart kyoo-auth kyoo-api kyoo-scanner." ], "warnings": [ - "There is no default account. The first account registered at https:// becomes the administrator, so create it right after the install. Later sign-ups have to be verified by the administrator before they can play anything." + "There is no default account: the first account registered becomes the administrator, so create it right after the install." ], "port": 443, "website": "https://kyoo.zoriya.dev/", @@ -12349,7 +12307,7 @@ { "name": "LibreDB Studio", "slug": "libredbstudio", - "desc": "LibreDB Studio is a browser-based SQL IDE you run on your own server. It connects to PostgreSQL, MySQL, SQLite, libSQL, DuckDB, Oracle, SQL Server, MongoDB, Redis, Couchbase, ClickHouse, Apache Druid, Elasticsearch, OpenSearch, Apache Trino and Apache Cassandra. Optional AI query assistance works with a local Ollama model, and read-only access is enforced by the database itself rather than by parsing SQL.", + "desc": "LibreDB Studio is a browser-based SQL IDE you run on your own server. It connects to PostgreSQL, MySQL, SQLite, SQL Server, MongoDB, Redis, ClickHouse, Elasticsearch and many more databases, with optional AI query help from a local Ollama model.", "script": "ct/libredbstudio.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/libredbstudio.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/libredbstudio.sh", @@ -12703,13 +12661,11 @@ "*Arr Suite" ], "notes": [ - "Only amd64 is supported: upstream ships no arm64 build.", - "Add a download client (qBittorrent, Transmission, SABnzbd or NZBGet) under Settings > Download Clients, then add Torznab/Newznab indexers under Settings > Indexers or import them from Prowlarr. If the download client runs in another container, mount its download folder here and set a remote path mapping.", - "Settings, database, logs and image cache live in /opt/listenarr_data/config. On first start Listenarr downloads its own ffprobe into that folder." + "If your download client runs in another container, mount its download folder here and set a remote path mapping in Listenarr." ], "warnings": [ - "Listenarr only publishes canary builds, all flagged as GitHub pre-releases. This script installs and updates from that channel, so expect breaking changes and keep backups of /opt/listenarr_data.", - "Authentication is disabled on first start. Turn on the login screen and create the admin account under Settings > General > Authentication, or keep the container on a trusted network." + "There is no login on first start. Turn it on and create the admin account under Settings > General > Authentication, or keep Listenarr on a trusted network.", + "Listenarr only publishes canary pre-releases, and this script installs and updates from them. Expect breaking changes and keep backups of /opt/listenarr_data." ], "port": 4545, "website": "https://getlistenarr.com/", @@ -12829,7 +12785,7 @@ { "name": "llama.cpp", "slug": "llama-cpp", - "desc": "llama.cpp runs GGUF language models directly in C/C++ with no Python runtime. This installs llama-server, which serves a built-in web chat UI plus an OpenAI-compatible API on the same port, so it can back tools like AnythingLLM, Open WebUI or Claude Code. Lighter and closer to the metal than Ollama.", + "desc": "llama.cpp runs GGUF language models directly in C/C++ with no Python runtime. Its llama-server offers a built-in web chat and an OpenAI-compatible API, so it can back tools like AnythingLLM, Open WebUI or Claude Code.", "script": "ct/llama-cpp.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/llama-cpp.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/llama-cpp.sh", @@ -12842,12 +12798,11 @@ "AI / Coding & Dev-Tools" ], "notes": [ - "On first start llama-server downloads the model set in LLAMA_ARG_HF_REPO (default: ggml-org/gemma-3-1b-it-GGUF, roughly 800 MB) into /opt/llama-cpp_data/models, so the container is usable straight away. Swap it for any GGUF repo, or point LLAMA_ARG_MODEL at a local file, then restart.", - "The build variant is chosen at install time: cpu or vulkan, or auto to follow the passed-through GPU. Upstream publishes no Linux CUDA or ROCm build, so every GPU is served by the vulkan build - AMD through RADV, NVIDIA through the driver's Vulkan ICD, which has to be present in the container. The choice is remembered in /opt/llama-cpp_data/.backend so updates keep it.", - "RAM is the limiting factor: the model must fit alongside the KV cache. 8 GB comfortably runs models up to roughly 7B at Q4. Raise LLAMA_ARG_CTX_SIZE only if you have headroom." + "The first start downloads a small default model (about 800 MB). Set LLAMA_ARG_HF_REPO to another GGUF repo, or LLAMA_ARG_MODEL to a local file, then run systemctl restart llama-cpp.", + "GPUs run on the Vulkan build, as upstream ships no Linux CUDA or ROCm build. NVIDIA cards need the driver's Vulkan libraries in the container." ], "warnings": [ - "The web UI and the OpenAI-compatible API share port 8080: /v1/chat/completions, /v1/models and friends. There is no authentication unless an API key is set - supply one at install time or set LLAMA_ARG_API_KEY in /opt/llama-cpp.env." + "The web UI and the API have no authentication unless you set an API key at install time or LLAMA_ARG_API_KEY in /opt/llama-cpp.env." ], "port": 8080, "website": "https://github.com/ggml-org/llama.cpp", @@ -13127,19 +13082,16 @@ "AI / Coding & Dev-Tools" ], "notes": [ - "Disk usage scales with total repository size. The default 20 GB is a starting point; size the container to your data.", - "Ports: 41337 (main endpoint, gRPC over TCP + QUIC over UDP), 41339 (HTTP health check), 41340 (internal mTLS replication, disabled by default).", - "A self-signed TLS certificate is generated at install (/etc/ssl/lore). Clients must trust it or be configured to accept it.", - "This is the Lore SERVER (loreserver). Developers connect to it with the 'lore' client CLI." + "Developers connect with the lore client CLI on port 41337 (TCP and UDP) and must trust the self-signed certificate in /etc/ssl/lore." ], "warnings": [ - "Lore is pre-1.0: on-disk formats may still change between versions, though committed-data durability is guaranteed. Intended for the experimental VED repo only.", - "Authentication is disabled by default (demo mode): the public endpoint accepts unauthenticated clients. Enable JWT verification via [server.auth.jwk] against an external identity provider in /opt/lore/local.toml before exposing it." + "Authentication is off, so anyone who reaches port 41337 can connect. Set up JWT verification under [server.auth.jwk] in /opt/lore/local.toml before exposing it.", + "Lore is pre-1.0, so its on-disk format may still change between versions." ], "port": 41337, "website": "https://epicgames.github.io/lore/", "documentation": "https://epicgames.github.io/lore/", - "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/lore-epic-games.webp", + "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/lore.webp", "updateable": true, "privileged": false, "has_arm": false, @@ -13608,13 +13560,11 @@ "Databases" ], "notes": [ - "On first visit Mathesar asks you to create the admin account. The two analytics checkboxes on that page (installation confirmation and anonymous usage data) are enabled by default; untick them if you do not want to share data.", - "The bundled PostgreSQL server holds Mathesar's internal database (mathesar_django), which cannot itself be used for your data. Use 'Create a new database' to store data in this container (the mathesar role may create databases), or 'Connect to an existing database' with the host, port and credentials of any other PostgreSQL 14+ server.", - "ALLOWED_HOSTS is * so the container IP works out of the box. Behind a reverse proxy, restrict it to your domain(s) and forward the Host and X-Forwarded-Proto headers." - ], - "warnings": [ - "Settings live in /opt/mathesar_data/.env, including SECRET_KEY, which encrypts the saved database passwords: keep it and back it up with the PostgreSQL databases. Add variables from https://docs.mathesar.org/administration/environment-variables/ there, then run `systemctl restart mathesar`." + "The first visit asks you to create the admin account. Its two analytics checkboxes are ticked by default; untick them if you do not want to share usage data.", + "The bundled PostgreSQL only holds Mathesar's own database. Choose 'Create a new database' for your data, or connect to an existing PostgreSQL 14+ server.", + "Behind a reverse proxy, set ALLOWED_HOSTS in /opt/mathesar_data/.env to your domain instead of * and forward the Host and X-Forwarded-Proto headers." ], + "warnings": [], "port": 8000, "website": "https://mathesar.org/", "documentation": "https://docs.mathesar.org/", @@ -14006,7 +13956,7 @@ { "name": "Meme Search", "slug": "memesearch", - "desc": "Meme Search is a self-hosted search engine for your own meme collection. A local vision model writes a description of each image, and the memes can then be found by keyword or by meaning (vector search), tagged, and fetched through a read-only search API. This script runs the Rails app with PostgreSQL and pgvector, plus the Python image-to-text service on the CPU.", + "desc": "Meme Search is a self-hosted search engine for your own meme collection. A local vision model writes a description of each image, and the memes can then be found by keyword or by meaning, tagged, and fetched through a read-only search API.", "script": "ct/memesearch.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/memesearch.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/memesearch.sh", @@ -14019,13 +13969,11 @@ "Media & Streaming" ], "notes": [ - "Rails only answers to host names it knows. MEME_SEARCH_ALLOWED_HOSTS in /opt/memesearch_data/.env holds the container IP from the install. Add any other IP or host name (comma-separated, exact values) and run systemctl restart memesearch when the IP changes or a reverse proxy is in front.", - "The meme library is /opt/memesearch_data/memes. Every subfolder can be added as an image path under Settings, and uploads land in direct-uploads. To index memes from the host, bind-mount the folder as a subfolder, for example mp0: /tank/memes,mp=/opt/memesearch_data/memes/mymemes. A symlinked folder is rejected.", - "Descriptions are generated on the CPU with Florence-2-base. The first job downloads the model (about 450 MB) to /opt/memesearch_data/models. On 4 cores an image then takes 10 to 30 seconds, and the generator peaks at about 5 GB RAM. The 6 GB default only fits Florence-2-base: Florence-2-large and moondream2 need 8 to 12 GB RAM and more disk. Alternatively, an OpenAI-compatible vision API such as Ollama can be configured under Settings.", - "With var_gpu=yes and an NVIDIA GPU passed through, the generator installs CUDA PyTorch instead of the CPU build, which needs about 6 GB more disk." + "After an IP change or behind a reverse proxy, add the new IP or host name to MEME_SEARCH_ALLOWED_HOSTS in /opt/memesearch_data/.env and run systemctl restart memesearch.", + "To index memes from the host, bind-mount them as a subfolder of /opt/memesearch_data/memes (symlinks are rejected) and add that folder under Settings." ], "warnings": [ - "Meme Search has no login. Anyone who can reach port 3000 can browse and delete memes, change settings and create API tokens, so keep the container on a trusted network or behind a VPN." + "Meme Search has no login. Anyone who reaches port 3000 can delete memes, change settings and create API tokens, so keep it on a trusted network or behind a VPN." ], "port": 3000, "website": "https://meme-search.neonwatty.com/", @@ -15115,6 +15063,44 @@ "config_path": "", "os": "debian" }, + { + "name": "Netronome", + "slug": "netronome", + "desc": "Netronome is a network speed test and monitoring tool with a web interface. It runs Speedtest.net, LibreSpeed and iperf3 tests on demand or on a schedule, watches packet loss and DNS, and collects metrics from agents on your servers.", + "script": "ct/netronome.sh", + "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/netronome.sh", + "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/netronome.sh", + "type": "lxc", + "type_id": "nm9bra8mzye2scg", + "categories": [ + "scriptcat00004", + "scriptcat00009" + ], + "category_names": [ + "Network & Firewall", + "Monitoring & Analytics" + ], + "notes": [ + "iperf3 tests need an iperf3 server: run iperf3 -s on another host and add it under Speed Test > iperf3." + ], + "warnings": [ + "There is no default login: the first visit opens a registration page, and that account is the only one. Create it right after the install.", + "/api/speedtest/public/history shows your test results without a login. Put a reverse proxy in front before exposing it beyond your LAN." + ], + "port": 7575, + "website": "https://netrono.me/", + "documentation": "https://netrono.me/", + "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/netronome.webp", + "updateable": true, + "privileged": false, + "has_arm": false, + "is_dev": true, + "execute_in": [ + "lxc" + ], + "config_path": "", + "os": "debian" + }, { "name": "NetworkOptimizer", "slug": "networkoptimizer", @@ -15290,7 +15276,7 @@ { "name": "NextDNS", "slug": "nextdns", - "desc": "NextDNS is a DNS-over-HTTPS (DoH) client and resolver that blocks ads, trackers and malware using cloud-managed profiles. This script installs a minimal Debian LXC with the official NextDNS CLI from the NextDNS apt repository, prompts for your profile ID, and configures router mode so DNS is served on TCP/UDP port 53.", + "desc": "NextDNS is a DNS-over-HTTPS (DoH) client and resolver that blocks ads, trackers and malware using cloud-managed profiles. It serves DNS for your network on port 53; profiles are managed at my.nextdns.io, there is no local web interface.", "script": "ct/nextdns.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/nextdns.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/nextdns.sh", @@ -15303,11 +15289,7 @@ "Adblock & DNS" ], "notes": [ - "During install you will be asked for your NextDNS profile ID (or pass var_nextdns_profile). The script runs: nextdns install -profile -report-client-info -setup-router", - "Create or copy your profile ID from https://my.nextdns.io before running the script.", - "After install, NextDNS listens on TCP/UDP port 53. Point DHCP clients at the container IP:53, or set the container as upstream DNS on your router. There is no local web UI (profiles are managed at my.nextdns.io).", - "Router mode (-setup-router) makes this LXC the DNS server for your network.", - "Updates use the official NextDNS apt repository (repo.nextdns.io). Run the container update script or apt upgrade inside the LXC." + "Have your NextDNS profile ID from https://my.nextdns.io ready: the install asks for it, or pass var_nextdns_profile." ], "warnings": [], "port": 0, @@ -15571,7 +15553,7 @@ { "name": "Nightingale", "slug": "nightingale", - "desc": "Nightingale is an open-source monitoring and alerting platform. Like Grafana it connects to existing data sources such as Prometheus, VictoriaMetrics, Elasticsearch, Loki, ClickHouse or MySQL, but its focus is the alerting engine: alert rules, muting, subscriptions, event pipelines and notifications to more than 20 channels, plus dashboards, a host inventory fed by the Categraf agent and a built-in time series database. This script installs the prebuilt release with MariaDB and Redis.", + "desc": "Nightingale is an open-source monitoring and alerting platform. It queries data sources such as Prometheus, VictoriaMetrics, Elasticsearch or Loki, and adds alert rules, muting, notifications to more than 20 channels, dashboards and a built-in time series database.", "script": "ct/nightingale.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/nightingale.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/nightingale.sh", @@ -15584,11 +15566,10 @@ "Monitoring & Analytics" ], "notes": [ - "No external Prometheus or VictoriaMetrics is needed: metrics pushed by Categraf agents land in Nightingale's built-in time series database, registered as the datasource embedded-tsdb. Install Categraf on the hosts to monitor from Infrastructure, Hosts, which serves the bundled agent and generates the install command. Samples are kept 15 days and capped at 4 GiB, set in [EmbeddedTSDB] of /opt/nightingale_data/config.toml.", - "Unlike the upstream default, anonymous queries against the datasources are disabled (PromQuerier = false in [Center.AnonymousAccess] of /opt/nightingale_data/config.toml), because they would let anyone who reaches port 17000 read every datasource. Set it to true for dashboards shared without login, then run systemctl restart nightingale." + "No separate Prometheus is needed: Categraf agents push metrics into the built-in time series database. Infrastructure > Hosts generates the agent install command." ], "warnings": [ - "Log in at http://:17000 as root with password root.2020. These defaults are public and the account is an administrator, so change the password right after the install: the user menu in the top right, Profile, Change password." + "The default login is public and has admin rights. Change the password right after the first login: user menu, Profile, Change password." ], "port": 17000, "website": "https://n9e.github.io/", @@ -15823,7 +15804,7 @@ { "name": "Norish", "slug": "norish", - "desc": "Norish is a realtime, self-hosted recipe app for families and friends. Recipes are imported from a link, pasted text or photos, organised in cookbooks, planned on a calendar and turned into a shared grocery list that updates live for everyone in the household. This script builds the web app from source and runs it with PostgreSQL, Redis, the bundled recipe parser and the Obscura headless browser that renders pages for URL imports.", + "desc": "Norish is a realtime, self-hosted recipe app for families and friends. Recipes are imported from a link, pasted text or photos, organised in cookbooks, planned on a calendar and turned into a shared grocery list that updates live for everyone in the household.", "script": "ct/norish.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/norish.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/norish.sh", @@ -15836,14 +15817,11 @@ "Gaming & Leisure" ], "notes": [ - "Sign-in and the realtime connection are bound to AUTH_URL in /opt/norish_data/.env, which points at the container IP. Change it when the IP changes or Norish sits behind a reverse proxy or domain (list further origins in TRUSTED_ORIGINS), then run systemctl restart norish.", - "Imports from recipe sites work without AI: the local Obscura browser renders the page and the bundled parser reads it. Importing from photos, free text and videos, and the enrichment features, need an AI provider configured under Settings => Admin.", - "Offline mode relies on a service worker, which browsers only allow over HTTPS. Put Norish behind a reverse proxy with TLS to use it.", - "Install and every update build Norish from source, which peaks at about 4 GB of RAM; the 6 GB default leaves headroom for it. The running app idles at under 1 GB and uses up to about 2 GB while an import transcodes recipe videos." + "Sign-in only works at AUTH_URL in /opt/norish_data/.env, set to the container IP. Change it for a new IP, a domain or a reverse proxy, then run systemctl restart norish." ], "warnings": [ - "There is no default account. Open http://:3000 and sign up: the first account becomes the server owner and admin, and sign-up closes after it. Anyone who reaches the port can claim it until then, so create the account right after the install.", - "Back up MASTER_KEY from /opt/norish_data/.env together with the database. Norish derives its sign-in secret from it and encrypts account details and stored secrets with it, so a database restored without the key locks every user out." + "There is no default account: the first sign-up becomes the admin, and sign-up closes after it. Create it right after the install.", + "Back up MASTER_KEY from /opt/norish_data/.env together with the database. A database restored without it locks every user out." ], "port": 3000, "website": "https://norish.dev/", @@ -15901,7 +15879,7 @@ { "name": "Note Mark", "slug": "notemark", - "desc": "Note Mark is a lightning-fast, minimal web-based Markdown note-taking app. Notes are kept as plain Markdown files in folders on disk, with a SQLite database for users and the folder cache, and can be shared per note with other users or publicly. It offers a CodeMirror editor with optional Vim keybindings, rendered previews, asset uploads, a scratch pad and optional OpenID Connect login. This script builds the Go backend and the SolidJS/WebAssembly frontend from source.", + "desc": "Note Mark is a fast, minimal web-based Markdown note-taking app. Notes are kept as plain Markdown files on disk and can be shared with other users or publicly, with a CodeMirror editor, optional Vim keybindings and optional OpenID Connect login.", "script": "ct/notemark.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/notemark.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/notemark.sh", @@ -15914,13 +15892,10 @@ "Documents & Notes" ], "notes": [ - "PUBLIC_URL in /opt/notemark_data/.env is set to the container IP. It must be the address you open Note Mark at, without a trailing slash. Change it when the IP changes or when Note Mark sits behind a reverse proxy or domain, then run systemctl restart notemark. Upstream recommends a reverse proxy with HTTPS and rate limiting on /api/auth/*. Copy to clipboard and installing the app as a PWA only work over HTTPS.", - "Notes are stored as plain Markdown files in /opt/notemark_data/notes, and users plus the folder cache in /opt/notemark_data/db.sqlite. Back up the whole /opt/notemark_data directory. If you change note files outside Note Mark, run the clear-cache command and restart the service.", - "The CLI (user add, set-password, clear-cache, clean) needs the service environment: set -a; . /opt/notemark_data/.env; set +a; /opt/notemark/note-mark --help", - "Install and every update build the Go backend and the Rust/WebAssembly + SolidJS frontend from source. That takes about 9 minutes on 2 cores and needs around 1 GB of RAM. The running server uses only a few dozen MB." + "PUBLIC_URL in /opt/notemark_data/.env must be the address you open Note Mark at. Change it for a new IP or a reverse proxy, then restart notemark. Clipboard copy and the PWA need HTTPS." ], "warnings": [ - "There is no default account. Create one at http://:8080/auth/signup. Sign-up is open to anyone who can reach the port, so once your accounts exist set ENABLE_INTERNAL_SIGNUP=false in /opt/notemark_data/.env and run systemctl restart notemark." + "There is no default account, and sign-up at /auth/signup is open to anyone. Once your accounts exist, set ENABLE_INTERNAL_SIGNUP=false in /opt/notemark_data/.env and run systemctl restart notemark." ], "port": 8080, "website": "https://notemark.docs.enchantedcode.co.uk/", @@ -16918,7 +16893,7 @@ "updateable": true, "privileged": false, "has_arm": false, - "is_dev": true, + "is_dev": false, "execute_in": [ "lxc" ], @@ -18479,9 +18454,8 @@ "Media & Streaming" ], "notes": [ - "RSS links are built from the Base URL, set to http://:8080 at install time. If podcast apps reach PigeonPod through a domain or reverse proxy, or the container IP changes, update it in the web UI settings. PIGEON_BASE_URL in /opt/pigeonpod_data/.env is only read while that setting is empty.", "YouTube channels and playlists need a YouTube Data API key, set in the web UI settings. Bilibili works without one.", - "The database and downloaded media live in /opt/pigeonpod_data. yt-dlp is a standalone binary kept current by the update script. The in-app yt-dlp updater installs through pip, which this container does not ship." + "RSS links use the Base URL from the web UI settings, set to the container IP at install. Update it when the IP changes or podcast apps reach PigeonPod through a domain or reverse proxy." ], "warnings": [ "Change the default password after the first login." @@ -18684,19 +18658,15 @@ "type": "lxc", "type_id": "nm9bra8mzye2scg", "categories": [ - "scriptcat00022" + "scriptcat00000" ], "category_names": [ - "Communication & Community" + "Miscellaneous" ], "notes": [ - "Credentials are stored in /opt/pixelfed/.env", - "ActivityPub federation is enabled by default", - "Uses PostgreSQL, Redis (socket), and PHP-FPM" - ], - "warnings": [ - "Create admin account with: cd /opt/pixelfed && sudo -u pixelfed php artisan user:create" + "There is no default account. Create the admin with: cd /opt/pixelfed && sudo -u pixelfed php artisan user:create" ], + "warnings": [], "port": 80, "website": "https://pixelfed.org/", "documentation": "https://docs.pixelfed.org/", @@ -19773,7 +19743,7 @@ { "name": "ProxCenter", "slug": "proxcenter", - "desc": "ProxCenter is a web console for running several Proxmox VE clusters and Proxmox Backup Server instances from one place: inventory and topology, in-browser noVNC/SPICE consoles, backup visibility, migrations from VMware, Hyper-V, Nutanix and XCP-ng, RBAC and SSO. This script installs the open-source Community Edition with its PostgreSQL database.", + "desc": "ProxCenter is a web console for running several Proxmox VE clusters and Proxmox Backup Server instances from one place, with inventory, in-browser consoles, backup visibility, migrations from VMware and other hypervisors, RBAC and SSO. This is the open-source Community Edition.", "script": "ct/proxcenter.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/proxcenter.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/proxcenter.sh", @@ -19782,12 +19752,11 @@ "categories": [], "category_names": [], "notes": [ - "This is the Community Edition. DRS load balancing, alerts, reports and notifications, MSP mode and high availability are Enterprise features that need ProxCenter's closed-source orchestrator, which this script does not install. A license key alone does not unlock them here.", - "NEXTAUTH_URL and APP_URL in /opt/proxcenter_data/.env point at the container IP. If the IP changes, or you put ProxCenter behind a reverse proxy or a domain, update both and run systemctl restart proxcenter." + "NEXTAUTH_URL and APP_URL in /opt/proxcenter_data/.env point at the container IP. Update both for a new IP, a domain or a reverse proxy, then run systemctl restart proxcenter." ], "warnings": [ - "There is no default account. The first visit to port 3000 opens a setup page that creates the administrator, and anyone who reaches that port can use it until then, so create the account right after the install.", - "Connect your clusters with a dedicated Proxmox user and API token rather than root@pam. Keep Privilege Separation on and grant only what the features you use need: https://docs.proxcenter.io/getting-started/connect-proxmox#proxmox-permissions. On PBS, grant the ACL to the token itself as well, since PBS tokens inherit nothing from their user." + "There is no default account: the first visit opens a setup page that creates the administrator. Create it right after the install.", + "Connect clusters with a dedicated API token with Privilege Separation, not root@pam. Required permissions: https://docs.proxcenter.io/getting-started/connect-proxmox#proxmox-permissions" ], "port": 3000, "website": "https://proxcenter.io/", @@ -20560,7 +20529,7 @@ { "name": "Rauthy", "slug": "rauthy", - "desc": "Rauthy is a single sign-on identity and access management server. It is an OpenID Connect and OAuth 2 provider with an admin UI, passkey (FIDO2/WebAuthn) and OTP multi-factor login, upstream login providers, SCIM, forward auth and PAM/SSH login. This script builds Rauthy from the release source and runs it with its embedded Hiqlite (Raft-replicated SQLite) database, served over HTTPS with a self-signed certificate.", + "desc": "Rauthy is a single sign-on identity and access management server. It is an OpenID Connect and OAuth 2 provider with an admin UI, passkey (FIDO2/WebAuthn) and OTP multi-factor login, upstream login providers, SCIM, forward auth and PAM/SSH login.", "script": "ct/rauthy.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/rauthy.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/rauthy.sh", @@ -20573,15 +20542,11 @@ "Authentication & Security" ], "notes": [ - "Open https://:8443/auth/v1/ and accept the self-signed certificate. Sign in as admin@localhost with the password_plain value under [bootstrap] in /opt/rauthy_data/config.toml (only read on the very first start) and change it on the account page right away.", - "The OIDC issuer is https:///auth/v1/ (discovery at /auth/v1/.well-known/openid-configuration). server.pub_url in /opt/rauthy_data/config.toml points at the container IP; change it when the IP changes or Rauthy sits behind a domain, then run systemctl restart rauthy. Behind a reverse proxy, proxy to https://:8443 and also set proxy_mode = true and trusted_proxies = ['/32'] under [server].", - "No mail server is configured, so password reset, user registration and event e-mails are not sent. Set smtp_url, smtp_username, smtp_password and smtp_from under [email] in /opt/rauthy_data/config.toml and restart Rauthy.", - "The self-signed certificate in /etc/ssl/rauthy is valid for one year. Replace rauthy.crt and rauthy.key there with your own certificate (or renew it) and restart Rauthy.", - "Rauthy publishes no release binaries, so the install and every update compile it from the release source (Rust). This takes about 50 minutes on 4 cores, up to 2.5 GB of RAM and 9 GB of disk; an update builds while the old version keeps running. The server itself uses about 200 MB, so RAM can be lowered after the install and raised again before an update." + "Accept the self-signed certificate and sign in as admin@localhost with the password_plain value under [bootstrap] in /opt/rauthy_data/config.toml. Change it right away." ], "warnings": [ - "Passkeys (WebAuthn) only work under a DNS name with a certificate the browser trusts; an IP address is never a valid relying party. So the script sets admin_force_mfa = false, otherwise the admin UI would be unreachable by IP. For production, serve Rauthy under a domain, set server.pub_url, webauthn.rp_id and webauthn.rp_origin to it before anyone registers a passkey (changing rp_id later breaks existing passkeys), register a passkey for the admin and then set admin_force_mfa = true.", - "Back up /opt/rauthy_data/config.toml together with the Hiqlite database in /opt/rauthy_data/hiqlite. The [encryption] keys encrypt client secrets and other stored values, a database restored without them is unusable." + "Passkeys need a domain, so admin MFA is off. For production, set pub_url, rp_id and rp_origin to your domain before anyone registers a passkey, then add the admin's passkey and set admin_force_mfa = true.", + "Back up /opt/rauthy_data/config.toml together with the database in /opt/rauthy_data/hiqlite. Without its encryption keys the database is unusable." ], "port": 8443, "website": "https://github.com/sebadob/rauthy", @@ -20617,13 +20582,10 @@ "Gaming & Leisure" ], "notes": [ - "The manager password is generated during installation and stored as MANAGER_PASSWORD in /opt/razzia/.env. Open the manager interface at http://:3000/manager and log in with it. Manager access is refused until MANAGER_PASSWORD is set.", - "JWT_SECRET in /opt/razzia/.env signs the session tokens and is generated during installation. Leaving it empty makes the server generate a new secret at every start, which logs managers out and gives players a fresh identity on each restart. It must be at least 32 characters; a shorter value is ignored. Restart the service after editing the file: systemctl restart razzia", - "Quizzes, saved results, uploaded media and optional branding live in /opt/razzia-config (quizz/, results/, media/, branding/). An example quiz is created there on first start." - ], - "warnings": [ - "Game state is kept in memory by the socket server, so only run a single instance. Behind a reverse proxy, WebSocket upgrade headers must be forwarded to port 3000 or clients stay stuck on connecting, and the upload limit must allow 100 MB media files." + "Host quizzes at http://:3000/manager with the generated password stored as MANAGER_PASSWORD in /opt/razzia/.env.", + "Behind a reverse proxy, forward the WebSocket upgrade headers and allow 100 MB uploads, or players stay stuck on connecting." ], + "warnings": [], "port": 3000, "website": "https://github.com/Ralex91/Razzia", "documentation": "https://github.com/Ralex91/Razzia/blob/main/docs/README.md", @@ -20841,7 +20803,7 @@ { "name": "Reconya", "slug": "reconya", - "desc": "Reconya is a network reconnaissance and asset discovery tool written in Go. It sweeps the networks you define with ICMP, ARP and TCP probes, identifies devices by MAC address, hostname and OS fingerprint, scans their top ports with service detection, passively picks up IPv6 neighbours, and raises alerts for new devices, risky open ports or unreachable hosts. Everything is shown in a web console with a topology map and a live event log.", + "desc": "Reconya is a network reconnaissance and asset discovery tool. It sweeps your networks with ICMP, ARP and TCP probes, identifies devices and their open ports, and alerts on new devices or risky ports, all in a web console with a topology map.", "script": "ct/reconya.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/reconya.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/reconya.sh", @@ -20854,14 +20816,11 @@ "Network & Firewall" ], "notes": [ - "The admin password is generated during install and stored as LOGIN_PASSWORD in /opt/reconya_data/.env. To change the username or password, edit that file and run systemctl restart reconya.", - "Nothing is scanned until you add a network: open Networks, add the suggested subnet of the container (or any CIDR it can route to), select it and start the scan. MAC addresses and ARP discovery only work on the layer-2 segment the container is attached to, so give it an interface on each bridge or VLAN you want inventoried.", - "All outbound lookups are off, so vendor names come from a small built-in table. Set VENDOR_LOOKUP_ONLINE_ENABLED=true in /opt/reconya_data/.env to look up unknown MAC prefixes at api.macvendors.com, then restart the service.", - "Screenshots of discovered web services need a browser in the container, for example apt install chromium, which the script does not install.", - "Reconya is licensed under CC BY-NC 4.0: free for non-commercial use, commercial use needs permission from the author." + "Log in as admin with the generated LOGIN_PASSWORD from /opt/reconya_data/.env. To change it, edit that file and run systemctl restart reconya.", + "Nothing is scanned until you add a network under Networks and start a scan. ARP and MAC discovery only reach the bridges or VLANs the container has an interface on." ], "warnings": [ - "Reconya signs login sessions with a key built into the binary, not a per-install secret, so a session cookie from any Reconya installation is accepted by every other one. Keep port 3008 on a trusted network and never expose it to the internet." + "Sessions are signed with a key built into the binary, so a session cookie from any Reconya install works on yours. Keep port 3008 on a trusted network, never on the internet." ], "port": 3008, "website": "https://reconya.com/", @@ -21361,7 +21320,7 @@ { "name": "Ryot", "slug": "ryot", - "desc": "Ryot (Roll Your Own Tracker) is a self-hosted tracker for the media you consume and the workouts you do. It logs progress, ratings and reviews for movies, shows, books, audiobooks, anime, manga, comics, video games, podcasts, music and visual novels, pulls their metadata from providers such as TMDB, IGDB, OpenLibrary and AniList, imports history from Trakt, Goodreads, Jellyfin and others, and records workouts, exercises and body measurements. This script builds the Rust backend and the React frontend from source and runs them with PostgreSQL behind nginx.", + "desc": "Ryot (Roll Your Own Tracker) is a self-hosted tracker for the media you consume and the workouts you do. It logs movies, shows, books, games, anime, podcasts and more with metadata from TMDB, IGDB, OpenLibrary and AniList, and records workouts and body measurements.", "script": "ct/ryot.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/ryot.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/ryot.sh", @@ -21374,13 +21333,11 @@ "Gaming & Leisure" ], "notes": [ - "Books (OpenLibrary), anime and manga (AniList), podcasts (iTunes), audiobooks, music and visual novels work out of the box. Movies and shows need MOVIES_AND_SHOWS_TMDB_ACCESS_TOKEN, video games need VIDEO_GAMES_TWITCH_CLIENT_ID and VIDEO_GAMES_TWITCH_CLIENT_SECRET in /opt/ryot_data/.env, then systemctl restart ryot-backend. All options: https://docs.ryot.io/configuration.html", - "FRONTEND_URL in /opt/ryot_data/.env points at the container IP and is used for links in notifications and integrations. Change it when the IP changes or Ryot sits behind a reverse proxy or domain, then restart ryot-backend.", - "Ryot Pro keys (SERVER_PRO_KEY) are only verified by the official Docker images, which carry the vendor's verification key. A source build cannot validate them and always runs the community edition.", - "Install and every update compile the Rust backend and the React frontend from source, which takes about 30 minutes on 4 cores (longer on a busy host) and peaks at about 3 GB of RAM. The running app with PostgreSQL needs about 300 MB, so the RAM can be lowered after the install and raised again before an update." + "Movies and shows need MOVIES_AND_SHOWS_TMDB_ACCESS_TOKEN, video games need the two VIDEO_GAMES_TWITCH_* keys. Add them to /opt/ryot_data/.env and restart ryot-backend.", + "Behind a reverse proxy or after an IP change, set FRONTEND_URL in /opt/ryot_data/.env to the new address and restart ryot-backend." ], "warnings": [ - "There is no default account. Open http://:8000 and register: the first account becomes the administrator. Registration stays open to anyone who reaches the port, so once the accounts exist, set USERS_ALLOW_REGISTRATION=false in /opt/ryot_data/.env and run systemctl restart ryot-backend." + "There is no default login: the first account you register becomes the admin. Registration stays open, so set USERS_ALLOW_REGISTRATION=false in /opt/ryot_data/.env afterwards and restart ryot-backend." ], "port": 8000, "website": "https://ryot.io/", @@ -22210,21 +22167,17 @@ "type": "lxc", "type_id": "nm9bra8mzye2scg", "categories": [ - "scriptcat00006", - "scriptcat00022" + "scriptcat00006" ], "category_names": [ - "Authentication & Security", - "Communication & Community" + "Authentication & Security" ], "notes": [ - "DKIM keys are generated in /opt/simplelogin/dkim/. The ready-to-use DNS TXT record is saved to /opt/simplelogin/dkim/dkim.dns.txt (public key also at dkim.public.key). Add it as a TXT record at dkim._domainkey.yourdomain.com, replacing EMAIL_DOMAIN with your domain.", - "Create your first admin account by visiting the web interface and registering." + "There is no default login: register the first admin account in the web interface." ], "warnings": [ - "After installation, update EMAIL_DOMAIN and URL in /opt/simplelogin/.env with your actual domain and configure DNS (MX, SPF, DKIM) accordingly.", - "A working SMTP setup (Postfix + valid domain/DNS) is required. Registration sends an activation email that must be delivered.", - "For real email delivery, edit /etc/postfix/main.cf with your values: myhostname (e.g. sl.yourdomain.com), mydomain (yourdomain.com), myorigin = $mydomain, inet_interfaces = all, and add your LXC subnet to mynetworks; then 'systemctl restart postfix'. SimpleLogin requires a fully configured mail domain (MX, SPF, DKIM, PTR/rDNS)." + "Set EMAIL_DOMAIN and URL in /opt/simplelogin/.env and add MX, SPF, DKIM and PTR records for your domain. The DKIM record is in /opt/simplelogin/dkim/dkim.dns.txt (replace EMAIL_DOMAIN in it).", + "Mail delivery must work, or the activation email after registration never arrives. Set myhostname, mydomain and mynetworks in /etc/postfix/main.cf, then restart postfix." ], "port": 80, "website": "https://simplelogin.io/", @@ -22584,7 +22537,7 @@ { "name": "Soulbeet", "slug": "soulbeet", - "desc": "Soulbeet is a self-hosted music downloader and library manager. You search for an album or track, it picks the best source on Soulseek, downloads it through slskd, tags and files it into your library with beets, and can push discovery playlists built from your Last.fm or ListenBrainz history to Navidrome. This script builds Soulbeet from source and installs beets; slskd and Navidrome run separately.", + "desc": "Soulbeet is a self-hosted music downloader and library manager. It finds albums and tracks on Soulseek through slskd, tags and files them into your library with beets, and can push discovery playlists from your Last.fm or ListenBrainz history to Navidrome.", "script": "ct/soulbeet.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/soulbeet.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/soulbeet.sh", @@ -22597,16 +22550,11 @@ "Media & Streaming" ], "notes": [ - "Soulbeet needs an slskd 0.26 or newer instance, which is not part of this container (use the slskd script for one). Enter its URL and API key in Settings > Config.", - "Add library folders in Settings > Library. /opt/soulbeet_data/music is prepared for that; mount the music share Navidrome reads at that path so imported tracks show up there.", - "Discovery playlists, rating sync and Navidrome logins need NAVIDROME_URL in /opt/soulbeet_data/.env. Uncomment it, then run systemctl restart soulbeet.", - "beets is installed with the plugin set of upstream's default (light) image: MusicBrainz tagging. Its configuration is /opt/soulbeet_data/beets_config.yaml, and pure-Python plugins can be dropped into /opt/soulbeet_data/beets-plugins.", - "Install and every update compile Soulbeet from source (Rust server plus WebAssembly client), which takes about 6 to 9 minutes on 4 cores. The running app needs well under 512 MB, so the RAM can be lowered after the install and raised again before an update." + "Needs a separate slskd 0.26+ instance. Enter its URL and API key in Settings > Config and mount its downloads folder here, e.g. pct set -mp0 /path/to/downloads,mp=/opt/soulbeet_data/downloads.", + "Mount the music share Navidrome reads at /opt/soulbeet_data/music and add it in Settings > Library. For Navidrome logins and playlists, uncomment NAVIDROME_URL in /opt/soulbeet_data/.env and restart soulbeet." ], "warnings": [ - "Soulbeet ships a local admin / admin account. Change its password in Settings > Users right after the first login. Once NAVIDROME_URL is set, users log in with their Navidrome credentials instead.", - "Soulbeet's sign-up API accepts requests without a login, and any logged-in user can change any other user's password. Anyone who reaches port 9765 can therefore take over the instance, including the slskd API key stored in it. Keep it on a trusted network and do not expose it to the internet.", - "Soulbeet imports what slskd downloads straight from disk, so slskd's downloads directory has to be mounted into this container at /opt/soulbeet_data/downloads, e.g. pct set -mp0 /path/to/slskd/downloads,mp=/opt/soulbeet_data/downloads." + "Anyone who reaches port 9765 can sign up and take over the instance, including the stored slskd API key. Keep it on a trusted network and change the admin password in Settings > Users right away." ], "port": 9765, "website": "https://github.com/terry90/soulbeet", @@ -23186,7 +23134,7 @@ { "name": "Stoatchat", "slug": "stoatchat", - "desc": "A self-hostable open-source chat platform and community server. Stoatchat is a fork of Revolt, featuring real-time messaging, voice channels, file sharing, and a full-featured web client. Built with Rust (backend) and SolidJS (frontend).", + "desc": "Stoatchat is an open-source chat platform and community server, forked from Revolt. It offers real-time messaging, voice channels, file sharing and a full-featured web client.", "script": "ct/stoatchat.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/stoatchat.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/stoatchat.sh", @@ -23199,17 +23147,16 @@ "Communication & Community" ], "notes": [ - "The first account registered becomes the instance administrator. Registration is open by default; set invite_only = true in /Revolt.toml to restrict it.", - "Voice and video calls require additional LiveKit setup. See https://github.com/stoatchat/self-hosted for details." + "Voice and video calls need a separate LiveKit setup, see https://github.com/stoatchat/self-hosted." ], "warnings": [ - "Initial setup takes 30-60 minutes due to Rust compilation and frontend build. Do not interrupt the process.", - "The files encryption key in /Revolt.toml is generated during installation. Back it up — losing it will make all uploaded files unreadable." + "Registration is open and the first account becomes the administrator. Register it right away, then set invite_only = true in /Revolt.toml to restrict sign-ups.", + "Back up the files encryption key in /Revolt.toml. Without it, all uploaded files are unreadable." ], "port": 80, "website": "https://stoat.chat", "documentation": "https://github.com/stoatchat/self-hosted", - "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/stoat.webp", + "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/stoatchat.webp", "updateable": true, "privileged": false, "has_arm": false, @@ -23399,7 +23346,7 @@ { "name": "Streamystats", "slug": "streamystats", - "desc": "Streamystats is a statistics and analytics service for Jellyfin. It tracks playback sessions through the Jellyfin API and shows watch history, per-user, library and client statistics, and watch-time graphs. It supports multiple servers and can import history from Jellystat and the Playback Reporting plugin. Optional AI features add library chat and embedding-based recommendations through OpenAI-compatible, Ollama or Anthropic providers.", + "desc": "Streamystats is a statistics and analytics service for Jellyfin. It shows watch history, per-user, library and client statistics and watch-time graphs for one or more servers, and can import history from Jellystat and the Playback Reporting plugin.", "script": "ct/streamystats.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/streamystats.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/streamystats.sh", @@ -23412,13 +23359,10 @@ "Monitoring & Analytics" ], "notes": [ - "On first visit the setup page asks for your Jellyfin URL and an API key. Create the key in Jellyfin under Dashboard > API Keys. The optional internal URL is used for server-to-server traffic when Jellyfin is reachable on a LAN address.", - "There is no separate account: after setup, sign in with your Jellyfin username and password. Jellyfin administrators get the admin views in Streamystats.", - "The first sync of a large library can take a while. AI chat and embedding-based recommendations stay off until you configure a provider under Settings > AI." - ], - "warnings": [ - "Installs and updates build the Next.js app from source, which peaks at about 2.3 GB of RAM. Keep the container at 3 GB or more, or updates can fail mid-build." + "The first visit asks for your Jellyfin URL and an API key (Jellyfin: Dashboard > API Keys). After that, sign in with your Jellyfin account; Jellyfin admins get the admin views.", + "AI chat and recommendations stay off until you set up a provider under Settings > AI." ], + "warnings": [], "port": 3000, "website": "https://github.com/fredrikburmester/streamystats", "documentation": "https://github.com/fredrikburmester/streamystats/blob/main/DOCKERLESS.md", @@ -23436,7 +23380,7 @@ { "name": "Stump", "slug": "stump", - "desc": "Stump is a free and open-source comics, manga and digital book server with OPDS support. It scans folders of CBZ, CBR, EPUB and PDF files into libraries and series, reads them in the browser with progress tracking, and serves them to OPDS readers and the Stump mobile apps. This script installs the official Linux server release together with PDFium for PDF support.", + "desc": "Stump is a free and open-source comics, manga and digital book server. It organizes CBZ, CBR, EPUB and PDF files into libraries and series, reads them in the browser with progress tracking, and serves them to OPDS readers and the Stump mobile apps.", "script": "ct/stump.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/stump.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/stump.sh", @@ -23449,12 +23393,11 @@ "Media & Streaming" ], "notes": [ - "Books are not added automatically. Create a library in Stump and point it at a folder inside the container. /opt/stump_data/library exists for this; to use a folder from the Proxmox host, bind-mount it there with pct set -mp0 /path/on/host,mp=/opt/stump_data/library. In an unprivileged container the files must be readable by host UID 100000.", - "OPDS readers connect to http://:10801/opds/v1.2/catalog (or /opds/v2.0/catalog) with a Stump username and password.", - "The database, Stump.toml, thumbnails and logs live in /opt/stump_data/config. STUMP_CONFIG_DIR, STUMP_CLIENT_DIR and PDFIUM_PATH are set in stump.service and take precedence over Stump.toml; run systemctl restart stump after changing either." + "Create a library pointing at /opt/stump_data/library. To use a host folder, mount it there with pct set -mp0 /path/on/host,mp=/opt/stump_data/library.", + "OPDS readers connect to http://:10801/opds/v1.2/catalog (or /opds/v2.0/catalog) with a Stump username and password." ], "warnings": [ - "There is no default account. Open http://:10801 and complete the onboarding: the first account becomes the server owner and closes sign-up, further users are added from the settings. Anyone who reaches the port can claim the server until then, so do it right after the install." + "There is no default login: the first account created in the onboarding becomes the owner. Anyone who reaches the port can claim the server until then, so do it right after the install." ], "port": 10801, "website": "https://www.stumpapp.dev/", @@ -23795,11 +23738,11 @@ "AI / Coding & Dev-Tools" ], "notes": [ - "Provider CLIs (Codex, Claude, Grok, OpenCode, GitHub) are included in the install. Login to the CT after creation to authenticate with these services.", - "Access T3 Code at http://:3773 and pair a device with the token/QR shown after install. Regenerate it with: `pct exec -- t3 pair --base-dir /opt/t3code`." + "Log in to the provider CLIs (Codex, Claude, Grok, OpenCode, GitHub) inside the container before using them in T3 Code.", + "The pairing URL shown after the install expires after an hour. Get a new one with pct exec -- t3 pair --base-dir /opt/t3code." ], "warnings": [ - "T3 Code and its agents run as root inside the LXC. The service sets IS_SANDBOX=1 so Claude can use Full access mode without a manual environment override. This does not enable additional sandboxing: agents can modify all container data and any writable host bind mounts. Use an unprivileged container and avoid exposing sensitive host paths." + "Agents run as root with Claude's Full access mode allowed, so they can change anything in the container and in writable bind mounts. Keep the container unprivileged and do not mount sensitive host paths." ], "port": 3773, "website": "https://t3.codes", @@ -23851,7 +23794,7 @@ { "name": "TaskView", "slug": "taskview", - "desc": "TaskView is a self-hosted project and task management platform for teams. Projects hold task lists, Kanban boards, a dependency graph and sprints, with priorities, tags, deadlines, assignees, recurring tasks and time tracking, plus organizations with role-based permissions, SSO and SCIM, webhooks, GitHub/GitLab/Gitea issue sync, API tokens and an MCP server for AI assistants. This script builds the API and web client from source and runs them with PostgreSQL behind Nginx.", + "desc": "TaskView is a source-available project and task management platform for teams. It offers task lists, Kanban boards, sprints and time tracking, plus organizations with role-based permissions, SSO, webhooks and issue sync with GitHub, GitLab and Gitea.", "script": "ct/taskview.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/taskview.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/taskview.sh", @@ -23864,13 +23807,11 @@ "Business & ERP" ], "notes": [ - "Without SMTP only the default account can sign in: sign-up, invitations and magic-link login all confirm the email address by mail. For more users add the SMTP_* settings from https://taskview.tech/docs/configuration/environment-variables to /opt/taskview_data/.env, consider ALLOW_PUBLIC_REGISTRATION=false (invited emails only), then run systemctl restart taskview.", - "The API only accepts browser requests from the origins in CORS_ALLOWED_ORIGINS, and builds email and OAuth links from APP_URL, both set to the container IP in /opt/taskview_data/.env. Change them when the IP changes or TaskView is reached through a hostname or reverse proxy (CORS_ALLOWED_ORIGINS takes a comma-separated list), then run systemctl restart taskview.", - "TaskView is source-available, not open source: the TaskView Source-Available License allows personal, family and internal company use, but forbids offering it to third parties as a hosted service or building a competing product on it.", - "Install and every update build TaskView from source, which needs about 4 GB of RAM (the API bundle is minified with Terser). The running services use far less, so the RAM can be lowered after the install and raised again before an update." + "Without SMTP only the default account can sign in. Add the SMTP_* settings (and ALLOW_PUBLIC_REGISTRATION=false for invite-only) to /opt/taskview_data/.env, then restart taskview.", + "Behind a hostname or reverse proxy, or after an IP change, update APP_URL and CORS_ALLOWED_ORIGINS in /opt/taskview_data/.env and restart taskview." ], "warnings": [ - "The default login user / user1!#Q is publicly documented. Sign in right after the install and claim the account under Account settings > Login and email (set your own login, email and password)." + "The default login is publicly known. Sign in right away and set your own login, email and password under Account settings > Login and email." ], "port": 80, "website": "https://taskview.tech/", @@ -25294,7 +25235,7 @@ { "name": "Typecho", "slug": "typecho", - "desc": "Typecho is a lightweight, open-source PHP blogging platform with a Markdown editor, pages, categories and tags, threaded comments, themes, plugins and an XML-RPC API for desktop and mobile editors. This script installs the official release with nginx, PHP-FPM and SQLite and completes the setup with upstream's command-line installer, so no setup page is ever left open.", + "desc": "Typecho is a lightweight, open-source PHP blogging platform with a Markdown editor, pages, categories and tags, threaded comments, themes, plugins and an XML-RPC API for desktop and mobile editors.", "script": "ct/typecho.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/typecho.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/typecho.sh", @@ -25307,14 +25248,11 @@ "Documents & Notes" ], "notes": [ - "The admin password is generated during install and shown at the end of the install output, together with the username. Log in at http:///admin/ and replace the placeholder email address admin@localhost.local in your profile.", - "Everything that is not core code lives in /opt/typecho_data: config.inc.php, the SQLite database typecho.db, and usr/ with themes, plugins and uploads. /opt/typecho/usr and /opt/typecho/config.inc.php are links into it. Back up /opt/typecho_data.", - "Updates replace only the core files, as upstream's upgrade guide does, and leave usr/ alone: the bundled themes are not refreshed, and edits made with the theme editor survive. After an update, open /admin/ and confirm the database upgrade Typecho asks for.", - "The interface is set to English using the language pack from typecho/languages, the timezone to UTC instead of upstream's UTC+8, and pretty URLs without index.php are on. All three can be changed in the settings." - ], - "warnings": [ - "The site address is set to http://, and Typecho builds every link from it. Change it under Settings > Basic when the IP changes or the blog sits behind a reverse proxy or domain." + "After the first login at http:///admin/, replace the placeholder email address admin@localhost.local in your profile.", + "Typecho builds every link from the site address http://. Change it under Settings > Basic when the IP changes or the blog sits behind a reverse proxy or domain.", + "After an update, open /admin/ and confirm the database upgrade Typecho asks for." ], + "warnings": [], "port": 80, "website": "https://typecho.org/", "documentation": "https://docs.typecho.org/", @@ -25774,7 +25712,7 @@ { "name": "Unsloth", "slug": "unsloth", - "desc": "Unsloth Studio is a local web UI for running and fine-tuning language models. It can search, download and serve GGUF, LoRA and safetensors models, compare two models side by side, export to other formats, and expose OpenAI- and Anthropic-compatible endpoints so local models can be used from Claude Code, Codex and similar tools. Fine-tuning with LoRA is configured entirely through the UI.", + "desc": "Unsloth Studio is a local web UI for running and fine-tuning language models. It downloads and serves GGUF, LoRA and safetensors models, compares models side by side, and exposes OpenAI- and Anthropic-compatible endpoints for tools like Claude Code and Codex.", "script": "ct/unsloth.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/unsloth.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/unsloth.sh", @@ -25787,13 +25725,11 @@ "AI / Coding & Dev-Tools" ], "notes": [ - "Log in as the user 'unsloth'; the generated password is in ~/unsloth.creds inside the container. Rotate it with 'unsloth studio reset-password', which prints a new one and needs no restart.", - "Models and Hugging Face caches land in /opt/unsloth_data, which fills up quickly - a single 7B model at Q4 is roughly 4 GB. Give the container more disk if you plan to keep several, and back that directory up rather than /opt/unsloth.", - "The Unsloth installer picks the PyTorch and llama.cpp builds for the GPU it finds (CUDA, ROCm, Intel or CPU). Run the update after adding or changing a GPU so the matching builds are installed." - ], - "warnings": [ - "Fine-tuning requires an NVIDIA GPU. Without one, inference, model management, export and the OpenAI-compatible API work, but training does not. Select GPU passthrough when creating the container; the matching driver libraries are installed automatically." + "Log in as unsloth with the password from ~/unsloth.creds in the container. To change it, run unsloth studio reset-password, which prints a new one.", + "Fine-tuning needs an NVIDIA GPU passed through to the container; without one, inference and export still work. After adding or changing a GPU, run the update to get matching builds.", + "Models are stored in /opt/unsloth_data and fill the disk fast (a 7B model at Q4 is about 4 GB). Add disk space if you plan to keep several." ], + "warnings": [], "port": 8888, "website": "https://unsloth.ai/", "documentation": "https://unsloth.ai/docs/new/studio", @@ -26049,7 +25985,7 @@ { "name": "useSend", "slug": "usesend", - "desc": "useSend is an open-source email sending platform and self-hosted alternative to Resend, SendGrid or Postmark. It sends transactional email through a REST API, SDKs or SMTP, and marketing campaigns to contact books from a visual editor, with domain verification, delivery, open and click tracking, bounces, suppression lists and webhooks. Delivery runs through Amazon SES. This script builds the web app and the SMTP proxy from source and runs them with PostgreSQL and Redis.", + "desc": "useSend is an open-source email sending platform and self-hosted alternative to Resend, SendGrid or Postmark. It sends transactional email through a REST API, SDKs or SMTP and marketing campaigns from a visual editor, with tracking, bounce handling and webhooks, delivered through Amazon SES.", "script": "ct/usesend.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/usesend.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/usesend.sh", @@ -26058,14 +25994,11 @@ "categories": [], "category_names": [], "notes": [ - "NEXTAUTH_URL in /opt/usesend_data/.env is http://:3000. Change it together with the OAuth callback URL when the IP changes or useSend runs behind a domain, then run systemctl restart usesend.", - "The SMTP proxy (usesend-smtp) accepts mail on 465 and 2465 (TLS) and 587 and 2587 (STARTTLS), user usesend and a useSend API key as password, and hands it to the API. Its certificate in /etc/ssl/usesend is self-signed and valid for one year. Port 25 is offered too unless another mail server already listens there.", - "Install and every update build useSend from source (Next.js), which takes about 15 minutes on 2 cores and needs the 4 GB of RAM. The running services use about 400 MB, so the RAM can be lowered after the install and raised again before an update." + "Sending needs Amazon SES: set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in /opt/usesend_data/.env, then add SES under Admin with a callback URL reachable from the internet.", + "Behind a domain or after an IP change, update NEXTAUTH_URL in /opt/usesend_data/.env and the OAuth callback URL, then restart usesend." ], "warnings": [ - "useSend has no local accounts. Sign-in is GitHub OAuth (Google OAuth works too, but only behind an HTTPS domain); the email code login cannot work on a fresh instance, because useSend sends that code through its own verified SES domain. Create a GitHub OAuth app with the callback URL http://:3000/api/auth/callback/github and pass var_github_id and var_github_secret, or fill in GITHUB_ID and GITHUB_SECRET in /opt/usesend_data/.env afterwards and run systemctl enable --now usesend usesend-smtp. The services do not start until then.", - "The first sign-in creates the account, after that only email addresses with a team invitation can sign up. Until then anyone with a GitHub account who reaches the port can claim the instance, so sign in right after setting up OAuth.", - "Sending needs Amazon SES. useSend installs and runs without it, but no email leaves until AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY of an IAM user with AmazonSESFullAccess and AmazonSNSFullAccess are set in /opt/usesend_data/.env and SES is added under Admin with a region and a callback URL. That URL must be reachable from the internet, because SNS posts delivery, bounce and complaint events to it. New SES accounts start in sandbox mode and only send to verified addresses." + "Sign-in is GitHub OAuth only, and the first sign-in claims the instance. Anyone with a GitHub account who reaches the port can do that, so sign in right after setting up OAuth." ], "port": 3000, "website": "https://usesend.com/", @@ -26191,7 +26124,7 @@ { "name": "Vane", "slug": "vane", - "desc": "Vane (formerly Perplexica) is a self-hosted AI answering engine in the style of Perplexity. It searches the web through SearXNG, reads the results and answers with cited sources, using a local LLM through Ollama or a cloud provider such as OpenAI, Anthropic, Gemini or Groq. It also offers speed, balanced and quality modes, academic and discussion search, image and video search, file uploads and a search history. This script builds Vane from source and runs a private SearXNG instance with JSON output next to it.", + "desc": "Vane (formerly Perplexica) is a self-hosted AI answering engine in the style of Perplexity. It searches the web through SearXNG and answers with cited sources, using a local LLM through Ollama or a cloud provider such as OpenAI, Anthropic, Gemini or Groq.", "script": "ct/vane.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/vane.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/vane.sh", @@ -26204,13 +26137,10 @@ "AI / Coding & Dev-Tools" ], "notes": [ - "No AI provider is configured. The first visit to port 3000 opens the setup screen: add Ollama, OpenAI, Anthropic, Gemini, Groq or any OpenAI-compatible server there and pick a chat and an embedding model. Ollama on another host must listen on 0.0.0.0 and be entered as http://:11434.", - "The bundled SearXNG only listens on 127.0.0.1:8888 and is configured in /etc/searxng/settings.yml (restart with systemctl restart searxng). To use your own instance instead, enable the json format there and change the SearXNG URL in Vane's settings.", - "Settings and API keys (config.json), the chat history (db.sqlite) and uploaded files live in /opt/vane_data, which updates leave untouched.", - "Install and every update build Vane from source, which takes about 10 minutes on 2 cores and needs the 4 GB of RAM and 12 GB of disk. Vane and SearXNG together idle at about 500 MB, so the RAM can be lowered after the install and raised again before an update." + "The first visit opens the setup screen: add an AI provider and pick a chat and an embedding model. Ollama on another host must listen on 0.0.0.0 and is entered as http://:11434." ], "warnings": [ - "Vane has no login. Anyone who reaches port 3000 can use it, read the chat history and see the provider API keys in the settings, so keep it on a trusted network or behind an authenticating reverse proxy." + "Vane has no login: anyone who reaches port 3000 can read the chat history and the provider API keys. Keep it on a trusted network or behind an authenticating reverse proxy." ], "port": 3000, "website": "https://github.com/ItzCrazyKns/Vane", @@ -26447,12 +26377,11 @@ "AI / Coding & Dev-Tools" ], "notes": [ - "Model, port, dtype, VRAM share and HuggingFace token can be chosen up front in the script generator; they are written to /opt/vllm/vllm.env. Restart the service after changing the file: systemctl restart vllm", - "Flags not covered by a field go into VLLM_SERVE_ARGS in /opt/vllm/vllm.env, which is appended to 'vllm serve' verbatim.", - "The configured model is downloaded from HuggingFace on first service start, which needs internet access and disk space. For gated/private models set HF_TOKEN in /opt/vllm/vllm.env. Resource needs scale heavily with the chosen model." + "Pass a GPU through when creating the container. CPU-only inference is impractically slow.", + "The model downloads from HuggingFace on first start. Change it, HF_TOKEN (gated models) or extra flags (VLLM_SERVE_ARGS) in /opt/vllm/vllm.env, then run systemctl restart vllm." ], "warnings": [ - "Select NVIDIA GPU passthrough at container creation. vLLM installs the CUDA build by default and requires an NVIDIA GPU for usable performance; CPU-only inference is impractically slow." + "Without an API key the API accepts requests from anyone. Set VLLM_API_KEY in /opt/vllm/vllm.env (clients send it as a bearer token) and run systemctl restart vllm." ], "port": 8000, "website": "https://vllm.ai/", @@ -27161,7 +27090,7 @@ { "name": "Windmill", "slug": "windmill", - "desc": "Windmill is an open-source developer platform that turns scripts into webhooks, workflows and UIs. Scripts in Python, TypeScript, Bash, SQL and other languages get an auto-generated form and API, can be chained into flows with branches, loops, retries and approval steps, run on schedules or from webhooks and other triggers, and back low-code apps. This script runs the Community Edition binary in standalone mode (server and worker in one process) with PostgreSQL.", + "desc": "Windmill is an open-source developer platform that turns scripts into webhooks, workflows and UIs. Scripts in Python, TypeScript, Bash, SQL and more get an auto-generated form and API, and can be chained into flows, run on schedules or triggers, and back low-code apps.", "script": "ct/windmill.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/windmill.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/windmill.sh", @@ -27174,13 +27103,11 @@ "Automation & Scheduling" ], "notes": [ - "Webhook URLs, OAuth redirects and links in emails are built from BASE_URL in /opt/windmill_data/.env, which points at the container IP. Change it when the IP changes or Windmill sits behind a reverse proxy or domain, then run systemctl restart windmill. A Base URL set in the instance settings takes precedence.", - "Python (through uv, which downloads the Python version on first use), TypeScript on Bun, Bash, DuckDB and SQL scripts run out of the box. The other languages the editor offers (TypeScript on Deno, Go, PHP, PowerShell, Rust, C#, Java, Ansible and more) need their runtime installed in the container first.", - "Server and worker share one process with a single worker, so jobs run one at a time. For parallel jobs, run more Windmill processes with MODE=worker against the same database.", - "The windmill database role has no CREATEDB or CREATEROLE privilege, so the Custom instance database option for Data Tables and DuckLake fails with permission denied. Point Data Tables at a PostgreSQL resource instead." + "Webhook URLs and OAuth redirects are built from BASE_URL in /opt/windmill_data/.env. Update it after an IP change or behind a reverse proxy or domain, then restart windmill.", + "Python, TypeScript on Bun, Bash, DuckDB and SQL work out of the box. Other languages need their runtime installed in the container first." ], "warnings": [ - "Log in with admin@windmill.dev / changeme right after the install. Windmill then asks for a new superadmin account, which replaces the default one. Until you do that, anyone who reaches port 8000 can log in with the default credentials." + "Log in with the default credentials right away: Windmill then asks for a new superadmin account. Until then, anyone who reaches port 8000 can log in." ], "port": 8000, "website": "https://www.windmill.dev/", @@ -27345,7 +27272,7 @@ { "name": "Woodpecker CI", "slug": "woodpecker-ci", - "desc": "Woodpecker CI is a simple, community-driven CI/CD engine. Pipelines are YAML files in the repository that run on push, pull request, tag, release, cron or manual events, with matrix builds, secrets, approvals for forks and a web UI with live logs. This script installs the official server and one agent with the local backend and SQLite, and connects it to Forgejo, Gitea, GitHub, GitLab or Bitbucket.", + "desc": "Woodpecker CI is a simple, community-driven CI/CD engine for Forgejo, Gitea, GitHub, GitLab and Bitbucket. Pipelines are YAML files in the repository that run on pushes, pull requests, tags or schedules, with matrix builds, secrets and a web UI with live logs.", "script": "ct/woodpecker-ci.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/woodpecker-ci.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/woodpecker-ci.sh", @@ -27358,14 +27285,11 @@ "AI / Coding & Dev-Tools" ], "notes": [ - "Registration is closed (WOODPECKER_OPEN=false): only the logins in WOODPECKER_ADMIN can sign in until an admin adds more users under Settings > Users.", - "WOODPECKER_HOST is set to http://:8000 and the forge must be able to reach it for webhooks. Forgejo and Gitea refuse webhooks to private addresses unless ALLOWED_HOST_LIST under [webhook] in their app.ini allows them; github.com, gitlab.com and Bitbucket Cloud need Woodpecker CI reachable from the internet. Change WOODPECKER_HOST and the OAuth callback URL together when the IP or domain changes.", - "With the local backend, image: names the shell (bash, sh) or a plugin executable, not a container image, so steps like image: golang do not work, and services: are not supported. Install the toolchains your pipelines need in the container. For container-isolated pipelines, add an agent with the Docker or Podman backend on another host, pointed at :9000 with WOODPECKER_AGENT_SECRET from server.env.", - "Everything that is not a binary lives in /opt/woodpecker_data: server.env and agent.env, the SQLite database woodpecker.sqlite and the agent ID in agent.conf. Back up /opt/woodpecker_data." + "The forge must reach WOODPECKER_HOST (http://:8000) for webhooks. Forgejo and Gitea block private addresses unless ALLOWED_HOST_LIST under [webhook] in their app.ini allows them.", + "Steps run without containers: image: names a shell or plugin, not a container image, and services: are not supported. Install the toolchains your pipelines need in the container." ], "warnings": [ - "Woodpecker CI has no local accounts, users sign in through the forge. Without the forge settings at install time, create an OAuth app on the forge with the callback URL http://:8000/authorize, fill in the forge block and WOODPECKER_ADMIN in /opt/woodpecker_data/server.env and run systemctl enable --now woodpecker-server woodpecker-agent.", - "The agent uses the local backend: pipeline steps run directly in this container as root, without isolation, so any pipeline can read the database with the users' forge tokens and the secrets in /opt/woodpecker_data. Only build repositories you trust." + "Pipeline steps run directly in this container as root, so any pipeline can read the stored secrets and the users' forge tokens. Only build repositories you trust." ], "port": 8000, "website": "https://woodpecker-ci.org/", @@ -27666,7 +27590,7 @@ { "name": "Youtarr", "slug": "youtarr", - "desc": "Youtarr is a self-hosted YouTube downloader that subscribes to channels and playlists and downloads new videos on a schedule with yt-dlp. Videos are organized per channel with NFO files, posters and embedded MP4 metadata, so they show up cleanly in Plex, Jellyfin, Emby or Kodi. It also mirrors playlists into those servers, syncs watch status back, supports SponsorBlock and age, space or watched-based cleanup, and plays videos in its own web UI.", + "desc": "Youtarr is a self-hosted YouTube downloader that subscribes to channels and playlists and downloads new videos on a schedule with yt-dlp. It adds NFO files, posters and metadata so the videos show up cleanly in Plex, Jellyfin, Emby or Kodi.", "script": "ct/youtarr.sh", "script_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/youtarr.sh", "script_url_mirror": "https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/youtarr.sh", @@ -27679,12 +27603,10 @@ "Media & Streaming" ], "notes": [ - "Videos are downloaded to /opt/youtarr_data/videos (DATA_PATH in /opt/youtarr_data/.env). To store them on a NAS or share them with Plex, Jellyfin or Emby, bind-mount the media folder there, e.g. pct set -mp0 /mnt/media/youtube,mp=/opt/youtarr_data/videos, then restart the container. In an unprivileged container the host folder must be writable by UID 100000.", - "Settings live in /opt/youtarr_data/config/config.json (edited through the web UI), database credentials in /opt/youtarr_data/.env. Both survive updates. Running update also refreshes yt-dlp; Youtarr can additionally auto-update it from its settings." - ], - "warnings": [ - "There is no default login. On first start Youtarr writes a one-time setup token to /opt/youtarr_data/config/setup-token (also shown in journalctl -u youtarr). Open the web UI, paste the token and create the admin account." + "There is no default login: paste the one-time token from /opt/youtarr_data/config/setup-token into the web UI and create the admin account.", + "To keep videos on a NAS or share them with Plex or Jellyfin, mount that folder at /opt/youtarr_data/videos (pct set -mp0 /host/path,mp=/opt/youtarr_data/videos). The host folder must be writable by UID 100000." ], + "warnings": [], "port": 3011, "website": "https://youtarr.com/", "documentation": "https://dialmasterorg.github.io/Youtarr/docs/installation/",