* Set default ProxmoxVE raw URL in UPS script
Define `_CS_DEFAULT_URL` at the top of `ct/pve-ups.sh` and remove the outdated bootstrap comments, aligning the script with the newer URL-default pattern used for script sourcing.
* Branch var_cpu by OS where the two variants actually differ
The merged scripts branch var_ram, var_disk and var_version on var_os but
left var_cpu above the branch, so both variants inherited the Debian value.
On Vaultwarden that meant an Alpine container was told it wanted four cores
for an update that runs apk and restarts a service.
Only seven scripts are affected. Comparing each merged script against the
alpine-* script it replaced, 22 of the 29 already had the same CPU count on
both sides, so moving the line there would be churn with no behaviour change.
These seven did not:
docker, forgejo, ironclaw, syncthing, transmission, zigbee2mqtt 2 -> 1
vaultwarden 4 -> 1
The Alpine values are the ones those scripts carried before the merge, read
back out of the deleted alpine-* files rather than picked. The Debian arm
keeps what it has now.
Needs the matching core change: until build.func derives var_os inside a
container, an update never reaches the Alpine arm at all.
* fix: source url
* Update script to source build functions from URLs
---------
Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>
DocuSeal switched to its own PDFium fork (upstream commit "adjust pdfium",
2026-08-15) and now attaches functions that only exist in that build, e.g.
FPDFPage_GetAnnotCountRaw from the added fpdf_annots_raw.h. The generic
bblanchon/pdfium-binaries library the script installed does not export them,
so lib/pdfium.rb raises FFI::NotFoundError while Rails eager-loads and both
docuseal.service and docuseal-sidekiq.service fail to start:
Unable to load application: FFI::NotFoundError: Function
'FPDFPage_GetAnnotCountRaw' not found in [libpdfium.so]
Install the library from docusealco/pdfium-binaries instead, matching the
upstream Dockerfile. It is only published as a musl build (DocuSeal's image is
Alpine based), so the musl runtime is installed and its library directory is
added to the loader search path - the shared object needs "libc.so" (musl) at
dlopen time. Verified on glibc: the library loads, resolves the raw annotation
functions and renders pages correctly.
The update path now refreshes PDFium too, so existing containers are repaired
by running "update" even when DocuSeal itself is already up to date.
Gatus install was failing with the existing memory defaults (512M) due to thrashing from memory pressure while compiling the package. Bumped to 2048M as the same issue occurred when using 1024M.
Gatus LXC is hovering around 150M post install so this could be bumped down after the install completed but there is no installation time only setting as far as I am aware.
* Shelfmark: fix internal bypasser under the gevent worker
The internal captcha bypasser never worked on this install. Shelfmark is served
by gunicorn's GeventWebSocketWorker, and DOCKERMODE controls whether the bypass
browser runs in a helper process "isolated from gunicorn/gevent" (upstream's
_get_via_subprocess). With DOCKERMODE=false the SeleniumBase CDP browser starts
inside the monkey-patched loop, its asyncio websocket never connects, and every
bypass dies at "Pure CDP browser startup timed out after 45s" — searches then
burn their whole retry budget and surface as "mirrors are blocked".
Set DOCKERMODE=true for deployment type 1, and migrate existing installs on
update. The flag is misnamed upstream: it gates gevent isolation, not Docker.
Also drop chromium.service. Nothing in Shelfmark connects to port 9222 — the
bypasser launches its own browser on a random port — so it only consumed
~226MB. With DOCKERMODE enabled it is additionally killed by Shelfmark's
orphan-process reaper (pkill -f chromium) on every bypass and respawned by
systemd, since an LXC shares its PID namespace.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Ln3yVj3sWHG2c6T78W1we
* Shelfmark: address review — one check, drop comments
Collapse the chromium.service removal and the DOCKERMODE migration into the
single internal-bypasser check, as every affected install has both. Guard the
disable so a second update run does not fail on the removed unit, matching
esphome.sh. Drop the explanatory comments.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Ln3yVj3sWHG2c6T78W1we
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Add securo (ct)
* fix: src
* securo: enable nginx site via nginx_enable_site helper
Replaces the manual symlink + default removal + restart with the core
helper, which also runs nginx -t before restarting and enables the unit.
---------
Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>
Co-authored-by: MickLesk <mickey.leskowitz@gmail.com>
* Add mumble (ct)
* Update mumble.sh to source new build function
Removed local core checkout instructions and added new source for build.func.
---------
Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
