From fc4f8e2ac59999981847e35cdf2b28a0fa779128 Mon Sep 17 00:00:00 2001
From: "push-app-to-main[bot]"
 <203845782+push-app-to-main[bot]@users.noreply.github.com>
Date: Fri, 13 Nov 2026 09:15:32 +0100
Subject: [PATCH] Add bulwark (ct) (#18656)

Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
---
 ct/bulwark.sh              | 60 ++++++++++++++++++++++++++++++++++++++
 install/bulwark-install.sh | 60 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 120 insertions(+)
 create mode 100644 ct/bulwark.sh
 create mode 100644 install/bulwark-install.sh

diff --git a/ct/bulwark.sh b/ct/bulwark.sh
new file mode 100644
index 000000000..8bf9b66c8
--- /dev/null
+++ b/ct/bulwark.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/bulwarkmail/webmail
+
+APP="Bulwark"
+var_tags="${var_tags:-mail;webmail;jmap}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+export var_jmap_url="${var_jmap_url:-}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/bulwark ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "bulwark" "bulwarkmail/webmail"; then
+    msg_info "Stopping Bulwark"
+    systemctl stop bulwark
+    msg_ok "Stopped Bulwark"
+
+    NODE_VERSION="24" setup_nodejs
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "bulwark" "bulwarkmail/webmail" "prebuild" "latest" "/opt/bulwark" "bulwark-standalone-*-linux-$(arch_resolve).tar.gz"
+
+    msg_info "Starting Bulwark"
+    systemctl start bulwark
+    msg_ok "Started Bulwark"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
+echo -e "${INFO}${YW}Setup wizard token: journalctl -u bulwark (inside the container)${CL}"
diff --git a/install/bulwark-install.sh b/install/bulwark-install.sh
new file mode 100644
index 000000000..2e5603e4a
--- /dev/null
+++ b/install/bulwark-install.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/bulwarkmail/webmail
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+NODE_VERSION="24" setup_nodejs
+
+fetch_and_deploy_gh_release "bulwark" "bulwarkmail/webmail" "prebuild" "latest" "/opt/bulwark" "bulwark-standalone-*-linux-$(arch_resolve).tar.gz"
+
+msg_info "Configuring Bulwark"
+mkdir -p /opt/bulwark_data
+cat <<EOF >/opt/bulwark_data/.env
+NODE_ENV=production
+HOSTNAME=0.0.0.0
+PORT=3000
+JMAP_SERVER_URL=${var_jmap_url:-}
+COOKIE_SECURE=false
+ADMIN_CONFIG_DIR=/opt/bulwark_data/admin
+ADMIN_STATE_DIR=/opt/bulwark_data/admin-state
+SETTINGS_DATA_DIR=/opt/bulwark_data/settings
+PLUGIN_SECRETS_DIR=/opt/bulwark_data/plugin-secrets
+TELEMETRY_DATA_DIR=/opt/bulwark_data/telemetry
+VERSION_CHECK_DATA_DIR=/opt/bulwark_data/version-check
+EOF
+chmod 600 /opt/bulwark_data/.env
+msg_ok "Configured Bulwark"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/bulwark.service
+[Unit]
+Description=Bulwark Webmail
+After=network.target
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/bulwark
+EnvironmentFile=/opt/bulwark_data/.env
+ExecStart=/usr/bin/node /opt/bulwark/server.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now bulwark
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc