build(deps-dev): Bump prettier from 3.8.0 to 3.8.1

Bumps [prettier](https://github.com/prettier/prettier) from 3.8.0 to 3.8.1.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.8.0...3.8.1)

---
updated-dependencies:
- dependency-name: prettier
  dependency-version: 3.8.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.env.example

@@ -18,7 +18,12 @@ ALLOWED_SCRIPT_PATHS="scripts/"
 WEBSOCKET_PORT="3001"
 
 # User settings
+# Optional tokens for private repos: GITHUB_TOKEN (GitHub), GITLAB_TOKEN (GitLab),
+# BITBUCKET_APP_PASSWORD or BITBUCKET_TOKEN (Bitbucket). REPO_URL and added repos
+# can be GitHub, GitLab, Bitbucket, or custom Git servers.
 GITHUB_TOKEN=
+GITLAB_TOKEN=
+BITBUCKET_APP_PASSWORD=
 SAVE_FILTER=false
 FILTERS=
 AUTH_USERNAME=

.github/pull_request_template.md

@@ -4,7 +4,7 @@
 
 
 ## 🔗 Related PR / Issue  
-Link: #
+Fixes: #
 
 
 ## ✅ Prerequisites  (**X** in brackets) 

.github/workflows/publish_release.yml

@@ -31,20 +31,24 @@ jobs:
           echo "Found draft version: ${{ steps.draft.outputs.tag_name }}"
 
       
-      - name: Create branch and commit VERSION
+      - name: Create branch and commit VERSION and package.json
         run: |
           branch="update-version-${{ steps.draft.outputs.tag_name }}"
           # Delete remote branch if exists
           git push origin --delete "$branch" || echo "No remote branch to delete"
           git fetch origin main
           git checkout -b "$branch" origin/main
-          # Write VERSION file and timestamp to ensure a diff
+          # Version without 'v' prefix (e.g. v1.2.3 -> 1.2.3)
           version="${{ steps.draft.outputs.tag_name }}"
-          echo "$version" | sed 's/^v//' > VERSION
+          version_plain=$(echo "$version" | sed 's/^v//')
-          git add VERSION
+          # Write VERSION file
+          echo "$version_plain" > VERSION
+          # Update package.json version
+          jq --arg v "$version_plain" '.version = $v' package.json > package.json.tmp && mv package.json.tmp package.json
+          git add VERSION package.json
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git commit -m "chore: add VERSION $version" --allow-empty
+          git commit -m "chore: bump version to $version_plain (VERSION + package.json)" --allow-empty
 
       - name: Push changes
         run: |
@@ -57,8 +61,8 @@ jobs:
             pr_url=$(gh pr create \
             --base main \
             --head update-version-${{ steps.draft.outputs.tag_name }} \
-            --title "chore: add VERSION ${{ steps.draft.outputs.tag_name }}" \
+            --title "chore: bump version to ${{ steps.draft.outputs.tag_name }} (VERSION + package.json)" \
-            --body "Adds VERSION file for release ${{ steps.draft.outputs.tag_name }}" \
+            --body "Updates VERSION file and package.json version for release ${{ steps.draft.outputs.tag_name }}" \
             --label automated)
     
             pr_number=$(echo "$pr_url" | awk -F/ '{print $NF}')

README.md

@@ -100,7 +100,7 @@ apt install -y nodejs
 ```bash
 # Clone the repository
 git clone https://github.com/community-scripts/ProxmoxVE-Local.git /opt/PVESciptslocal
-cd PVESciptslocal
+cd /opt/PVESciptslocal
 
 # Install dependencies and build
 npm install

VERSION

@@ -1 +1 @@
-0.5.0
+0.5.6

package.json

@@ -1,6 +1,6 @@
 {
   "name": "pve-scripts-local",
-  "version": "0.1.0",
+  "version": "0.5.6",
   "private": true,
   "type": "module",
   "scripts": {
@@ -25,35 +25,35 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@prisma/adapter-better-sqlite3": "^7.0.1",
+    "@prisma/adapter-better-sqlite3": "^7.3.0",
-    "@prisma/client": "^7.0.1",
+    "@prisma/client": "^7.3.0",
     "@radix-ui/react-dropdown-menu": "^2.1.16",
     "@radix-ui/react-slot": "^1.2.4",
-    "@t3-oss/env-nextjs": "^0.13.8",
+    "@t3-oss/env-nextjs": "^0.13.10",
     "@tailwindcss/typography": "^0.5.19",
-    "@tanstack/react-query": "^5.90.11",
+    "@tanstack/react-query": "^5.90.20",
-    "@trpc/client": "^11.7.2",
+    "@trpc/client": "^11.8.1",
-    "@trpc/react-query": "^11.7.2",
+    "@trpc/react-query": "^11.8.1",
-    "@trpc/server": "^11.7.2",
+    "@trpc/server": "^11.8.1",
     "@types/react-syntax-highlighter": "^15.5.13",
     "@types/ws": "^8.18.1",
-    "@xterm/addon-fit": "^0.10.0",
+    "@xterm/addon-fit": "^0.11.0",
-    "@xterm/addon-web-links": "^0.11.0",
+    "@xterm/addon-web-links": "^0.12.0",
-    "@xterm/xterm": "^5.5.0",
+    "@xterm/xterm": "^6.0.0",
     "axios": "^1.13.2",
     "bcryptjs": "^3.0.3",
-    "better-sqlite3": "^12.4.6",
+    "better-sqlite3": "^12.6.2",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cron-validator": "^1.4.0",
     "dotenv": "^17.2.3",
-    "jsonwebtoken": "^9.0.2",
+    "jsonwebtoken": "^9.0.3",
-    "lucide-react": "^0.555.0",
+    "lucide-react": "^0.562.0",
-    "next": "^16.0.5",
+    "next": ">=16.1.5",
     "node-cron": "^4.2.1",
-    "node-pty": "^1.0.0",
+    "node-pty": "^1.1.0",
-    "react": "^19.2.0",
+    "react": "^19.2.3",
-    "react-dom": "^19.2.0",
+    "react-dom": "^19.2.3",
     "react-markdown": "^10.1.0",
     "react-syntax-highlighter": "^16.1.0",
     "refractor": "^5.0.0",
@@ -62,37 +62,38 @@
     "strip-ansi": "^7.1.2",
     "superjson": "^2.2.6",
     "tailwind-merge": "^3.4.0",
-    "ws": "^8.18.3",
+    "ws": "^8.19.0",
-    "zod": "^4.1.13"
+    "zod": "^4.3.5"
   },
   "devDependencies": {
-    "@tailwindcss/postcss": "^4.1.17",
+    "next": ">=16.1.5",
+    "@tailwindcss/postcss": "^4.1.18",
     "@testing-library/jest-dom": "^6.9.1",
-    "@testing-library/react": "^16.3.0",
+    "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
     "@types/bcryptjs": "^3.0.0",
     "@types/better-sqlite3": "^7.6.13",
     "@types/jsonwebtoken": "^9.0.10",
-    "@types/node": "^24.10.1",
+    "@types/node": "^24.10.9",
     "@types/node-cron": "^3.0.11",
-    "@types/react": "^19.2.7",
+    "@types/react": "^19.2.8",
     "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^5.1.1",
+    "@vitejs/plugin-react": "^5.1.2",
-    "@vitest/coverage-v8": "^4.0.14",
+    "@vitest/coverage-v8": "^4.0.17",
-    "@vitest/ui": "^4.0.14",
+    "@vitest/ui": "^4.0.17",
-    "baseline-browser-mapping": "^2.8.32",
+    "baseline-browser-mapping": "^2.9.15",
-    "eslint": "^9.39.1",
+    "eslint": "^9.39.2",
-    "eslint-config-next": "^16.0.5",
+    "eslint-config-next": "^16.1.3",
-    "jsdom": "^27.2.0",
+    "jsdom": "^27.4.0",
     "postcss": "^8.5.6",
-    "prettier": "^3.7.1",
+    "prettier": "^3.8.1",
-    "prettier-plugin-tailwindcss": "^0.7.1",
+    "prettier-plugin-tailwindcss": "^0.7.2",
-    "prisma": "^7.0.1",
+    "prisma": "^7.3.0",
-    "tailwindcss": "^4.1.17",
+    "tailwindcss": "^4.1.18",
-    "tsx": "^4.19.4",
+    "tsx": "^4.21.0",
     "typescript": "^5.9.3",
-    "typescript-eslint": "^8.48.0",
+    "typescript-eslint": "^8.54.0",
-    "vitest": "^4.0.14"
+    "vitest": "^4.0.17"
   },
   "ct3aMetadata": {
     "initVersion": "7.39.3"
@@ -102,6 +103,7 @@
     "node": ">=24.0.0"
   },
   "overrides": {
-    "prismjs": "^1.30.0"
+    "prismjs": "^1.30.0",
+    "hono": ">=4.11.7"
   }
 }

scripts/core/alpine-install.func

@@ -1,4 +1,4 @@
-# Copyright (c) 2021-2025 community-scripts ORG
+# Copyright (c) 2021-2026 community-scripts ORG
 # Author: tteck (tteckster)
 # Co-Author: MickLesk
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
@@ -6,33 +6,68 @@
 if ! command -v curl >/dev/null 2>&1; then
   apk update && apk add curl >/dev/null 2>&1
 fi
-
+source "$(dirname "${BASH_SOURCE[0]}")/core.func"
+source "$(dirname "${BASH_SOURCE[0]}")/error-handler.func"
 load_functions
+catch_errors
+
+# Get LXC IP address (must be called INSIDE container, after network is up)
+get_lxc_ip
 
 # This function enables IPv6 if it's not disabled and sets verbose mode
 verb_ip6() {
   set_std_mode # Set STD mode based on VERBOSE
 
-  if [ "$DISABLEIPV6" == "yes" ]; then
+  if [ "${IPV6_METHOD:-}" = "disable" ]; then
+    msg_info "Disabling IPv6 (this may affect some services)"
     $STD sysctl -w net.ipv6.conf.all.disable_ipv6=1
-    echo "net.ipv6.conf.all.disable_ipv6 = 1" >>/etc/sysctl.conf
+    $STD sysctl -w net.ipv6.conf.default.disable_ipv6=1
+    $STD sysctl -w net.ipv6.conf.lo.disable_ipv6=1
+    mkdir -p /etc/sysctl.d
+    $STD tee /etc/sysctl.d/99-disable-ipv6.conf >/dev/null <<EOF
+net.ipv6.conf.all.disable_ipv6 = 1
+net.ipv6.conf.default.disable_ipv6 = 1
+net.ipv6.conf.lo.disable_ipv6 = 1
+EOF
     $STD rc-update add sysctl default
+    msg_ok "Disabled IPv6"
   fi
 }
 
-# This function catches errors and handles them with the error handler function
+set -Eeuo pipefail
-catch_errors() {
+trap 'error_handler $? $LINENO "$BASH_COMMAND"' ERR
-  set -Eeuo pipefail
+trap on_exit EXIT
-  trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
+trap on_interrupt INT
+trap on_terminate TERM
+
+error_handler() {
+  local exit_code="$1"
+  local line_number="$2"
+  local command="$3"
+
+  if [[ "$exit_code" -eq 0 ]]; then
+    return 0
+  fi
+
+  printf "\e[?25h"
+  echo -e "\n${RD}[ERROR]${CL} in line ${RD}$line_number${CL}: exit code ${RD}$exit_code${CL}: while executing command ${YW}$command${CL}\n"
+  exit "$exit_code"
 }
 
-# This function handles errors
+on_exit() {
-error_handler() {
   local exit_code="$?"
-  local line_number="$1"
+  [[ -n "${lockfile:-}" && -e "$lockfile" ]] && rm -f "$lockfile"
-  local command="$2"
+  exit "$exit_code"
-  local error_message="${RD}[ERROR]${CL} in line ${RD}$line_number${CL}: exit code ${RD}$exit_code${CL}: while executing command ${YW}$command${CL}"
+}
-  echo -e "\n$error_message\n"
+
+on_interrupt() {
+  echo -e "\n${RD}Interrupted by user (SIGINT)${CL}"
+  exit 130
+}
+
+on_terminate() {
+  echo -e "\n${RD}Terminated by signal (SIGTERM)${CL}"
+  exit 143
 }
 
 # This function sets up the Container OS by generating the locale, setting the timezone, and checking the network connection
@@ -61,10 +96,10 @@ network_check() {
   set +e
   trap - ERR
   if ping -c 1 -W 1 1.1.1.1 &>/dev/null || ping -c 1 -W 1 8.8.8.8 &>/dev/null || ping -c 1 -W 1 9.9.9.9 &>/dev/null; then
-    msg_ok "Internet Connected"
+    ipv4_status="${GN}✔${CL} IPv4"
   else
-    msg_error "Internet NOT Connected"
+    ipv4_status="${RD}✖${CL} IPv4"
-    read -r -p "Would you like to continue anyway? <y/N> " prompt
+    read -r -p "Internet NOT connected. Continue anyway? <y/N> " prompt
     if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
       echo -e "${INFO}${RD}Expect Issues Without Internet${CL}"
     else
@@ -73,7 +108,11 @@ network_check() {
     fi
   fi
   RESOLVEDIP=$(getent hosts github.com | awk '{ print $1 }')
-  if [[ -z "$RESOLVEDIP" ]]; then msg_error "DNS Lookup Failure"; else msg_ok "DNS Resolved github.com to ${BL}$RESOLVEDIP${CL}"; fi
+  if [[ -z "$RESOLVEDIP" ]]; then
+    msg_error "Internet: ${ipv4_status}  DNS Failed"
+  else
+    msg_ok "Internet: ${ipv4_status}  DNS: ${BL}${RESOLVEDIP}${CL}"
+  fi
   set -e
   trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 }
@@ -82,29 +121,20 @@ network_check() {
 update_os() {
   msg_info "Updating Container OS"
   $STD apk -U upgrade
-  #source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/tools.func)
+  source "$(dirname "${BASH_SOURCE[0]}")/tools.func"
   msg_ok "Updated Container OS"
 }
 
 # This function modifies the message of the day (motd) and SSH settings
 motd_ssh() {
   echo "export TERM='xterm-256color'" >>/root/.bashrc
-  IP=$(ip -4 addr show eth0 | awk '/inet / {print $2}' | cut -d/ -f1 | head -n 1)
-
-  if [ -f "/etc/os-release" ]; then
-    OS_NAME=$(grep ^NAME /etc/os-release | cut -d= -f2 | tr -d '"')
-    OS_VERSION=$(grep ^VERSION_ID /etc/os-release | cut -d= -f2 | tr -d '"')
-  else
-    OS_NAME="Alpine Linux"
-    OS_VERSION="Unknown"
-  fi
 
   PROFILE_FILE="/etc/profile.d/00_lxc-details.sh"
   echo "echo -e \"\"" >"$PROFILE_FILE"
   echo -e "echo -e \"${BOLD}${APPLICATION} LXC Container${CL}"\" >>"$PROFILE_FILE"
   echo -e "echo -e \"${TAB}${GATEWAY}${YW} Provided by: ${GN}community-scripts ORG ${YW}| GitHub: ${GN}https://github.com/community-scripts/ProxmoxVE${CL}\"" >>"$PROFILE_FILE"
   echo "echo \"\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${TAB}${OS}${YW} OS: ${GN}${OS_NAME} - Version: ${OS_VERSION}${CL}\"" >>"$PROFILE_FILE"
+  echo -e "echo -e \"${TAB}${OS}${YW} OS: ${GN}\$(grep ^NAME /etc/os-release | cut -d= -f2 | tr -d '\"') - Version: \$(grep ^VERSION_ID /etc/os-release | cut -d= -f2 | tr -d '\"')${CL}\"" >>"$PROFILE_FILE"
   echo -e "echo -e \"${TAB}${HOSTNAME}${YW} Hostname: ${GN}\$(hostname)${CL}\"" >>"$PROFILE_FILE"
   echo -e "echo -e \"${TAB}${INFO}${YW} IP Address: ${GN}\$(ip -4 addr show eth0 | awk '/inet / {print \$2}' | cut -d/ -f1 | head -n 1)${CL}\"" >>"$PROFILE_FILE"
 
@@ -154,10 +184,4 @@ EOF
   echo "bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/${app}.sh)\"" >/usr/bin/update
   chmod +x /usr/bin/update
 
-  if [[ -n "${SSH_AUTHORIZED_KEY}" ]]; then
-    mkdir -p /root/.ssh
-    echo "${SSH_AUTHORIZED_KEY}" >/root/.ssh/authorized_keys
-    chmod 700 /root/.ssh
-    chmod 600 /root/.ssh/authorized_keys
-  fi
 }

scripts/core/alpine-tools.func

@@ -0,0 +1,188 @@
+#!/bin/ash
+# shellcheck shell=ash
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+
+if ! command -v curl >/dev/null 2>&1; then
+  apk update && apk add curl >/dev/null 2>&1
+fi
+source "$(dirname "${BASH_SOURCE[0]}")/core.func"
+source "$(dirname "${BASH_SOURCE[0]}")/error-handler.func"
+load_functions
+catch_errors
+
+# Get LXC IP address (must be called INSIDE container, after network is up)
+get_lxc_ip
+
+# This function enables IPv6 if it's not disabled and sets verbose mode
+verb_ip6() {
+  set_std_mode # Set STD mode based on VERBOSE
+
+  if [ "${IPV6_METHOD:-}" = "disable" ]; then
+    msg_info "Disabling IPv6 (this may affect some services)"
+    $STD sysctl -w net.ipv6.conf.all.disable_ipv6=1
+    $STD sysctl -w net.ipv6.conf.default.disable_ipv6=1
+    $STD sysctl -w net.ipv6.conf.lo.disable_ipv6=1
+    mkdir -p /etc/sysctl.d
+    $STD tee /etc/sysctl.d/99-disable-ipv6.conf >/dev/null <<EOF
+net.ipv6.conf.all.disable_ipv6 = 1
+net.ipv6.conf.default.disable_ipv6 = 1
+net.ipv6.conf.lo.disable_ipv6 = 1
+EOF
+    $STD rc-update add sysctl default
+    msg_ok "Disabled IPv6"
+  fi
+}
+
+set -Eeuo pipefail
+trap 'error_handler $? $LINENO "$BASH_COMMAND"' ERR
+trap on_exit EXIT
+trap on_interrupt INT
+trap on_terminate TERM
+
+error_handler() {
+  local exit_code="$1"
+  local line_number="$2"
+  local command="$3"
+
+  if [[ "$exit_code" -eq 0 ]]; then
+    return 0
+  fi
+
+  printf "\e[?25h"
+  echo -e "\n${RD}[ERROR]${CL} in line ${RD}$line_number${CL}: exit code ${RD}$exit_code${CL}: while executing command ${YW}$command${CL}\n"
+  exit "$exit_code"
+}
+
+on_exit() {
+  local exit_code="$?"
+  [[ -n "${lockfile:-}" && -e "$lockfile" ]] && rm -f "$lockfile"
+  exit "$exit_code"
+}
+
+on_interrupt() {
+  echo -e "\n${RD}Interrupted by user (SIGINT)${CL}"
+  exit 130
+}
+
+on_terminate() {
+  echo -e "\n${RD}Terminated by signal (SIGTERM)${CL}"
+  exit 143
+}
+
+# This function sets up the Container OS by generating the locale, setting the timezone, and checking the network connection
+setting_up_container() {
+  msg_info "Setting up Container OS"
+  while [ $i -gt 0 ]; do
+    if [ "$(ip addr show | grep 'inet ' | grep -v '127.0.0.1' | awk '{print $2}' | cut -d'/' -f1)" != "" ]; then
+      break
+    fi
+    echo 1>&2 -en "${CROSS}${RD} No Network! "
+    sleep $RETRY_EVERY
+    i=$((i - 1))
+  done
+
+  if [ "$(ip addr show | grep 'inet ' | grep -v '127.0.0.1' | awk '{print $2}' | cut -d'/' -f1)" = "" ]; then
+    echo 1>&2 -e "\n${CROSS}${RD} No Network After $RETRY_NUM Tries${CL}"
+    echo -e "${NETWORK}Check Network Settings"
+    exit 1
+  fi
+  msg_ok "Set up Container OS"
+  msg_ok "Network Connected: ${BL}$(ip addr show | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1 | tail -n1)${CL}"
+}
+
+# This function checks the network connection by pinging a known IP address and prompts the user to continue if the internet is not connected
+network_check() {
+  set +e
+  trap - ERR
+  if ping -c 1 -W 1 1.1.1.1 &>/dev/null || ping -c 1 -W 1 8.8.8.8 &>/dev/null || ping -c 1 -W 1 9.9.9.9 &>/dev/null; then
+    ipv4_status="${GN}✔${CL} IPv4"
+  else
+    ipv4_status="${RD}✖${CL} IPv4"
+    read -r -p "Internet NOT connected. Continue anyway? <y/N> " prompt
+    if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
+      echo -e "${INFO}${RD}Expect Issues Without Internet${CL}"
+    else
+      echo -e "${NETWORK}Check Network Settings"
+      exit 1
+    fi
+  fi
+  RESOLVEDIP=$(getent hosts github.com | awk '{ print $1 }')
+  if [[ -z "$RESOLVEDIP" ]]; then
+    msg_error "Internet: ${ipv4_status}  DNS Failed"
+  else
+    msg_ok "Internet: ${ipv4_status}  DNS: ${BL}${RESOLVEDIP}${CL}"
+  fi
+  set -e
+  trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
+}
+
+# This function updates the Container OS by running apt-get update and upgrade
+update_os() {
+  msg_info "Updating Container OS"
+  $STD apk -U upgrade
+  source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
+  msg_ok "Updated Container OS"
+}
+
+# This function modifies the message of the day (motd) and SSH settings
+motd_ssh() {
+  echo "export TERM='xterm-256color'" >>/root/.bashrc
+
+  PROFILE_FILE="/etc/profile.d/00_lxc-details.sh"
+  echo "echo -e \"\"" >"$PROFILE_FILE"
+  echo -e "echo -e \"${BOLD}${APPLICATION} LXC Container${CL}"\" >>"$PROFILE_FILE"
+  echo -e "echo -e \"${TAB}${GATEWAY}${YW} Provided by: ${GN}community-scripts ORG ${YW}| GitHub: ${GN}https://github.com/community-scripts/ProxmoxVE${CL}\"" >>"$PROFILE_FILE"
+  echo "echo \"\"" >>"$PROFILE_FILE"
+  echo -e "echo -e \"${TAB}${OS}${YW} OS: ${GN}\$(grep ^NAME /etc/os-release | cut -d= -f2 | tr -d '\"') - Version: \$(grep ^VERSION_ID /etc/os-release | cut -d= -f2 | tr -d '\"')${CL}\"" >>"$PROFILE_FILE"
+  echo -e "echo -e \"${TAB}${HOSTNAME}${YW} Hostname: ${GN}\$(hostname)${CL}\"" >>"$PROFILE_FILE"
+  echo -e "echo -e \"${TAB}${INFO}${YW} IP Address: ${GN}\$(ip -4 addr show eth0 | awk '/inet / {print \$2}' | cut -d/ -f1 | head -n 1)${CL}\"" >>"$PROFILE_FILE"
+
+  # Configure SSH if enabled
+  if [[ "${SSH_ROOT}" == "yes" ]]; then
+    # Enable sshd service
+    $STD rc-update add sshd
+    # Allow root login via SSH
+    sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" /etc/ssh/sshd_config
+    # Start the sshd service
+    $STD /etc/init.d/sshd start
+  fi
+}
+
+# Validate Timezone for some LXC's
+validate_tz() {
+  [[ -f "/usr/share/zoneinfo/$1" ]]
+}
+
+# This function customizes the container and enables passwordless login for the root user
+customize() {
+  if [[ "$PASSWORD" == "" ]]; then
+    msg_info "Customizing Container"
+    passwd -d root >/dev/null 2>&1
+
+    # Ensure agetty is available
+    apk add --no-cache --force-broken-world util-linux >/dev/null 2>&1
+
+    # Create persistent autologin boot script
+    mkdir -p /etc/local.d
+    cat <<'EOF' >/etc/local.d/autologin.start
+#!/bin/sh
+sed -i 's|^tty1::respawn:.*|tty1::respawn:/sbin/agetty --autologin root --noclear tty1 38400 linux|' /etc/inittab
+kill -HUP 1
+EOF
+    touch /root/.hushlogin
+
+    chmod +x /etc/local.d/autologin.start
+    rc-update add local >/dev/null 2>&1
+
+    # Apply autologin immediately for current session
+    /etc/local.d/autologin.start
+
+    msg_ok "Customized Container"
+  fi
+
+  echo "bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/${app}.sh)\"" >/usr/bin/update
+  chmod +x /usr/bin/update
+
+}

scripts/core/api.func

@@ -1,7 +1,154 @@
-# Copyright (c) 2021-2025 community-scripts ORG
+# Copyright (c) 2021-2026 community-scripts ORG
 # Author: michelroegl-brunner
 # License: MIT | https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/LICENSE
 
+# ==============================================================================
+# API.FUNC - TELEMETRY & DIAGNOSTICS API
+# ==============================================================================
+#
+# Provides functions for sending anonymous telemetry data to Community-Scripts
+# API for analytics and diagnostics purposes.
+#
+# Features:
+#   - Container/VM creation statistics
+#   - Installation success/failure tracking
+#   - Error code mapping and reporting
+#   - Privacy-respecting anonymous telemetry
+#
+# Usage:
+#   source <(curl -fsSL .../api.func)
+#   post_to_api          # Report container creation
+#   post_update_to_api   # Report installation status
+#
+# Privacy:
+#   - Only anonymous statistics (no personal data)
+#   - User can opt-out via diagnostics settings
+#   - Random UUID for session tracking only
+#
+# ==============================================================================
+
+# ==============================================================================
+# SECTION 1: ERROR CODE DESCRIPTIONS
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# explain_exit_code()
+#
+# - Maps numeric exit codes to human-readable error descriptions
+# - Supports:
+#   * Generic/Shell errors (1, 2, 126, 127, 128, 130, 137, 139, 143)
+#   * Package manager errors (APT, DPKG: 100, 101, 255)
+#   * Node.js/npm errors (243-249, 254)
+#   * Python/pip/uv errors (210-212)
+#   * PostgreSQL errors (231-234)
+#   * MySQL/MariaDB errors (241-244)
+#   * MongoDB errors (251-254)
+#   * Proxmox custom codes (200-231)
+# - Returns description string for given exit code
+# - Shared function with error_handler.func for consistency
+# ------------------------------------------------------------------------------
+explain_exit_code() {
+  local code="$1"
+  case "$code" in
+  # --- Generic / Shell ---
+  1) echo "General error / Operation not permitted" ;;
+  2) echo "Misuse of shell builtins (e.g. syntax error)" ;;
+  126) echo "Command invoked cannot execute (permission problem?)" ;;
+  127) echo "Command not found" ;;
+  128) echo "Invalid argument to exit" ;;
+  130) echo "Terminated by Ctrl+C (SIGINT)" ;;
+  137) echo "Killed (SIGKILL / Out of memory?)" ;;
+  139) echo "Segmentation fault (core dumped)" ;;
+  143) echo "Terminated (SIGTERM)" ;;
+
+  # --- Package manager / APT / DPKG ---
+  100) echo "APT: Package manager error (broken packages / dependency problems)" ;;
+  101) echo "APT: Configuration error (bad sources.list, malformed config)" ;;
+  255) echo "DPKG: Fatal internal error" ;;
+
+  # --- Node.js / npm / pnpm / yarn ---
+  243) echo "Node.js: Out of memory (JavaScript heap out of memory)" ;;
+  245) echo "Node.js: Invalid command-line option" ;;
+  246) echo "Node.js: Internal JavaScript Parse Error" ;;
+  247) echo "Node.js: Fatal internal error" ;;
+  248) echo "Node.js: Invalid C++ addon / N-API failure" ;;
+  249) echo "Node.js: Inspector error" ;;
+  254) echo "npm/pnpm/yarn: Unknown fatal error" ;;
+
+  # --- Python / pip / uv ---
+  210) echo "Python: Virtualenv / uv environment missing or broken" ;;
+  211) echo "Python: Dependency resolution failed" ;;
+  212) echo "Python: Installation aborted (permissions or EXTERNALLY-MANAGED)" ;;
+
+  # --- PostgreSQL ---
+  231) echo "PostgreSQL: Connection failed (server not running / wrong socket)" ;;
+  232) echo "PostgreSQL: Authentication failed (bad user/password)" ;;
+  233) echo "PostgreSQL: Database does not exist" ;;
+  234) echo "PostgreSQL: Fatal error in query / syntax" ;;
+
+  # --- MySQL / MariaDB ---
+  241) echo "MySQL/MariaDB: Connection failed (server not running / wrong socket)" ;;
+  242) echo "MySQL/MariaDB: Authentication failed (bad user/password)" ;;
+  243) echo "MySQL/MariaDB: Database does not exist" ;;
+  244) echo "MySQL/MariaDB: Fatal error in query / syntax" ;;
+
+  # --- MongoDB ---
+  251) echo "MongoDB: Connection failed (server not running)" ;;
+  252) echo "MongoDB: Authentication failed (bad user/password)" ;;
+  253) echo "MongoDB: Database not found" ;;
+  254) echo "MongoDB: Fatal query error" ;;
+
+  # --- Proxmox Custom Codes ---
+  200) echo "Custom: Failed to create lock file" ;;
+  203) echo "Custom: Missing CTID variable" ;;
+  204) echo "Custom: Missing PCT_OSTYPE variable" ;;
+  205) echo "Custom: Invalid CTID (<100)" ;;
+  206) echo "Custom: CTID already in use (check 'pct list' and /etc/pve/lxc/)" ;;
+  207) echo "Custom: Password contains unescaped special characters (-, /, \\, *, etc.)" ;;
+  208) echo "Custom: Invalid configuration (DNS/MAC/Network format error)" ;;
+  209) echo "Custom: Container creation failed (check logs for pct create output)" ;;
+  210) echo "Custom: Cluster not quorate" ;;
+  211) echo "Custom: Timeout waiting for template lock (concurrent download in progress)" ;;
+  214) echo "Custom: Not enough storage space" ;;
+  215) echo "Custom: Container created but not listed (ghost state - check /etc/pve/lxc/)" ;;
+  216) echo "Custom: RootFS entry missing in config (incomplete creation)" ;;
+  217) echo "Custom: Storage does not support rootdir (check storage capabilities)" ;;
+  218) echo "Custom: Template file corrupted or incomplete download (size <1MB or invalid archive)" ;;
+  220) echo "Custom: Unable to resolve template path" ;;
+  221) echo "Custom: Template file exists but not readable (check file permissions)" ;;
+  222) echo "Custom: Template download failed after 3 attempts (network/storage issue)" ;;
+  223) echo "Custom: Template not available after download (storage sync issue)" ;;
+  225) echo "Custom: No template available for OS/Version (check 'pveam available')" ;;
+  231) echo "Custom: LXC stack upgrade/retry failed (outdated pve-container - check https://github.com/community-scripts/ProxmoxVE/discussions/8126)" ;;
+
+  # --- Default ---
+  *) echo "Unknown error" ;;
+  esac
+}
+
+# ==============================================================================
+# SECTION 2: TELEMETRY FUNCTIONS
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# post_to_api()
+#
+# - Sends LXC container creation statistics to Community-Scripts API
+# - Only executes if:
+#   * curl is available
+#   * DIAGNOSTICS=yes
+#   * RANDOM_UUID is set
+# - Payload includes:
+#   * Container type, disk size, CPU cores, RAM
+#   * OS type and version
+#   * IPv6 disable status
+#   * Application name (NSAPP)
+#   * Installation method
+#   * PVE version
+#   * Status: "installing"
+#   * Random UUID for session tracking
+# - Anonymous telemetry (no personal data)
+# ------------------------------------------------------------------------------
 post_to_api() {
 
   if ! command -v curl &>/dev/null; then
@@ -30,7 +177,6 @@ post_to_api() {
     "ram_size": $RAM_SIZE,
     "os_type": "$var_os",
     "os_version": "$var_version",
-    "disableip6": "",
     "nsapp": "$NSAPP",
     "method": "$METHOD(PVE-Local)",
     "pve_version": "$pve_version",
@@ -39,14 +185,26 @@ post_to_api() {
 }
 EOF
   )
-
   if [[ "$DIAGNOSTICS" == "yes" ]]; then
     RESPONSE=$(curl -s -w "%{http_code}" -L -X POST "$API_URL" --post301 --post302 \
       -H "Content-Type: application/json" \
       -d "$JSON_PAYLOAD") || true
   fi
+
 }
 
+# ------------------------------------------------------------------------------
+# post_to_api_vm()
+#
+# - Sends VM creation statistics to Community-Scripts API
+# - Similar to post_to_api() but for virtual machines (not containers)
+# - Reads DIAGNOSTICS from /usr/local/community-scripts/diagnostics file
+# - Payload differences:
+#   * ct_type=2 (VM instead of LXC)
+#   * type="vm"
+#   * Disk size without 'G' suffix (parsed from DISK_SIZE variable)
+# - Only executes if DIAGNOSTICS=yes and RANDOM_UUID is set
+# ------------------------------------------------------------------------------
 post_to_api_vm() {
 
   if [[ ! -f /usr/local/community-scripts/diagnostics ]]; then
@@ -81,7 +239,6 @@ post_to_api_vm() {
     "ram_size": $RAM_SIZE,
     "os_type": "$var_os",
     "os_version": "$var_version",
-    "disableip6": "",
     "nsapp": "$NSAPP",
     "method": "$METHOD(PVE-Local)",
     "pve_version": "$pve_version",
@@ -90,7 +247,6 @@ post_to_api_vm() {
 }
 EOF
   )
-
   if [[ "$DIAGNOSTICS" == "yes" ]]; then
     RESPONSE=$(curl -s -w "%{http_code}" -L -X POST "$API_URL" --post301 --post302 \
       -H "Content-Type: application/json" \
@@ -98,19 +254,54 @@ EOF
   fi
 }
 
-POST_UPDATE_DONE=false
+# ------------------------------------------------------------------------------
+# post_update_to_api()
+#
+# - Reports installation completion status to API
+# - Prevents duplicate submissions via POST_UPDATE_DONE flag
+# - Arguments:
+#   * $1: status ("success" or "failed")
+#   * $2: exit_code (default: 1 for failed, 0 for success)
+# - Payload includes:
+#   * Final status (success/failed)
+#   * Error description via get_error_description()
+#   * Random UUID for session correlation
+# - Only executes once per session
+# - Silently returns if:
+#   * curl not available
+#   * Already reported (POST_UPDATE_DONE=true)
+#   * DIAGNOSTICS=no
+# ------------------------------------------------------------------------------
 post_update_to_api() {
 
   if ! command -v curl &>/dev/null; then
     return
   fi
 
+  # Initialize flag if not set (prevents 'unbound variable' error with set -u)
+  POST_UPDATE_DONE=${POST_UPDATE_DONE:-false}
+
   if [ "$POST_UPDATE_DONE" = true ]; then
     return 0
   fi
+  exit_code=${2:-1}
   local API_URL="http://api.community-scripts.org/upload/updatestatus"
   local status="${1:-failed}"
-  local error="${2:-No error message}"
+  if [[ "$status" == "failed" ]]; then
+    local exit_code="${2:-1}"
+  elif [[ "$status" == "success" ]]; then
+    local exit_code="${2:-0}"
+  fi
+
+  if [[ -z "$exit_code" ]]; then
+    exit_code=1
+  fi
+
+  error=$(explain_exit_code "$exit_code")
+
+  if [ -z "$error" ]; then
+    error="Unknown error"
+  fi
 
   JSON_PAYLOAD=$(
     cat <<EOF
@@ -121,7 +312,6 @@ post_update_to_api() {
 }
 EOF
   )
-
   if [[ "$DIAGNOSTICS" == "yes" ]]; then
     RESPONSE=$(curl -s -w "%{http_code}" -L -X POST "$API_URL" --post301 --post302 \
       -H "Content-Type: application/json" \

scripts/core/cloud-init.func

@@ -0,0 +1,505 @@
+#!/usr/bin/env bash
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: community-scripts ORG
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/branch/main/LICENSE
+# Revision: 1
+
+# ==============================================================================
+# CLOUD-INIT.FUNC - VM CLOUD-INIT CONFIGURATION LIBRARY
+# ==============================================================================
+#
+# Universal helper library for Cloud-Init configuration in Proxmox VMs.
+# Provides functions for:
+#
+#   - Native Proxmox Cloud-Init setup (user, password, network, SSH keys)
+#   - Interactive configuration dialogs (whiptail)
+#   - IP address retrieval via qemu-guest-agent
+#   - Cloud-Init status monitoring and waiting
+#
+# Usage:
+#   source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/cloud-init.func)
+#   setup_cloud_init "$VMID" "$STORAGE" "$HN" "yes"
+#
+# Compatible with: Debian, Ubuntu, and all Cloud-Init enabled distributions
+# ==============================================================================
+
+# ==============================================================================
+# SECTION 1: CONFIGURATION DEFAULTS
+# ==============================================================================
+# These can be overridden before sourcing this library
+
+CLOUDINIT_DEFAULT_USER="${CLOUDINIT_DEFAULT_USER:-root}"
+CLOUDINIT_DNS_SERVERS="${CLOUDINIT_DNS_SERVERS:-1.1.1.1 8.8.8.8}"
+CLOUDINIT_SEARCH_DOMAIN="${CLOUDINIT_SEARCH_DOMAIN:-local}"
+CLOUDINIT_SSH_KEYS="${CLOUDINIT_SSH_KEYS:-/root/.ssh/authorized_keys}"
+
+# ==============================================================================
+# SECTION 2: HELPER FUNCTIONS
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# _ci_msg - Internal message helper with fallback
+# ------------------------------------------------------------------------------
+function _ci_msg_info() { msg_info "$1" 2>/dev/null || echo "[INFO] $1"; }
+function _ci_msg_ok() { msg_ok "$1" 2>/dev/null || echo "[OK] $1"; }
+function _ci_msg_warn() { msg_warn "$1" 2>/dev/null || echo "[WARN] $1"; }
+function _ci_msg_error() { msg_error "$1" 2>/dev/null || echo "[ERROR] $1"; }
+
+# ------------------------------------------------------------------------------
+# validate_ip_cidr - Validate IP address in CIDR format
+# Usage: validate_ip_cidr "192.168.1.100/24" && echo "Valid"
+# Returns: 0 if valid, 1 if invalid
+# ------------------------------------------------------------------------------
+function validate_ip_cidr() {
+  local ip_cidr="$1"
+  # Match: 0-255.0-255.0-255.0-255/0-32
+  if [[ "$ip_cidr" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$ ]]; then
+    # Validate each octet is 0-255
+    local ip="${ip_cidr%/*}"
+    IFS='.' read -ra octets <<<"$ip"
+    for octet in "${octets[@]}"; do
+      ((octet > 255)) && return 1
+    done
+    return 0
+  fi
+  return 1
+}
+
+# ------------------------------------------------------------------------------
+# validate_ip - Validate plain IP address (no CIDR)
+# Usage: validate_ip "192.168.1.1" && echo "Valid"
+# ------------------------------------------------------------------------------
+function validate_ip() {
+  local ip="$1"
+  if [[ "$ip" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
+    IFS='.' read -ra octets <<<"$ip"
+    for octet in "${octets[@]}"; do
+      ((octet > 255)) && return 1
+    done
+    return 0
+  fi
+  return 1
+}
+
+# ==============================================================================
+# SECTION 3: MAIN CLOUD-INIT FUNCTIONS
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# setup_cloud_init - Configures Proxmox Native Cloud-Init
+# ------------------------------------------------------------------------------
+# Parameters:
+#   $1 - VMID (required)
+#   $2 - Storage name (required)
+#   $3 - Hostname (optional, default: vm-<vmid>)
+#   $4 - Enable Cloud-Init (yes/no, default: no)
+#   $5 - User (optional, default: root)
+#   $6 - Network mode (dhcp/static, default: dhcp)
+#   $7 - Static IP (optional, format: 192.168.1.100/24)
+#   $8 - Gateway (optional)
+#   $9 - Nameservers (optional, default: 1.1.1.1 8.8.8.8)
+#
+# Returns: 0 on success, 1 on failure
+# Exports: CLOUDINIT_USER, CLOUDINIT_PASSWORD, CLOUDINIT_CRED_FILE
+# ==============================================================================
+function setup_cloud_init() {
+  local vmid="$1"
+  local storage="$2"
+  local hostname="${3:-vm-${vmid}}"
+  local enable="${4:-no}"
+  local ciuser="${5:-$CLOUDINIT_DEFAULT_USER}"
+  local network_mode="${6:-dhcp}"
+  local static_ip="${7:-}"
+  local gateway="${8:-}"
+  local nameservers="${9:-$CLOUDINIT_DNS_SERVERS}"
+
+  # Skip if not enabled
+  if [ "$enable" != "yes" ]; then
+    return 0
+  fi
+
+  # Validate static IP if provided
+  if [ "$network_mode" = "static" ]; then
+    if [ -n "$static_ip" ] && ! validate_ip_cidr "$static_ip"; then
+      _ci_msg_error "Invalid static IP format: $static_ip (expected: x.x.x.x/xx)"
+      return 1
+    fi
+    if [ -n "$gateway" ] && ! validate_ip "$gateway"; then
+      _ci_msg_error "Invalid gateway IP format: $gateway"
+      return 1
+    fi
+  fi
+
+  _ci_msg_info "Configuring Cloud-Init"
+
+  # Create Cloud-Init drive (try ide2 first, then scsi1 as fallback)
+  if ! qm set "$vmid" --ide2 "${storage}:cloudinit" >/dev/null 2>&1; then
+    qm set "$vmid" --scsi1 "${storage}:cloudinit" >/dev/null 2>&1
+  fi
+
+  # Set user
+  qm set "$vmid" --ciuser "$ciuser" >/dev/null
+
+  # Generate and set secure random password
+  local cipassword=$(openssl rand -base64 16)
+  qm set "$vmid" --cipassword "$cipassword" >/dev/null
+
+  # Add SSH keys if available
+  if [ -f "$CLOUDINIT_SSH_KEYS" ]; then
+    qm set "$vmid" --sshkeys "$CLOUDINIT_SSH_KEYS" >/dev/null 2>&1 || true
+  fi
+
+  # Configure network
+  if [ "$network_mode" = "static" ] && [ -n "$static_ip" ] && [ -n "$gateway" ]; then
+    qm set "$vmid" --ipconfig0 "ip=${static_ip},gw=${gateway}" >/dev/null
+  else
+    qm set "$vmid" --ipconfig0 "ip=dhcp" >/dev/null
+  fi
+
+  # Set DNS servers
+  qm set "$vmid" --nameserver "$nameservers" >/dev/null
+
+  # Set search domain
+  qm set "$vmid" --searchdomain "$CLOUDINIT_SEARCH_DOMAIN" >/dev/null
+
+  # Enable package upgrades on first boot (if supported by Proxmox version)
+  qm set "$vmid" --ciupgrade 1 >/dev/null 2>&1 || true
+
+  # Save credentials to file (with restrictive permissions)
+  local cred_file="/tmp/${hostname}-${vmid}-cloud-init-credentials.txt"
+  umask 077
+  cat >"$cred_file" <<EOF
+╔══════════════════════════════════════════════════════════════════╗
+║  ⚠️  SECURITY WARNING: DELETE THIS FILE AFTER NOTING CREDENTIALS  ║
+╚══════════════════════════════════════════════════════════════════╝
+
+Cloud-Init Credentials
+────────────────────────────────────────
+VM ID:    ${vmid}
+Hostname: ${hostname}
+Created:  $(date)
+
+Username: ${ciuser}
+Password: ${cipassword}
+
+Network:  ${network_mode}$([ "$network_mode" = "static" ] && echo " (IP: ${static_ip}, GW: ${gateway})" || echo " (DHCP)")
+DNS:      ${nameservers}
+
+────────────────────────────────────────
+SSH Access (if keys configured):
+  ssh ${ciuser}@<vm-ip>
+
+Proxmox UI Configuration:
+  VM ${vmid} > Cloud-Init > Edit
+  - User, Password, SSH Keys
+  - Network (IP Config)
+  - DNS, Search Domain
+
+────────────────────────────────────────
+🗑️  To delete this file:
+  rm -f ${cred_file}
+────────────────────────────────────────
+EOF
+  chmod 600 "$cred_file"
+
+  _ci_msg_ok "Cloud-Init configured (User: ${ciuser})"
+
+  # Export for use in calling script (DO NOT display password here - will be shown in summary)
+  export CLOUDINIT_USER="$ciuser"
+  export CLOUDINIT_PASSWORD="$cipassword"
+  export CLOUDINIT_CRED_FILE="$cred_file"
+
+  return 0
+}
+
+# ==============================================================================
+# SECTION 4: INTERACTIVE CONFIGURATION
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# configure_cloud_init_interactive - Whiptail dialog for Cloud-Init setup
+# ------------------------------------------------------------------------------
+# Prompts user for Cloud-Init configuration choices
+# Returns configuration via exported variables:
+#   - CLOUDINIT_ENABLE (yes/no)
+#   - CLOUDINIT_USER
+#   - CLOUDINIT_NETWORK_MODE (dhcp/static)
+#   - CLOUDINIT_IP (if static)
+#   - CLOUDINIT_GW (if static)
+#   - CLOUDINIT_DNS
+# ------------------------------------------------------------------------------
+function configure_cloud_init_interactive() {
+  local default_user="${1:-root}"
+
+  # Check if whiptail is available
+  if ! command -v whiptail >/dev/null 2>&1; then
+    echo "Warning: whiptail not available, skipping interactive configuration"
+    export CLOUDINIT_ENABLE="no"
+    return 1
+  fi
+
+  # Ask if user wants to enable Cloud-Init
+  if ! (whiptail --backtitle "Proxmox VE Helper Scripts" --title "CLOUD-INIT" \
+    --yesno "Enable Cloud-Init for VM configuration?\n\nCloud-Init allows automatic configuration of:\n• User accounts and passwords\n• SSH keys\n• Network settings (DHCP/Static)\n• DNS configuration\n\nYou can also configure these settings later in Proxmox UI." 16 68); then
+    export CLOUDINIT_ENABLE="no"
+    return 0
+  fi
+
+  export CLOUDINIT_ENABLE="yes"
+
+  # Username
+  if CLOUDINIT_USER=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox \
+    "Cloud-Init Username" 8 58 "$default_user" --title "USERNAME" 3>&1 1>&2 2>&3); then
+    export CLOUDINIT_USER="${CLOUDINIT_USER:-$default_user}"
+  else
+    export CLOUDINIT_USER="$default_user"
+  fi
+
+  # Network configuration
+  if (whiptail --backtitle "Proxmox VE Helper Scripts" --title "NETWORK MODE" \
+    --yesno "Use DHCP for network configuration?\n\nSelect 'No' for static IP configuration." 10 58); then
+    export CLOUDINIT_NETWORK_MODE="dhcp"
+  else
+    export CLOUDINIT_NETWORK_MODE="static"
+
+    # Static IP with validation
+    while true; do
+      if CLOUDINIT_IP=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox \
+        "Static IP Address (CIDR format)\nExample: 192.168.1.100/24" 9 58 "" --title "IP ADDRESS" 3>&1 1>&2 2>&3); then
+        if validate_ip_cidr "$CLOUDINIT_IP"; then
+          export CLOUDINIT_IP
+          break
+        else
+          whiptail --backtitle "Proxmox VE Helper Scripts" --title "INVALID IP" \
+            --msgbox "Invalid IP format: $CLOUDINIT_IP\n\nPlease use CIDR format: x.x.x.x/xx\nExample: 192.168.1.100/24" 10 50
+        fi
+      else
+        _ci_msg_warn "Static IP required, falling back to DHCP"
+        export CLOUDINIT_NETWORK_MODE="dhcp"
+        break
+      fi
+    done
+
+    # Gateway with validation
+    if [ "$CLOUDINIT_NETWORK_MODE" = "static" ]; then
+      while true; do
+        if CLOUDINIT_GW=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox \
+          "Gateway IP Address\nExample: 192.168.1.1" 8 58 "" --title "GATEWAY" 3>&1 1>&2 2>&3); then
+          if validate_ip "$CLOUDINIT_GW"; then
+            export CLOUDINIT_GW
+            break
+          else
+            whiptail --backtitle "Proxmox VE Helper Scripts" --title "INVALID GATEWAY" \
+              --msgbox "Invalid gateway format: $CLOUDINIT_GW\n\nPlease use format: x.x.x.x\nExample: 192.168.1.1" 10 50
+          fi
+        else
+          _ci_msg_warn "Gateway required, falling back to DHCP"
+          export CLOUDINIT_NETWORK_MODE="dhcp"
+          break
+        fi
+      done
+    fi
+  fi
+
+  # DNS Servers
+  if CLOUDINIT_DNS=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox \
+    "DNS Servers (space-separated)" 8 58 "1.1.1.1 8.8.8.8" --title "DNS SERVERS" 3>&1 1>&2 2>&3); then
+    export CLOUDINIT_DNS="${CLOUDINIT_DNS:-1.1.1.1 8.8.8.8}"
+  else
+    export CLOUDINIT_DNS="1.1.1.1 8.8.8.8"
+  fi
+
+  return 0
+}
+
+# ==============================================================================
+# SECTION 5: UTILITY FUNCTIONS
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# display_cloud_init_info - Show Cloud-Init summary after setup
+# ------------------------------------------------------------------------------
+function display_cloud_init_info() {
+  local vmid="$1"
+  local hostname="${2:-}"
+
+  if [ -n "$CLOUDINIT_CRED_FILE" ] && [ -f "$CLOUDINIT_CRED_FILE" ]; then
+    if [ -n "${INFO:-}" ]; then
+      echo -e "\n${INFO}${BOLD:-}${GN:-} Cloud-Init Configuration:${CL:-}"
+      echo -e "${TAB:-  }${DGN:-}User: ${BGN:-}${CLOUDINIT_USER:-root}${CL:-}"
+      echo -e "${TAB:-  }${DGN:-}Password: ${BGN:-}${CLOUDINIT_PASSWORD}${CL:-}"
+      echo -e "${TAB:-  }${DGN:-}Credentials: ${BL:-}${CLOUDINIT_CRED_FILE}${CL:-}"
+      echo -e "${TAB:-  }${RD:-}⚠️  Delete credentials file after noting password!${CL:-}"
+      echo -e "${TAB:-  }${YW:-}💡 Configure in Proxmox UI: VM ${vmid} > Cloud-Init${CL:-}"
+    else
+      echo ""
+      echo "[INFO] Cloud-Init Configuration:"
+      echo "  User: ${CLOUDINIT_USER:-root}"
+      echo "  Password: ${CLOUDINIT_PASSWORD}"
+      echo "  Credentials: ${CLOUDINIT_CRED_FILE}"
+      echo "  ⚠️  Delete credentials file after noting password!"
+      echo "  Configure in Proxmox UI: VM ${vmid} > Cloud-Init"
+    fi
+  fi
+}
+
+# ------------------------------------------------------------------------------
+# cleanup_cloud_init_credentials - Remove credentials file
+# ------------------------------------------------------------------------------
+# Usage: cleanup_cloud_init_credentials
+# Call this after user has noted/saved the credentials
+# ------------------------------------------------------------------------------
+function cleanup_cloud_init_credentials() {
+  if [ -n "$CLOUDINIT_CRED_FILE" ] && [ -f "$CLOUDINIT_CRED_FILE" ]; then
+    rm -f "$CLOUDINIT_CRED_FILE"
+    _ci_msg_ok "Credentials file removed: $CLOUDINIT_CRED_FILE"
+    unset CLOUDINIT_CRED_FILE
+    return 0
+  fi
+  return 1
+}
+
+# ------------------------------------------------------------------------------
+# has_cloud_init - Check if VM has Cloud-Init configured
+# ------------------------------------------------------------------------------
+function has_cloud_init() {
+  local vmid="$1"
+  qm config "$vmid" 2>/dev/null | grep -qE "(ide2|scsi1):.*cloudinit"
+}
+
+# ------------------------------------------------------------------------------
+# regenerate_cloud_init - Regenerate Cloud-Init configuration
+# ------------------------------------------------------------------------------
+function regenerate_cloud_init() {
+  local vmid="$1"
+
+  if has_cloud_init "$vmid"; then
+    _ci_msg_info "Regenerating Cloud-Init configuration"
+    qm cloudinit update "$vmid" >/dev/null 2>&1 || true
+    _ci_msg_ok "Cloud-Init configuration regenerated"
+    return 0
+  else
+    _ci_msg_warn "VM $vmid does not have Cloud-Init configured"
+    return 1
+  fi
+}
+
+# ------------------------------------------------------------------------------
+# get_vm_ip - Get VM IP address via qemu-guest-agent
+# ------------------------------------------------------------------------------
+function get_vm_ip() {
+  local vmid="$1"
+  local timeout="${2:-30}"
+
+  local elapsed=0
+  while [ $elapsed -lt $timeout ]; do
+    local vm_ip=$(qm guest cmd "$vmid" network-get-interfaces 2>/dev/null |
+      jq -r '.[] | select(.name != "lo") | ."ip-addresses"[]? | select(."ip-address-type" == "ipv4") | ."ip-address"' 2>/dev/null | head -1)
+
+    if [ -n "$vm_ip" ]; then
+      echo "$vm_ip"
+      return 0
+    fi
+
+    sleep 2
+    elapsed=$((elapsed + 2))
+  done
+
+  return 1
+}
+
+# ------------------------------------------------------------------------------
+# wait_for_cloud_init - Wait for Cloud-Init to complete (requires SSH access)
+# ------------------------------------------------------------------------------
+function wait_for_cloud_init() {
+  local vmid="$1"
+  local timeout="${2:-300}"
+  local vm_ip="${3:-}"
+
+  # Get IP if not provided
+  if [ -z "$vm_ip" ]; then
+    vm_ip=$(get_vm_ip "$vmid" 60)
+  fi
+
+  if [ -z "$vm_ip" ]; then
+    _ci_msg_warn "Unable to determine VM IP address"
+    return 1
+  fi
+
+  _ci_msg_info "Waiting for Cloud-Init to complete on ${vm_ip}"
+
+  local elapsed=0
+  while [ $elapsed -lt $timeout ]; do
+    if timeout 10 ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+      "${CLOUDINIT_USER:-root}@${vm_ip}" "cloud-init status --wait" 2>/dev/null; then
+      _ci_msg_ok "Cloud-Init completed successfully"
+      return 0
+    fi
+    sleep 10
+    elapsed=$((elapsed + 10))
+  done
+
+  _ci_msg_warn "Cloud-Init did not complete within ${timeout}s"
+  return 1
+}
+
+# ==============================================================================
+# SECTION 6: EXPORTS
+# ==============================================================================
+# Export all functions for use in other scripts
+
+export -f setup_cloud_init 2>/dev/null || true
+export -f configure_cloud_init_interactive 2>/dev/null || true
+export -f display_cloud_init_info 2>/dev/null || true
+export -f cleanup_cloud_init_credentials 2>/dev/null || true
+export -f has_cloud_init 2>/dev/null || true
+export -f regenerate_cloud_init 2>/dev/null || true
+export -f get_vm_ip 2>/dev/null || true
+export -f wait_for_cloud_init 2>/dev/null || true
+export -f validate_ip_cidr 2>/dev/null || true
+export -f validate_ip 2>/dev/null || true
+
+# ==============================================================================
+# SECTION 7: EXAMPLES & DOCUMENTATION
+# ==============================================================================
+: <<'EXAMPLES'
+
+# Example 1: Simple DHCP setup (most common)
+setup_cloud_init "$VMID" "$STORAGE" "$HN" "yes"
+
+# Example 2: Static IP setup
+setup_cloud_init "$VMID" "$STORAGE" "myserver" "yes" "root" "static" "192.168.1.100/24" "192.168.1.1"
+
+# Example 3: Interactive configuration in advanced_settings()
+configure_cloud_init_interactive "admin"
+if [ "$CLOUDINIT_ENABLE" = "yes" ]; then
+  setup_cloud_init "$VMID" "$STORAGE" "$HN" "yes" "$CLOUDINIT_USER" \
+    "$CLOUDINIT_NETWORK_MODE" "$CLOUDINIT_IP" "$CLOUDINIT_GW" "$CLOUDINIT_DNS"
+fi
+
+# Example 4: Display info after VM creation
+display_cloud_init_info "$VMID" "$HN"
+
+# Example 5: Check if VM has Cloud-Init
+if has_cloud_init "$VMID"; then
+    echo "Cloud-Init is configured"
+fi
+
+# Example 6: Wait for Cloud-Init to complete after VM start
+if [ "$START_VM" = "yes" ]; then
+    qm start "$VMID"
+    sleep 30
+    wait_for_cloud_init "$VMID" 300
+fi
+
+# Example 7: Cleanup credentials file after user has noted password
+display_cloud_init_info "$VMID" "$HN"
+read -p "Have you saved the credentials? (y/N): " -r
+[[ $REPLY =~ ^[Yy]$ ]] && cleanup_cloud_init_credentials
+
+# Example 8: Validate IP before using
+if validate_ip_cidr "192.168.1.100/24"; then
+  echo "Valid IP/CIDR"
+fi
+
+EXAMPLES

scripts/core/config-file.func

@@ -1,699 +0,0 @@
-config_file() {
-  CONFIG_FILE="/opt/community-scripts/.settings"
-
-  if [[ -f "/opt/community-scripts/${NSAPP}.conf" ]]; then
-    CONFIG_FILE="/opt/community-scripts/${NSAPP}.conf"
-  fi
-
-  if CONFIG_FILE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set absolute path to config file" 8 58 "$CONFIG_FILE" --title "CONFIG FILE" 3>&1 1>&2 2>&3); then
-    if [[ ! -f "$CONFIG_FILE" ]]; then
-      echo -e "${CROSS}${RD}Config file not found, exiting script!.${CL}"
-      exit
-    else
-      echo -e "${INFO}${BOLD}${DGN}Using config File: ${BGN}$CONFIG_FILE${CL}"
-      source "$CONFIG_FILE"
-    fi
-  fi
-  if [[ -n "${CT_ID-}" ]]; then
-    if [[ "$CT_ID" =~ ^([0-9]{3,4})-([0-9]{3,4})$ ]]; then
-      MIN_ID=${BASH_REMATCH[1]}
-      MAX_ID=${BASH_REMATCH[2]}
-      if ((MIN_ID >= MAX_ID)); then
-        msg_error "Invalid Container ID range. The first number must be smaller than the second number, was ${CT_ID}"
-        exit
-      fi
-
-      LIST_OF_IDS=$(pvesh get /cluster/resources --type vm --output-format json 2>/dev/null | grep -oP '"vmid":\s*\K\d+') || true
-      if [[ -n "$LIST_OF_IDS" ]]; then
-        for ((ID = MIN_ID; ID <= MAX_ID; ID++)); do
-          if ! grep -q "^$ID$" <<<"$LIST_OF_IDS"; then
-            CT_ID=$ID
-            break
-          fi
-        done
-      fi
-      echo -e "${CONTAINERID}${BOLD}${DGN}Container ID: ${BGN}$CT_ID${CL}"
-
-    elif [[ "$CT_ID" =~ ^[0-9]+$ ]]; then
-      LIST_OF_IDS=$(pvesh get /cluster/resources --type vm --output-format json 2>/dev/null | grep -oP '"vmid":\s*\K\d+') || true
-      if [[ -n "$LIST_OF_IDS" ]]; then
-
-        if ! grep -q "^$CT_ID$" <<<"$LIST_OF_IDS"; then
-          echo -e "${CONTAINERID}${BOLD}${DGN}Container ID: ${BGN}$CT_ID${CL}"
-        else
-          msg_error "Container ID $CT_ID already exists"
-          exit
-        fi
-      else
-        echo -e "${CONTAINERID}${BOLD}${DGN}Container ID: ${BGN}$CT_ID${CL}"
-      fi
-    else
-      msg_error "Invalid Container ID format. Needs to be 0000-9999 or 0-9999, was ${CT_ID}"
-      exit
-    fi
-  else
-    if CT_ID=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Container ID" 8 58 "$NEXTID" --title "CONTAINER ID" 3>&1 1>&2 2>&3); then
-      if [ -z "$CT_ID" ]; then
-        CT_ID="$NEXTID"
-        echo -e "${CONTAINERID}${BOLD}${DGN}Container ID: ${BGN}$CT_ID${CL}"
-      else
-        echo -e "${CONTAINERID}${BOLD}${DGN}Container ID: ${BGN}$CT_ID${CL}"
-      fi
-    else
-      exit_script
-    fi
-
-  fi
-  if [[ -n "${CT_TYPE-}" ]]; then
-    if [[ "$CT_TYPE" -eq 0 ]]; then
-      CT_TYPE_DESC="Privileged"
-    elif [[ "$CT_TYPE" -eq 1 ]]; then
-      CT_TYPE_DESC="Unprivileged"
-    else
-      msg_error "Unknown setting for CT_TYPE, should be 1 or 0, was ${CT_TYPE}"
-      exit
-    fi
-    echo -e "${CONTAINERTYPE}${BOLD}${DGN}Container Type: ${BGN}$CT_TYPE_DESC${CL}"
-  else
-    if CT_TYPE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "CONTAINER TYPE" --radiolist "Choose Type" 10 58 2 \
-      "1" "Unprivileged" ON \
-      "0" "Privileged" OFF \
-      3>&1 1>&2 2>&3); then
-      if [ -n "$CT_TYPE" ]; then
-        CT_TYPE_DESC="Unprivileged"
-        if [ "$CT_TYPE" -eq 0 ]; then
-          CT_TYPE_DESC="Privileged"
-        fi
-        echo -e "${CONTAINERTYPE}${BOLD}${DGN}Container Type: ${BGN}$CT_TYPE_DESC${CL}"
-      fi
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${PW-}" ]]; then
-    if [[ "$PW" == "none" ]]; then
-      PW=""
-    else
-      if [[ "$PW" == *" "* ]]; then
-        msg_error "Password cannot be empty"
-        exit
-      elif [[ ${#PW} -lt 5 ]]; then
-        msg_error "Password must be at least 5 characters long"
-        exit
-      else
-        echo -e "${VERIFYPW}${BOLD}${DGN}Root Password: ${BGN}********${CL}"
-      fi
-      PW="-password $PW"
-    fi
-  else
-    while true; do
-      if PW1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --passwordbox "\nSet Root Password (needed for root ssh access)" 9 58 --title "PASSWORD (leave blank for automatic login)" 3>&1 1>&2 2>&3); then
-        if [[ -n "$PW1" ]]; then
-          if [[ "$PW1" == *" "* ]]; then
-            whiptail --msgbox "Password cannot contain spaces. Please try again." 8 58
-          elif [ ${#PW1} -lt 5 ]; then
-            whiptail --msgbox "Password must be at least 5 characters long. Please try again." 8 58
-          else
-            if PW2=$(whiptail --backtitle "Proxmox VE Helper Scripts" --passwordbox "\nVerify Root Password" 9 58 --title "PASSWORD VERIFICATION" 3>&1 1>&2 2>&3); then
-              if [[ "$PW1" == "$PW2" ]]; then
-                PW="-password $PW1"
-                echo -e "${VERIFYPW}${BOLD}${DGN}Root Password: ${BGN}********${CL}"
-                break
-              else
-                whiptail --msgbox "Passwords do not match. Please try again." 8 58
-              fi
-            else
-              exit_script
-            fi
-          fi
-        else
-          PW1="Automatic Login"
-          PW=""
-          echo -e "${VERIFYPW}${BOLD}${DGN}Root Password: ${BGN}$PW1${CL}"
-          break
-        fi
-      else
-        exit_script
-      fi
-    done
-  fi
-
-  if [[ -n "${HN-}" ]]; then
-    echo -e "${HOSTNAME}${BOLD}${DGN}Hostname: ${BGN}$HN${CL}"
-  else
-    if CT_NAME=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Hostname" 8 58 "$NSAPP" --title "HOSTNAME" 3>&1 1>&2 2>&3); then
-      if [ -z "$CT_NAME" ]; then
-        HN="$NSAPP"
-      else
-        HN=$(echo "${CT_NAME,,}" | tr -d ' ')
-      fi
-      echo -e "${HOSTNAME}${BOLD}${DGN}Hostname: ${BGN}$HN${CL}"
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${DISK_SIZE-}" ]]; then
-    if [[ "$DISK_SIZE" =~ ^-?[0-9]+$ ]]; then
-      echo -e "${DISKSIZE}${BOLD}${DGN}Disk Size: ${BGN}${DISK_SIZE} GB${CL}"
-    else
-      msg_error "DISK_SIZE must be an integer, was ${DISK_SIZE}"
-      exit
-    fi
-  else
-    if DISK_SIZE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Disk Size in GB" 8 58 "$var_disk" --title "DISK SIZE" 3>&1 1>&2 2>&3); then
-      if [ -z "$DISK_SIZE" ]; then
-        DISK_SIZE="$var_disk"
-        echo -e "${DISKSIZE}${BOLD}${DGN}Disk Size: ${BGN}${DISK_SIZE} GB${CL}"
-      else
-        if ! [[ $DISK_SIZE =~ $INTEGER ]]; then
-          echo -e "{INFO}${HOLD}${RD} DISK SIZE MUST BE AN INTEGER NUMBER!${CL}"
-          advanced_settings
-        fi
-        echo -e "${DISKSIZE}${BOLD}${DGN}Disk Size: ${BGN}${DISK_SIZE} GB${CL}"
-      fi
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${CORE_COUNT-}" ]]; then
-    if [[ "$CORE_COUNT" =~ ^-?[0-9]+$ ]]; then
-      echo -e "${CPUCORE}${BOLD}${DGN}CPU Cores: ${BGN}${CORE_COUNT}${CL}"
-    else
-      msg_error "CORE_COUNT must be an integer, was ${CORE_COUNT}"
-      exit
-    fi
-  else
-    if CORE_COUNT=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Allocate CPU Cores" 8 58 "$var_cpu" --title "CORE COUNT" 3>&1 1>&2 2>&3); then
-      if [ -z "$CORE_COUNT" ]; then
-        CORE_COUNT="$var_cpu"
-        echo -e "${CPUCORE}${BOLD}${DGN}CPU Cores: ${BGN}$CORE_COUNT${CL}"
-      else
-        echo -e "${CPUCORE}${BOLD}${DGN}CPU Cores: ${BGN}$CORE_COUNT${CL}"
-      fi
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${RAM_SIZE-}" ]]; then
-    if [[ "$RAM_SIZE" =~ ^-?[0-9]+$ ]]; then
-      echo -e "${RAMSIZE}${BOLD}${DGN}RAM Size: ${BGN}${RAM_SIZE} MiB${CL}"
-    else
-      msg_error "RAM_SIZE must be an integer, was ${RAM_SIZE}"
-      exit
-    fi
-  else
-    if RAM_SIZE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Allocate RAM in MiB" 8 58 "$var_ram" --title "RAM" 3>&1 1>&2 2>&3); then
-      if [ -z "$RAM_SIZE" ]; then
-        RAM_SIZE="$var_ram"
-        echo -e "${RAMSIZE}${BOLD}${DGN}RAM Size: ${BGN}${RAM_SIZE} MiB${CL}"
-      else
-        echo -e "${RAMSIZE}${BOLD}${DGN}RAM Size: ${BGN}${RAM_SIZE} MiB${CL}"
-      fi
-    else
-      exit_script
-    fi
-  fi
-
-  IFACE_FILEPATH_LIST="/etc/network/interfaces"$'\n'$(find "/etc/network/interfaces.d/" -type f)
-  BRIDGES=""
-  OLD_IFS=$IFS
-  IFS=$'\n'
-
-  for iface_filepath in ${IFACE_FILEPATH_LIST}; do
-
-    iface_indexes_tmpfile=$(mktemp -q -u '.iface-XXXX')
-    (grep -Pn '^\s*iface' "${iface_filepath}" | cut -d':' -f1 && wc -l "${iface_filepath}" | cut -d' ' -f1) | awk 'FNR==1 {line=$0; next} {print line":"$0-1; line=$0}' >"${iface_indexes_tmpfile}" || true
-
-    if [ -f "${iface_indexes_tmpfile}" ]; then
-
-      while read -r pair; do
-        start=$(echo "${pair}" | cut -d':' -f1)
-        end=$(echo "${pair}" | cut -d':' -f2)
-        if awk "NR >= ${start} && NR <= ${end}" "${iface_filepath}" | grep -qP '^\s*(bridge[-_](ports|stp|fd|vlan-aware|vids)|ovs_type\s+OVSBridge)\b'; then
-          iface_name=$(sed "${start}q;d" "${iface_filepath}" | awk '{print $2}')
-          BRIDGES="${iface_name}"$'\n'"${BRIDGES}"
-        fi
-
-      done <"${iface_indexes_tmpfile}"
-      rm -f "${iface_indexes_tmpfile}"
-    fi
-
-  done
-  IFS=$OLD_IFS
-  BRIDGES=$(echo "$BRIDGES" | grep -v '^\s*$' | sort | uniq)
-
-  if [[ -n "${BRG-}" ]]; then
-    if echo "$BRIDGES" | grep -q "${BRG}"; then
-      echo -e "${BRIDGE}${BOLD}${DGN}Bridge: ${BGN}$BRG${CL}"
-    else
-      msg_error "Bridge '${BRG}' does not exist in /etc/network/interfaces or /etc/network/interfaces.d/sdn"
-      exit
-    fi
-  else
-    BRG=$(whiptail --backtitle "Proxmox VE Helper Scripts" --menu "Select network bridge:" 15 40 6 $(echo "$BRIDGES" | awk '{print $0, "Bridge"}') 3>&1 1>&2 2>&3)
-    if [ -z "$BRG" ]; then
-      exit_script
-    else
-      echo -e "${BRIDGE}${BOLD}${DGN}Bridge: ${BGN}$BRG${CL}"
-    fi
-  fi
-
-  local ip_cidr_regex='^([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})/([0-9]{1,2})$'
-  local ip_regex='^([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$'
-
-  if [[ -n ${NET-} ]]; then
-    if [ "$NET" == "dhcp" ]; then
-      echo -e "${NETWORK}${BOLD}${DGN}IP Address: ${BGN}DHCP${CL}"
-      echo -e "${GATEWAY}${BOLD}${DGN}Gateway IP Address: ${BGN}Default${CL}"
-      GATE=""
-    elif [[ "$NET" =~ $ip_cidr_regex ]]; then
-      echo -e "${NETWORK}${BOLD}${DGN}IP Address: ${BGN}$NET${CL}"
-      if [[ -n "$GATE" ]]; then
-        [[ "$GATE" =~ ",gw=" ]] && GATE="${GATE##,gw=}"
-        if [[ "$GATE" =~ $ip_regex ]]; then
-          echo -e "${GATEWAY}${BOLD}${DGN}Gateway IP Address: ${BGN}$GATE${CL}"
-          GATE=",gw=$GATE"
-        else
-          msg_error "Invalid IP Address format for Gateway. Needs to be 0.0.0.0, was ${GATE}"
-          exit
-        fi
-
-      else
-        while true; do
-          GATE1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Enter gateway IP address" 8 58 --title "Gateway IP" 3>&1 1>&2 2>&3)
-          if [ -z "$GATE1" ]; then
-            whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox "Gateway IP address cannot be empty" 8 58
-          elif [[ ! "$GATE1" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
-            whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox "Invalid IP address format" 8 58
-          else
-            GATE=",gw=$GATE1"
-            echo -e "${GATEWAY}${BOLD}${DGN}Gateway IP Address: ${BGN}$GATE1${CL}"
-            break
-          fi
-        done
-      fi
-    elif [[ "$NET" == *-* ]]; then
-      IFS="-" read -r ip_start ip_end <<<"$NET"
-
-      if [[ ! "$ip_start" =~ $ip_cidr_regex ]] || [[ ! "$ip_end" =~ $ip_cidr_regex ]]; then
-        msg_error "Invalid IP range format, was $NET should be 0.0.0.0/0-0.0.0.0/0"
-        exit 1
-      fi
-
-      ip1="${ip_start%%/*}"
-      ip2="${ip_end%%/*}"
-      cidr="${ip_start##*/}"
-
-      ip_to_int() {
-        local IFS=.
-        read -r i1 i2 i3 i4 <<<"$1"
-        echo $(((i1 << 24) + (i2 << 16) + (i3 << 8) + i4))
-      }
-
-      int_to_ip() {
-        local ip=$1
-        echo "$(((ip >> 24) & 0xFF)).$(((ip >> 16) & 0xFF)).$(((ip >> 8) & 0xFF)).$((ip & 0xFF))"
-      }
-
-      start_int=$(ip_to_int "$ip1")
-      end_int=$(ip_to_int "$ip2")
-
-      for ((ip_int = start_int; ip_int <= end_int; ip_int++)); do
-        ip=$(int_to_ip $ip_int)
-        msg_info "Checking IP: $ip"
-        if ! ping -c 2 -W 1 "$ip" >/dev/null 2>&1; then
-          NET="$ip/$cidr"
-          msg_ok "Using free IP Address: ${BGN}$NET${CL}"
-          sleep 3
-          break
-        fi
-      done
-      if [[ "$NET" == *-* ]]; then
-        msg_error "No free IP found in range"
-        exit 1
-      fi
-      if [ -n "$GATE" ]; then
-        if [[ "$GATE" =~ $ip_regex ]]; then
-          echo -e "${GATEWAY}${BOLD}${DGN}Gateway IP Address: ${BGN}$GATE${CL}"
-          GATE=",gw=$GATE"
-        else
-          msg_error "Invalid IP Address format for Gateway. Needs to be 0.0.0.0, was ${GATE}"
-          exit
-        fi
-      else
-        while true; do
-          GATE1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Enter gateway IP address" 8 58 --title "Gateway IP" 3>&1 1>&2 2>&3)
-          if [ -z "$GATE1" ]; then
-            whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox "Gateway IP address cannot be empty" 8 58
-          elif [[ ! "$GATE1" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
-            whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox "Invalid IP address format" 8 58
-          else
-            GATE=",gw=$GATE1"
-            echo -e "${GATEWAY}${BOLD}${DGN}Gateway IP Address: ${BGN}$GATE1${CL}"
-            break
-          fi
-        done
-      fi
-    else
-      msg_error "Invalid IP Address format. Needs to be 0.0.0.0/0 or a range like 10.0.0.1/24-10.0.0.10/24, was ${NET}"
-      exit
-    fi
-  else
-    while true; do
-      NET=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a Static IPv4 CIDR Address (/24)" 8 58 dhcp --title "IP ADDRESS" 3>&1 1>&2 2>&3)
-      exit_status=$?
-      if [ $exit_status -eq 0 ]; then
-        if [ "$NET" = "dhcp" ]; then
-          echo -e "${NETWORK}${BOLD}${DGN}IP Address: ${BGN}$NET${CL}"
-          break
-        else
-          if [[ "$NET" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$ ]]; then
-            echo -e "${NETWORK}${BOLD}${DGN}IP Address: ${BGN}$NET${CL}"
-            break
-          else
-            whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox "$NET is an invalid IPv4 CIDR address. Please enter a valid IPv4 CIDR address or 'dhcp'" 8 58
-          fi
-        fi
-      else
-        exit_script
-      fi
-    done
-    if [ "$NET" != "dhcp" ]; then
-      while true; do
-        GATE1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Enter gateway IP address" 8 58 --title "Gateway IP" 3>&1 1>&2 2>&3)
-        if [ -z "$GATE1" ]; then
-          whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox "Gateway IP address cannot be empty" 8 58
-        elif [[ ! "$GATE1" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
-          whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox "Invalid IP address format" 8 58
-        else
-          GATE=",gw=$GATE1"
-          echo -e "${GATEWAY}${BOLD}${DGN}Gateway IP Address: ${BGN}$GATE1${CL}"
-          break
-        fi
-      done
-    else
-      GATE=""
-      echo -e "${GATEWAY}${BOLD}${DGN}Gateway IP Address: ${BGN}Default${CL}"
-    fi
-  fi
-
-  if [ "$var_os" == "alpine" ]; then
-    APT_CACHER=""
-    APT_CACHER_IP=""
-  else
-    if [[ -n "${APT_CACHER_IP-}" ]]; then
-      if [[ ! $APT_CACHER_IP == "none" ]]; then
-        APT_CACHER="yes"
-        echo -e "${NETWORK}${BOLD}${DGN}APT-CACHER IP Address: ${BGN}$APT_CACHER_IP${CL}"
-      else
-        APT_CACHER=""
-        echo -e "${NETWORK}${BOLD}${DGN}APT-Cacher IP Address: ${BGN}No${CL}"
-      fi
-    else
-      if APT_CACHER_IP=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set APT-Cacher IP (leave blank for none)" 8 58 --title "APT-Cacher IP" 3>&1 1>&2 2>&3); then
-        APT_CACHER="${APT_CACHER_IP:+yes}"
-        echo -e "${NETWORK}${BOLD}${DGN}APT-Cacher IP Address: ${BGN}${APT_CACHER_IP:-Default}${CL}"
-        if [[ -n $APT_CACHER_IP ]]; then
-          APT_CACHER_IP="none"
-        fi
-      else
-        exit_script
-      fi
-    fi
-  fi
-
-  if [[ -n "${MTU-}" ]]; then
-    if [[ "$MTU" =~ ^-?[0-9]+$ ]]; then
-      echo -e "${DEFAULT}${BOLD}${DGN}Interface MTU Size: ${BGN}$MTU${CL}"
-      MTU=",mtu=$MTU"
-    else
-      msg_error "MTU must be an integer, was ${MTU}"
-      exit
-    fi
-  else
-    if MTU1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Interface MTU Size (leave blank for default [The MTU of your selected vmbr, default is 1500])" 8 58 --title "MTU SIZE" 3>&1 1>&2 2>&3); then
-      if [ -z "$MTU1" ]; then
-        MTU1="Default"
-        MTU=""
-      else
-        MTU=",mtu=$MTU1"
-      fi
-      echo -e "${DEFAULT}${BOLD}${DGN}Interface MTU Size: ${BGN}$MTU1${CL}"
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ "$IPV6_METHOD" == "static" ]]; then
-    if [[ -n "$IPV6STATIC" ]]; then
-      IP6=",ip6=${IPV6STATIC}"
-      echo -e "${NETWORK}${BOLD}${DGN}IPv6 Address: ${BGN}${IPV6STATIC}${CL}"
-    else
-      msg_error "IPV6_METHOD is set to static but IPV6STATIC is empty"
-      exit
-    fi
-  elif [[ "$IPV6_METHOD" == "auto" ]]; then
-    IP6=",ip6=auto"
-    echo -e "${NETWORK}${BOLD}${DGN}IPv6 Address: ${BGN}auto${CL}"
-  else
-    IP6=""
-    echo -e "${NETWORK}${BOLD}${DGN}IPv6 Address: ${BGN}none${CL}"
-  fi
-
-  if [[ -n "${SD-}" ]]; then
-    if [[ "$SD" == "none" ]]; then
-      SD=""
-      echo -e "${SEARCH}${BOLD}${DGN}DNS Search Domain: ${BGN}Host${CL}"
-    else
-      # Strip prefix if present for config file storage
-      local SD_VALUE="$SD"
-      [[ "$SD" =~ ^-searchdomain= ]] && SD_VALUE="${SD#-searchdomain=}"
-      echo -e "${SEARCH}${BOLD}${DGN}DNS Search Domain: ${BGN}$SD_VALUE${CL}"
-      SD="-searchdomain=$SD_VALUE"
-    fi
-  else
-    if SD=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a DNS Search Domain (leave blank for HOST)" 8 58 --title "DNS Search Domain" 3>&1 1>&2 2>&3); then
-      if [ -z "$SD" ]; then
-        SX=Host
-        SD=""
-      else
-        SX=$SD
-        SD="-searchdomain=$SD"
-      fi
-      echo -e "${SEARCH}${BOLD}${DGN}DNS Search Domain: ${BGN}$SX${CL}"
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${NS-}" ]]; then
-    if [[ $NS == "none" ]]; then
-      NS=""
-      echo -e "${NETWORK}${BOLD}${DGN}DNS Server IP Address: ${BGN}Host${CL}"
-    else
-      # Strip prefix if present for config file storage
-      local NS_VALUE="$NS"
-      [[ "$NS" =~ ^-nameserver= ]] && NS_VALUE="${NS#-nameserver=}"
-      if [[ "$NS_VALUE" =~ $ip_regex ]]; then
-        echo -e "${NETWORK}${BOLD}${DGN}DNS Server IP Address: ${BGN}$NS_VALUE${CL}"
-        NS="-nameserver=$NS_VALUE"
-      else
-        msg_error "Invalid IP Address format for DNS Server. Needs to be 0.0.0.0, was ${NS_VALUE}"
-        exit
-      fi
-    fi
-  else
-    if NX=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a DNS Server IP (leave blank for HOST)" 8 58 --title "DNS SERVER IP" 3>&1 1>&2 2>&3); then
-      if [ -z "$NX" ]; then
-        NX=Host
-        NS=""
-      else
-        NS="-nameserver=$NX"
-      fi
-      echo -e "${NETWORK}${BOLD}${DGN}DNS Server IP Address: ${BGN}$NX${CL}"
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${MAC-}" ]]; then
-    if [[ "$MAC" == "none" ]]; then
-      MAC=""
-      echo -e "${MACADDRESS}${BOLD}${DGN}MAC Address: ${BGN}Host${CL}"
-    else
-      # Strip prefix if present for config file storage
-      local MAC_VALUE="$MAC"
-      [[ "$MAC" =~ ^,hwaddr= ]] && MAC_VALUE="${MAC#,hwaddr=}"
-      if [[ "$MAC_VALUE" =~ ^([A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2}$ ]]; then
-        echo -e "${MACADDRESS}${BOLD}${DGN}MAC Address: ${BGN}$MAC_VALUE${CL}"
-        MAC=",hwaddr=$MAC_VALUE"
-      else
-        msg_error "MAC Address must be in the format xx:xx:xx:xx:xx:xx, was ${MAC_VALUE}"
-        exit
-      fi
-    fi
-  else
-    if MAC1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a MAC Address(leave blank for generated MAC)" 8 58 --title "MAC ADDRESS" 3>&1 1>&2 2>&3); then
-      if [ -z "$MAC1" ]; then
-        MAC1="Default"
-        MAC=""
-      else
-        MAC=",hwaddr=$MAC1"
-        echo -e "${MACADDRESS}${BOLD}${DGN}MAC Address: ${BGN}$MAC1${CL}"
-      fi
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${VLAN-}" ]]; then
-    if [[ "$VLAN" == "none" ]]; then
-      VLAN=""
-      echo -e "${VLANTAG}${BOLD}${DGN}Vlan: ${BGN}Host${CL}"
-    else
-      # Strip prefix if present for config file storage
-      local VLAN_VALUE="$VLAN"
-      [[ "$VLAN" =~ ^,tag= ]] && VLAN_VALUE="${VLAN#,tag=}"
-      if [[ "$VLAN_VALUE" =~ ^-?[0-9]+$ ]]; then
-        echo -e "${VLANTAG}${BOLD}${DGN}Vlan: ${BGN}$VLAN_VALUE${CL}"
-        VLAN=",tag=$VLAN_VALUE"
-      else
-        msg_error "VLAN must be an integer, was ${VLAN_VALUE}"
-        exit
-      fi
-    fi
-  else
-    if VLAN1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a Vlan(leave blank for no VLAN)" 8 58 --title "VLAN" 3>&1 1>&2 2>&3); then
-      if [ -z "$VLAN1" ]; then
-        VLAN1="Default"
-        VLAN=""
-      else
-        VLAN=",tag=$VLAN1"
-      fi
-      echo -e "${VLANTAG}${BOLD}${DGN}Vlan: ${BGN}$VLAN1${CL}"
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${TAGS-}" ]]; then
-    if [[ "$TAGS" == *"DEFAULT"* ]]; then
-      TAGS="${TAGS//DEFAULT/}"
-      TAGS="${TAGS//;/}"
-      TAGS="$TAGS;${var_tags:-}"
-      echo -e "${NETWORK}${BOLD}${DGN}Tags: ${BGN}$TAGS${CL}"
-    fi
-  else
-    TAGS="community-scripts;"
-    if ADV_TAGS=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Custom Tags?[If you remove all, there will be no tags!]" 8 58 "${TAGS}" --title "Advanced Tags" 3>&1 1>&2 2>&3); then
-      if [ -n "${ADV_TAGS}" ]; then
-        ADV_TAGS=$(echo "$ADV_TAGS" | tr -d '[:space:]')
-        TAGS="${ADV_TAGS}"
-      else
-        TAGS=";"
-      fi
-      echo -e "${NETWORK}${BOLD}${DGN}Tags: ${BGN}$TAGS${CL}"
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${SSH-}" ]]; then
-    if [[ "$SSH" == "yes" ]]; then
-      echo -e "${ROOTSSH}${BOLD}${DGN}Root SSH Access: ${BGN}$SSH${CL}"
-      if [[ ! -z "$SSH_AUTHORIZED_KEY" ]]; then
-        echo -e "${ROOTSSH}${BOLD}${DGN}SSH Authorized Key: ${BGN}********************${CL}"
-      else
-        echo -e "${ROOTSSH}${BOLD}${DGN}SSH Authorized Key: ${BGN}None${CL}"
-      fi
-    elif [[ "$SSH" == "no" ]]; then
-      echo -e "${ROOTSSH}${BOLD}${DGN}Root SSH Access: ${BGN}$SSH${CL}"
-    else
-      msg_error "SSH needs to be 'yes' or 'no', was ${SSH}"
-      exit
-    fi
-  else
-    SSH_AUTHORIZED_KEY="$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "SSH Authorized key for root (leave empty for none)" 8 58 --title "SSH Key" 3>&1 1>&2 2>&3)"
-    if [[ -z "${SSH_AUTHORIZED_KEY}" ]]; then
-      SSH_AUTHORIZED_KEY=""
-    fi
-    if [[ "$PW" == -password* || -n "$SSH_AUTHORIZED_KEY" ]]; then
-      if (whiptail --backtitle "Proxmox VE Helper Scripts" --defaultno --title "SSH ACCESS" --yesno "Enable Root SSH Access?" 10 58); then
-        SSH="yes"
-      else
-        SSH="no"
-      fi
-      echo -e "${ROOTSSH}${BOLD}${DGN}Root SSH Access: ${BGN}$SSH${CL}"
-    else
-      SSH="no"
-      echo -e "${ROOTSSH}${BOLD}${DGN}Root SSH Access: ${BGN}$SSH${CL}"
-    fi
-  fi
-
-  if [[ -n "$ENABLE_FUSE" ]]; then
-    if [[ "$ENABLE_FUSE" == "yes" ]]; then
-      echo -e "${FUSE}${BOLD}${DGN}Enable FUSE: ${BGN}Yes${CL}"
-    elif [[ "$ENABLE_FUSE" == "no" ]]; then
-      echo -e "${FUSE}${BOLD}${DGN}Enable FUSE: ${BGN}No${CL}"
-    else
-      msg_error "Enable FUSE needs to be 'yes' or 'no', was ${ENABLE_FUSE}"
-      exit
-    fi
-  else
-    if (whiptail --backtitle "Proxmox VE Helper Scripts" --defaultno --title "FUSE" --yesno "Enable FUSE?" 10 58); then
-      ENABLE_FUSE="yes"
-    else
-      ENABLE_FUSE="no"
-    fi
-    echo -e "${FUSE}${BOLD}${DGN}Enable FUSE: ${BGN}$ENABLE_FUSE${CL}"
-  fi
-
-  if [[ -n "$ENABLE_TUN" ]]; then
-    if [[ "$ENABLE_TUN" == "yes" ]]; then
-      echo -e "${FUSE}${BOLD}${DGN}Enable TUN: ${BGN}Yes${CL}"
-    elif [[ "$ENABLE_TUN" == "no" ]]; then
-      echo -e "${FUSE}${BOLD}${DGN}Enable TUN: ${BGN}No${CL}"
-    else
-      msg_error "Enable TUN needs to be 'yes' or 'no', was ${ENABLE_TUN}"
-      exit
-    fi
-  else
-    if (whiptail --backtitle "Proxmox VE Helper Scripts" --defaultno --title "TUN" --yesno "Enable TUN?" 10 58); then
-      ENABLE_TUN="yes"
-    else
-      ENABLE_TUN="no"
-    fi
-    echo -e "${FUSE}${BOLD}${DGN}Enable TUN: ${BGN}$ENABLE_TUN${CL}"
-  fi
-
-  if [[ -n "${VERBOSE-}" ]]; then
-    if [[ "$VERBOSE" == "yes" ]]; then
-      echo -e "${SEARCH}${BOLD}${DGN}Verbose Mode: ${BGN}$VERBOSE${CL}"
-    elif [[ "$VERBOSE" == "no" ]]; then
-      echo -e "${SEARCH}${BOLD}${DGN}Verbose Mode: ${BGN}No${CL}"
-    else
-      msg_error "Verbose Mode needs to be 'yes' or 'no', was ${VERBOSE}"
-      exit
-    fi
-  else
-    if (whiptail --backtitle "Proxmox VE Helper Scripts" --defaultno --title "VERBOSE MODE" --yesno "Enable Verbose Mode?" 10 58); then
-      VERBOSE="yes"
-    else
-      VERBOSE="no"
-    fi
-    echo -e "${SEARCH}${BOLD}${DGN}Verbose Mode: ${BGN}$VERBOSE${CL}"
-  fi
-
-  if (whiptail --backtitle "Proxmox VE Helper Scripts" --title "ADVANCED SETTINGS WITH CONFIG FILE COMPLETE" --yesno "Ready to create ${APP} LXC?" 10 58); then
-    echo -e "${CREATING}${BOLD}${RD}Creating a ${APP} LXC using the above settings${CL}"
-  else
-    clear
-    header_info
-    echo -e "${INFO}${HOLD} ${GN}Using Config File on node $PVEHOST_NAME${CL}"
-    config_file
-  fi
-}

scripts/core/create_lxc.sh

@@ -1,380 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2025 tteck
-# Author: tteck (tteckster)
-# Co-Author: MickLesk
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-
-# This sets verbose mode if the global variable is set to "yes"
-# if [ "$VERBOSE" == "yes" ]; then set -x; fi
-
-source "$(dirname "$0")/core.func"
-
-
-# This sets error handling options and defines the error_handler function to handle errors
-set -Eeuo pipefail
-trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
-trap on_exit EXIT
-trap on_interrupt INT
-trap on_terminate TERM
-
-function on_exit() {
-  local exit_code="$?"
-  [[ -n "${lockfile:-}" && -e "$lockfile" ]] && rm -f "$lockfile"
-  exit "$exit_code"
-}
-
-function error_handler() {
-  local exit_code="$?"
-  local line_number="$1"
-  local command="$2"
-  printf "\e[?25h"
-  echo -e "\n${RD}[ERROR]${CL} in line ${RD}$line_number${CL}: exit code ${RD}$exit_code${CL}: while executing command ${YW}$command${CL}\n"
-  exit "$exit_code"
-}
-
-function on_interrupt() {
-  echo -e "\n${RD}Interrupted by user (SIGINT)${CL}"
-  exit 130
-}
-
-function on_terminate() {
-  echo -e "\n${RD}Terminated by signal (SIGTERM)${CL}"
-  exit 143
-}
-
-function exit_script() {
-  clear
-  printf "\e[?25h"
-  echo -e "\n${CROSS}${RD}User exited script${CL}\n"
-  kill 0
-  exit 1
-}
-
-function check_storage_support() {
-  local CONTENT="$1"
-  local -a VALID_STORAGES=()
-  while IFS= read -r line; do
-    local STORAGE_NAME
-    STORAGE_NAME=$(awk '{print $1}' <<<"$line")
-    [[ -z "$STORAGE_NAME" ]] && continue
-    VALID_STORAGES+=("$STORAGE_NAME")
-  done < <(pvesm status -content "$CONTENT" 2>/dev/null | awk 'NR>1')
-
-  [[ ${#VALID_STORAGES[@]} -gt 0 ]]
-}
-
-# This function selects a storage pool for a given content type (e.g., rootdir, vztmpl).
-function select_storage() {
-  local CLASS=$1 CONTENT CONTENT_LABEL
-
-  case $CLASS in
-  container)
-    CONTENT='rootdir'
-    CONTENT_LABEL='Container'
-    ;;
-  template)
-    CONTENT='vztmpl'
-    CONTENT_LABEL='Container template'
-    ;;
-  iso)
-    CONTENT='iso'
-    CONTENT_LABEL='ISO image'
-    ;;
-  images)
-    CONTENT='images'
-    CONTENT_LABEL='VM Disk image'
-    ;;
-  backup)
-    CONTENT='backup'
-    CONTENT_LABEL='Backup'
-    ;;
-  snippets)
-    CONTENT='snippets'
-    CONTENT_LABEL='Snippets'
-    ;;
-  *)
-    msg_error "Invalid storage class '$CLASS'"
-    return 1
-    ;;
-  esac
-
-  # Check for preset STORAGE variable
-  if [ "$CONTENT" = "rootdir" ] && [ -n "${STORAGE:-}" ]; then
-    if pvesm status -content "$CONTENT" | awk 'NR>1 {print $1}' | grep -qx "$STORAGE"; then
-      STORAGE_RESULT="$STORAGE"
-      msg_info "Using preset storage: $STORAGE_RESULT for $CONTENT_LABEL"
-      return 0
-    else
-      msg_error "Preset storage '$STORAGE' is not valid for content type '$CONTENT'."
-      return 2
-    fi
-  fi
-
-  local -A STORAGE_MAP
-  local -a MENU
-  local COL_WIDTH=0
-
-  while read -r TAG TYPE _ TOTAL USED FREE _; do
-    [[ -n "$TAG" && -n "$TYPE" ]] || continue
-    local STORAGE_NAME="$TAG"
-    local DISPLAY="${STORAGE_NAME} (${TYPE})"
-    local USED_FMT=$(numfmt --to=iec --from-unit=K --format %.1f <<<"$USED")
-    local FREE_FMT=$(numfmt --to=iec --from-unit=K --format %.1f <<<"$FREE")
-    local INFO="Free: ${FREE_FMT}B  Used: ${USED_FMT}B"
-    STORAGE_MAP["$DISPLAY"]="$STORAGE_NAME"
-    MENU+=("$DISPLAY" "$INFO" "OFF")
-    ((${#DISPLAY} > COL_WIDTH)) && COL_WIDTH=${#DISPLAY}
-  done < <(pvesm status -content "$CONTENT" | awk 'NR>1')
-
-  if [ ${#MENU[@]} -eq 0 ]; then
-    msg_error "No storage found for content type '$CONTENT'."
-    return 2
-  fi
-
-  if [ $((${#MENU[@]} / 3)) -eq 1 ]; then
-    STORAGE_RESULT="${STORAGE_MAP[${MENU[0]}]}"
-    STORAGE_INFO="${MENU[1]}"
-    return 0
-  fi
-
-  local WIDTH=$((COL_WIDTH + 42))
-  while true; do
-    local DISPLAY_SELECTED
-    DISPLAY_SELECTED=$(whiptail --backtitle "Proxmox VE Helper Scripts" \
-      --title "Storage Pools" \
-      --radiolist "Which storage pool for ${CONTENT_LABEL,,}?\n(Spacebar to select)" \
-      16 "$WIDTH" 6 "${MENU[@]}" 3>&1 1>&2 2>&3)
-
-    # Cancel or ESC
-    [[ $? -ne 0 ]] && exit_script
-
-    # Strip trailing whitespace or newline (important for storages like "storage (dir)")
-    DISPLAY_SELECTED=$(sed 's/[[:space:]]*$//' <<<"$DISPLAY_SELECTED")
-
-    if [[ -z "$DISPLAY_SELECTED" || -z "${STORAGE_MAP[$DISPLAY_SELECTED]+_}" ]]; then
-      whiptail --msgbox "No valid storage selected. Please try again." 8 58
-      continue
-    fi
-
-    STORAGE_RESULT="${STORAGE_MAP[$DISPLAY_SELECTED]}"
-    for ((i = 0; i < ${#MENU[@]}; i += 3)); do
-      if [[ "${MENU[$i]}" == "$DISPLAY_SELECTED" ]]; then
-        STORAGE_INFO="${MENU[$i + 1]}"
-        break
-      fi
-    done
-    return 0
-  done
-}
-
-# Test if required variables are set
-[[ "${CTID:-}" ]] || {
-  msg_error "You need to set 'CTID' variable."
-  exit 203
-}
-[[ "${PCT_OSTYPE:-}" ]] || {
-  msg_error "You need to set 'PCT_OSTYPE' variable."
-  exit 204
-}
-
-# Test if ID is valid
-[ "$CTID" -ge "100" ] || {
-  msg_error "ID cannot be less than 100."
-  exit 205
-}
-
-# Test if ID is in use
-if qm status "$CTID" &>/dev/null || pct status "$CTID" &>/dev/null; then
-  echo -e "ID '$CTID' is already in use."
-  unset CTID
-  msg_error "Cannot use ID that is already in use."
-  exit 206
-fi
-
-# This checks for the presence of valid Container Storage and Template Storage locations
-msg_info "Validating storage"
-if ! check_storage_support "rootdir"; then
-  msg_error "No valid storage found for 'rootdir' [Container]"
-  exit 1
-fi
-if ! check_storage_support "vztmpl"; then
-  msg_error "No valid storage found for 'vztmpl' [Template]"
-  exit 1
-fi
-
-#msg_info "Checking template storage"
-while true; do
-  if select_storage template; then
-    TEMPLATE_STORAGE="$STORAGE_RESULT"
-    TEMPLATE_STORAGE_INFO="$STORAGE_INFO"
-    msg_ok "Storage ${BL}$TEMPLATE_STORAGE${CL} ($TEMPLATE_STORAGE_INFO) [Template]"
-    break
-  fi
-done
-
-while true; do
-  if select_storage container; then
-    CONTAINER_STORAGE="$STORAGE_RESULT"
-    CONTAINER_STORAGE_INFO="$STORAGE_INFO"
-    msg_ok "Storage ${BL}$CONTAINER_STORAGE${CL} ($CONTAINER_STORAGE_INFO) [Container]"
-    break
-  fi
-done
-
-# Check free space on selected container storage
-STORAGE_FREE=$(pvesm status | awk -v s="$CONTAINER_STORAGE" '$1 == s { print $6 }')
-REQUIRED_KB=$((${PCT_DISK_SIZE:-8} * 1024 * 1024))
-if [ "$STORAGE_FREE" -lt "$REQUIRED_KB" ]; then
-  msg_error "Not enough space on '$CONTAINER_STORAGE'. Needed: ${PCT_DISK_SIZE:-8}G."
-  exit 214
-fi
-
-# Check Cluster Quorum if in Cluster
-if [ -f /etc/pve/corosync.conf ]; then
-  msg_info "Checking cluster quorum"
-  if ! pvecm status | awk -F':' '/^Quorate/ { exit ($2 ~ /Yes/) ? 0 : 1 }'; then
-
-    msg_error "Cluster is not quorate. Start all nodes or configure quorum device (QDevice)."
-    exit 210
-  fi
-  msg_ok "Cluster is quorate"
-fi
-
-# Update LXC template list
-TEMPLATE_SEARCH="${PCT_OSTYPE}-${PCT_OSVERSION:-}"
-case "$PCT_OSTYPE" in
-debian | ubuntu)
-  TEMPLATE_PATTERN="-standard_"
-  ;;
-alpine | fedora | rocky | centos)
-  TEMPLATE_PATTERN="-default_"
-  ;;
-*)
-  TEMPLATE_PATTERN=""
-  ;;
-esac
-
-# 1. Check local templates first
-msg_info "Searching for template '$TEMPLATE_SEARCH'"
-mapfile -t TEMPLATES < <(
-  pveam list "$TEMPLATE_STORAGE" |
-    awk -v s="$TEMPLATE_SEARCH" -v p="$TEMPLATE_PATTERN" '$1 ~ s && $1 ~ p {print $1}' |
-    sed 's/.*\///' | sort -t - -k 2 -V
-)
-
-if [ ${#TEMPLATES[@]} -gt 0 ]; then
-  TEMPLATE_SOURCE="local"
-else
-  msg_info "No local template found, checking online repository"
-  pveam update >/dev/null 2>&1
-  mapfile -t TEMPLATES < <(
-    pveam update >/dev/null 2>&1 &&
-      pveam available -section system |
-      sed -n "s/.*\($TEMPLATE_SEARCH.*$TEMPLATE_PATTERN.*\)/\1/p" |
-        sort -t - -k 2 -V
-  )
-  TEMPLATE_SOURCE="online"
-fi
-
-TEMPLATE="${TEMPLATES[-1]}"
-TEMPLATE_PATH="$(pvesm path $TEMPLATE_STORAGE:vztmpl/$TEMPLATE 2>/dev/null ||
-  echo "/var/lib/vz/template/cache/$TEMPLATE")"
-msg_ok "Template ${BL}$TEMPLATE${CL} [$TEMPLATE_SOURCE]"
-
-# 4. Validate template (exists & not corrupted)
-TEMPLATE_VALID=1
-
-if [ ! -s "$TEMPLATE_PATH" ]; then
-  TEMPLATE_VALID=0
-elif ! tar --use-compress-program=zstdcat -tf "$TEMPLATE_PATH" >/dev/null 2>&1; then
-  TEMPLATE_VALID=0
-fi
-
-if [ "$TEMPLATE_VALID" -eq 0 ]; then
-  msg_warn "Template $TEMPLATE is missing or corrupted. Re-downloading."
-  [[ -f "$TEMPLATE_PATH" ]] && rm -f "$TEMPLATE_PATH"
-  for attempt in {1..3}; do
-    msg_info "Attempt $attempt: Downloading LXC template..."
-    if pveam download "$TEMPLATE_STORAGE" "$TEMPLATE" >/dev/null 2>&1; then
-      msg_ok "Template download successful."
-      break
-    fi
-    if [ $attempt -eq 3 ]; then
-      msg_error "Failed after 3 attempts. Please check network access or manually run:\n  pveam download $TEMPLATE_STORAGE $TEMPLATE"
-      exit 208
-    fi
-    sleep $((attempt * 5))
-  done
-fi
-
-msg_info "Creating LXC Container"
-# Check and fix subuid/subgid
-grep -q "root:100000:65536" /etc/subuid || echo "root:100000:65536" >>/etc/subuid
-grep -q "root:100000:65536" /etc/subgid || echo "root:100000:65536" >>/etc/subgid
-
-# Combine all options
-PCT_OPTIONS=(${PCT_OPTIONS[@]:-${DEFAULT_PCT_OPTIONS[@]}})
-[[ " ${PCT_OPTIONS[@]} " =~ " -rootfs " ]] || PCT_OPTIONS+=(-rootfs "$CONTAINER_STORAGE:${PCT_DISK_SIZE:-8}")
-
-# Secure creation of the LXC container with lock and template check
-lockfile="/tmp/template.${TEMPLATE}.lock"
-exec 9>"$lockfile" || {
-  msg_error "Failed to create lock file '$lockfile'."
-  exit 200
-}
-flock -w 60 9 || {
-  msg_error "Timeout while waiting for template lock"
-  exit 211
-}
-
-if ! pct create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" "${PCT_OPTIONS[@]}" &>/dev/null; then
-  msg_error "Container creation failed. Checking if template is corrupted or incomplete."
-
-  if [[ ! -s "$TEMPLATE_PATH" || "$(stat -c%s "$TEMPLATE_PATH")" -lt 1000000 ]]; then
-    msg_error "Template file too small or missing – re-downloading."
-    rm -f "$TEMPLATE_PATH"
-  elif ! zstdcat "$TEMPLATE_PATH" | tar -tf - &>/dev/null; then
-    msg_error "Template appears to be corrupted – re-downloading."
-    rm -f "$TEMPLATE_PATH"
-  else
-    msg_error "Template is valid, but container creation still failed."
-    exit 209
-  fi
-
-  # Retry download
-  for attempt in {1..3}; do
-    msg_info "Attempt $attempt: Re-downloading template..."
-    if timeout 120 pveam download "$TEMPLATE_STORAGE" "$TEMPLATE" >/dev/null; then
-      msg_ok "Template re-download successful."
-      break
-    fi
-    if [ "$attempt" -eq 3 ]; then
-      msg_error "Three failed attempts. Aborting."
-      exit 208
-    fi
-    sleep $((attempt * 5))
-  done
-
-  sleep 1 # I/O-Sync-Delay
-  msg_ok "Re-downloaded LXC Template"
-fi
-
-if ! pct list | awk '{print $1}' | grep -qx "$CTID"; then
-  msg_error "Container ID $CTID not listed in 'pct list' – unexpected failure."
-  exit 215
-fi
-
-if ! grep -q '^rootfs:' "/etc/pve/lxc/$CTID.conf"; then
-  msg_error "RootFS entry missing in container config – storage not correctly assigned."
-  exit 216
-fi
-
-if grep -q '^hostname:' "/etc/pve/lxc/$CTID.conf"; then
-  CT_HOSTNAME=$(grep '^hostname:' "/etc/pve/lxc/$CTID.conf" | awk '{print $2}')
-  if [[ ! "$CT_HOSTNAME" =~ ^[a-z0-9-]+$ ]]; then
-    msg_warn "Hostname '$CT_HOSTNAME' contains invalid characters – may cause issues with networking or DNS."
-  fi
-fi
-
-msg_ok "LXC Container ${BL}$CTID${CL} ${GN}was successfully created."

scripts/core/error-handler.func

@@ -0,0 +1,322 @@
+#!/usr/bin/env bash
+# ------------------------------------------------------------------------------
+# ERROR HANDLER - ERROR & SIGNAL MANAGEMENT
+# ------------------------------------------------------------------------------
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# ------------------------------------------------------------------------------
+#
+# Provides comprehensive error handling and signal management for all scripts.
+# Includes:
+#   - Exit code explanations (shell, package managers, databases, custom codes)
+#   - Error handler with detailed logging
+#   - Signal handlers (EXIT, INT, TERM)
+#   - Initialization function for trap setup
+#
+# Usage:
+#   source <(curl -fsSL .../error_handler.func)
+#   catch_errors
+#
+# ------------------------------------------------------------------------------
+
+# ==============================================================================
+# SECTION 1: EXIT CODE EXPLANATIONS
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# explain_exit_code()
+#
+# - Maps numeric exit codes to human-readable error descriptions
+# - Supports:
+#   * Generic/Shell errors (1, 2, 126, 127, 128, 130, 137, 139, 143)
+#   * Package manager errors (APT, DPKG: 100, 101, 255)
+#   * Node.js/npm errors (243-249, 254)
+#   * Python/pip/uv errors (210-212)
+#   * PostgreSQL errors (231-234)
+#   * MySQL/MariaDB errors (241-244)
+#   * MongoDB errors (251-254)
+#   * Proxmox custom codes (200-231)
+# - Returns description string for given exit code
+# ------------------------------------------------------------------------------
+explain_exit_code() {
+  local code="$1"
+  case "$code" in
+  # --- Generic / Shell ---
+  1) echo "General error / Operation not permitted" ;;
+  2) echo "Misuse of shell builtins (e.g. syntax error)" ;;
+  126) echo "Command invoked cannot execute (permission problem?)" ;;
+  127) echo "Command not found" ;;
+  128) echo "Invalid argument to exit" ;;
+  130) echo "Terminated by Ctrl+C (SIGINT)" ;;
+  137) echo "Killed (SIGKILL / Out of memory?)" ;;
+  139) echo "Segmentation fault (core dumped)" ;;
+  143) echo "Terminated (SIGTERM)" ;;
+
+  # --- Package manager / APT / DPKG ---
+  100) echo "APT: Package manager error (broken packages / dependency problems)" ;;
+  101) echo "APT: Configuration error (bad sources.list, malformed config)" ;;
+  255) echo "DPKG: Fatal internal error" ;;
+
+  # --- Node.js / npm / pnpm / yarn ---
+  243) echo "Node.js: Out of memory (JavaScript heap out of memory)" ;;
+  245) echo "Node.js: Invalid command-line option" ;;
+  246) echo "Node.js: Internal JavaScript Parse Error" ;;
+  247) echo "Node.js: Fatal internal error" ;;
+  248) echo "Node.js: Invalid C++ addon / N-API failure" ;;
+  249) echo "Node.js: Inspector error" ;;
+  254) echo "npm/pnpm/yarn: Unknown fatal error" ;;
+
+  # --- Python / pip / uv ---
+  210) echo "Python: Virtualenv / uv environment missing or broken" ;;
+  211) echo "Python: Dependency resolution failed" ;;
+  212) echo "Python: Installation aborted (permissions or EXTERNALLY-MANAGED)" ;;
+
+  # --- PostgreSQL ---
+  231) echo "PostgreSQL: Connection failed (server not running / wrong socket)" ;;
+  232) echo "PostgreSQL: Authentication failed (bad user/password)" ;;
+  233) echo "PostgreSQL: Database does not exist" ;;
+  234) echo "PostgreSQL: Fatal error in query / syntax" ;;
+
+  # --- MySQL / MariaDB ---
+  241) echo "MySQL/MariaDB: Connection failed (server not running / wrong socket)" ;;
+  242) echo "MySQL/MariaDB: Authentication failed (bad user/password)" ;;
+  243) echo "MySQL/MariaDB: Database does not exist" ;;
+  244) echo "MySQL/MariaDB: Fatal error in query / syntax" ;;
+
+  # --- MongoDB ---
+  251) echo "MongoDB: Connection failed (server not running)" ;;
+  252) echo "MongoDB: Authentication failed (bad user/password)" ;;
+  253) echo "MongoDB: Database not found" ;;
+  254) echo "MongoDB: Fatal query error" ;;
+
+  # --- Proxmox Custom Codes ---
+  200) echo "Proxmox: Failed to create lock file" ;;
+  203) echo "Proxmox: Missing CTID variable" ;;
+  204) echo "Proxmox: Missing PCT_OSTYPE variable" ;;
+  205) echo "Proxmox: Invalid CTID (<100)" ;;
+  206) echo "Proxmox: CTID already in use" ;;
+  207) echo "Proxmox: Password contains unescaped special characters" ;;
+  208) echo "Proxmox: Invalid configuration (DNS/MAC/Network format)" ;;
+  209) echo "Proxmox: Container creation failed" ;;
+  210) echo "Proxmox: Cluster not quorate" ;;
+  211) echo "Proxmox: Timeout waiting for template lock" ;;
+  212) echo "Proxmox: Storage type 'iscsidirect' does not support containers (VMs only)" ;;
+  213) echo "Proxmox: Storage type does not support 'rootdir' content" ;;
+  214) echo "Proxmox: Not enough storage space" ;;
+  215) echo "Proxmox: Container created but not listed (ghost state)" ;;
+  216) echo "Proxmox: RootFS entry missing in config" ;;
+  217) echo "Proxmox: Storage not accessible" ;;
+  219) echo "Proxmox: CephFS does not support containers - use RBD" ;;
+  224) echo "Proxmox: PBS storage is for backups only" ;;
+  218) echo "Proxmox: Template file corrupted or incomplete" ;;
+  220) echo "Proxmox: Unable to resolve template path" ;;
+  221) echo "Proxmox: Template file not readable" ;;
+  222) echo "Proxmox: Template download failed" ;;
+  223) echo "Proxmox: Template not available after download" ;;
+  225) echo "Proxmox: No template available for OS/Version" ;;
+  231) echo "Proxmox: LXC stack upgrade failed" ;;
+
+  # --- Default ---
+  *) echo "Unknown error" ;;
+  esac
+}
+
+# ==============================================================================
+# SECTION 2: ERROR HANDLERS
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# error_handler()
+#
+# - Main error handler triggered by ERR trap
+# - Arguments: exit_code, command, line_number
+# - Behavior:
+#   * Returns silently if exit_code is 0 (success)
+#   * Sources explain_exit_code() for detailed error description
+#   * Displays error message with:
+#     - Line number where error occurred
+#     - Exit code with explanation
+#     - Command that failed
+#   * Shows last 20 lines of SILENT_LOGFILE if available
+#   * Copies log to container /root for later inspection
+#   * Exits with original exit code
+# ------------------------------------------------------------------------------
+error_handler() {
+  local exit_code=${1:-$?}
+  local command=${2:-${BASH_COMMAND:-unknown}}
+  local line_number=${BASH_LINENO[0]:-unknown}
+
+  command="${command//\$STD/}"
+
+  if [[ "$exit_code" -eq 0 ]]; then
+    return 0
+  fi
+
+  local explanation
+  explanation="$(explain_exit_code "$exit_code")"
+
+  printf "\e[?25h"
+
+  # Use msg_error if available, fallback to echo
+  if declare -f msg_error >/dev/null 2>&1; then
+    msg_error "in line ${line_number}: exit code ${exit_code} (${explanation}): while executing command ${command}"
+  else
+    echo -e "\n${RD}[ERROR]${CL} in line ${RD}${line_number}${CL}: exit code ${RD}${exit_code}${CL} (${explanation}): while executing command ${YWB}${command}${CL}\n"
+  fi
+
+  if [[ -n "${DEBUG_LOGFILE:-}" ]]; then
+    {
+      echo "------ ERROR ------"
+      echo "Timestamp : $(date '+%Y-%m-%d %H:%M:%S')"
+      echo "Exit Code : $exit_code ($explanation)"
+      echo "Line      : $line_number"
+      echo "Command   : $command"
+      echo "-------------------"
+    } >>"$DEBUG_LOGFILE"
+  fi
+
+  # Get active log file (BUILD_LOG or INSTALL_LOG)
+  local active_log=""
+  if declare -f get_active_logfile >/dev/null 2>&1; then
+    active_log="$(get_active_logfile)"
+  elif [[ -n "${SILENT_LOGFILE:-}" ]]; then
+    active_log="$SILENT_LOGFILE"
+  fi
+
+  if [[ -n "$active_log" && -s "$active_log" ]]; then
+    echo "--- Last 20 lines of silent log ---"
+    tail -n 20 "$active_log"
+    echo "-----------------------------------"
+
+    # Detect context: Container (INSTALL_LOG set + /root exists) vs Host (BUILD_LOG)
+    if [[ -n "${INSTALL_LOG:-}" && -d /root ]]; then
+      # CONTAINER CONTEXT: Copy log and create flag file for host
+      local container_log="/root/.install-${SESSION_ID:-error}.log"
+      cp "$active_log" "$container_log" 2>/dev/null || true
+
+      # Create error flag file with exit code for host detection
+      echo "$exit_code" >"/root/.install-${SESSION_ID:-error}.failed" 2>/dev/null || true
+
+      if declare -f msg_custom >/dev/null 2>&1; then
+        msg_custom "📋" "${YW}" "Log saved to: ${container_log}"
+      else
+        echo -e "${YW}Log saved to:${CL} ${BL}${container_log}${CL}"
+      fi
+    else
+      # HOST CONTEXT: Show local log path and offer container cleanup
+      if declare -f msg_custom >/dev/null 2>&1; then
+        msg_custom "📋" "${YW}" "Full log: ${active_log}"
+      else
+        echo -e "${YW}Full log:${CL} ${BL}${active_log}${CL}"
+      fi
+
+      # Offer to remove container if it exists (build errors after container creation)
+      if [[ -n "${CTID:-}" ]] && command -v pct &>/dev/null && pct status "$CTID" &>/dev/null; then
+        echo ""
+        echo -en "${YW}Remove broken container ${CTID}? (Y/n) [auto-remove in 60s]: ${CL}"
+
+        if read -t 60 -r response; then
+          if [[ -z "$response" || "$response" =~ ^[Yy]$ ]]; then
+            echo -e "\n${YW}Removing container ${CTID}${CL}"
+            pct stop "$CTID" &>/dev/null || true
+            pct destroy "$CTID" &>/dev/null || true
+            echo -e "${GN}✔${CL} Container ${CTID} removed"
+          elif [[ "$response" =~ ^[Nn]$ ]]; then
+            echo -e "\n${YW}Container ${CTID} kept for debugging${CL}"
+          fi
+        else
+          # Timeout - auto-remove
+          echo -e "\n${YW}No response - auto-removing container${CL}"
+          pct stop "$CTID" &>/dev/null || true
+          pct destroy "$CTID" &>/dev/null || true
+          echo -e "${GN}✔${CL} Container ${CTID} removed"
+        fi
+      fi
+    fi
+  fi
+
+  exit "$exit_code"
+}
+
+# ==============================================================================
+# SECTION 3: SIGNAL HANDLERS
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# on_exit()
+#
+# - EXIT trap handler
+# - Cleans up lock files if lockfile variable is set
+# - Exits with captured exit code
+# - Always runs on script termination (success or failure)
+# ------------------------------------------------------------------------------
+on_exit() {
+  local exit_code=$?
+  [[ -n "${lockfile:-}" && -e "$lockfile" ]] && rm -f "$lockfile"
+  exit "$exit_code"
+}
+
+# ------------------------------------------------------------------------------
+# on_interrupt()
+#
+# - SIGINT (Ctrl+C) trap handler
+# - Displays "Interrupted by user" message
+# - Exits with code 130 (128 + SIGINT=2)
+# ------------------------------------------------------------------------------
+on_interrupt() {
+  if declare -f msg_error >/dev/null 2>&1; then
+    msg_error "Interrupted by user (SIGINT)"
+  else
+    echo -e "\n${RD}Interrupted by user (SIGINT)${CL}"
+  fi
+  exit 130
+}
+
+# ------------------------------------------------------------------------------
+# on_terminate()
+#
+# - SIGTERM trap handler
+# - Displays "Terminated by signal" message
+# - Exits with code 143 (128 + SIGTERM=15)
+# - Triggered by external process termination
+# ------------------------------------------------------------------------------
+on_terminate() {
+  if declare -f msg_error >/dev/null 2>&1; then
+    msg_error "Terminated by signal (SIGTERM)"
+  else
+    echo -e "\n${RD}Terminated by signal (SIGTERM)${CL}"
+  fi
+  exit 143
+}
+
+# ==============================================================================
+# SECTION 4: INITIALIZATION
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# catch_errors()
+#
+# - Initializes error handling and signal traps
+# - Enables strict error handling:
+#   * set -Ee: Exit on error, inherit ERR trap in functions
+#   * set -o pipefail: Pipeline fails if any command fails
+#   * set -u: (optional) Exit on undefined variable (if STRICT_UNSET=1)
+# - Sets up traps:
+#   * ERR → error_handler
+#   * EXIT → on_exit
+#   * INT → on_interrupt
+#   * TERM → on_terminate
+# - Call this function early in every script
+# ------------------------------------------------------------------------------
+catch_errors() {
+  set -Ee -o pipefail
+  if [ "${STRICT_UNSET:-0}" = "1" ]; then
+    set -u
+  fi
+
+  trap 'error_handler' ERR
+  trap on_exit EXIT
+  trap on_interrupt INT
+  trap on_terminate TERM
+}

scripts/core/install.func

@@ -1,50 +1,91 @@
-# Copyright (c) 2021-2025 michelroegl-brunner
+# Copyright (c) 2021-2026 community-scripts ORG
-# Author: michelroegl-brunner
+# Author: tteck (tteckster)
-# License: MIT
+# Co-Author: MickLesk
-# https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+
+# ==============================================================================
+# INSTALL.FUNC - CONTAINER INSTALLATION & SETUP
+# ==============================================================================
+#
+# This file provides installation functions executed inside LXC containers
+# after creation. Handles:
+#
+#   - Network connectivity verification (IPv4/IPv6)
+#   - OS updates and package installation
+#   - DNS resolution checks
+#   - MOTD and SSH configuration
+#   - Container customization and auto-login
+#
+# Usage:
+#   - Sourced by <app>-install.sh scripts
+#   - Executes via pct exec inside container
+#   - Requires internet connectivity
+#
+# ==============================================================================
+
+# ==============================================================================
+# SECTION 1: INITIALIZATION
+# ==============================================================================
 
 if ! command -v curl >/dev/null 2>&1; then
   printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
-  apt-get update >/dev/null 2>&1
+  apt update >/dev/null 2>&1
-  apt-get install -y curl >/dev/null 2>&1
+  apt install -y curl >/dev/null 2>&1
 fi
-# core.func is included in FUNCTIONS_FILE_PATH
+source "$(dirname "${BASH_SOURCE[0]}")/core.func"
+source "$(dirname "${BASH_SOURCE[0]}")/error-handler.func"
 load_functions
-# This function enables IPv6 if it's not disabled and sets verbose mode
+catch_errors
+
+# Get LXC IP address (must be called INSIDE container, after network is up)
+get_lxc_ip
+
+# ==============================================================================
+# SECTION 2: NETWORK & CONNECTIVITY
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# verb_ip6()
+#
+# - Configures IPv6 based on DISABLEIPV6 variable
+# - If DISABLEIPV6=yes: disables IPv6 via sysctl
+# - Sets verbose mode via set_std_mode()
+# ------------------------------------------------------------------------------
 verb_ip6() {
   set_std_mode # Set STD mode based on VERBOSE
 
-  if [ "$DISABLEIPV6" == "yes" ]; then
+  if [ "${IPV6_METHOD:-}" = "disable" ]; then
-    echo "net.ipv6.conf.all.disable_ipv6 = 1" >>/etc/sysctl.conf
+    msg_info "Disabling IPv6 (this may affect some services)"
-    $STD sysctl -p
+    mkdir -p /etc/sysctl.d
+    $STD tee /etc/sysctl.d/99-disable-ipv6.conf >/dev/null <<EOF
+# Disable IPv6 (set by community-scripts)
+net.ipv6.conf.all.disable_ipv6 = 1
+net.ipv6.conf.default.disable_ipv6 = 1
+net.ipv6.conf.lo.disable_ipv6 = 1
+EOF
+    $STD sysctl -p /etc/sysctl.d/99-disable-ipv6.conf
+    msg_ok "Disabled IPv6"
   fi
 }
 
-# This function sets error handling options and defines the error_handler function to handle errors
+# ------------------------------------------------------------------------------
-catch_errors() {
+# setting_up_container()
-  set -Eeuo pipefail
+#
-  trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
+# - Verifies network connectivity via hostname -I
-}
+# - Retries up to RETRY_NUM times with RETRY_EVERY seconds delay
-
+# - Removes Python EXTERNALLY-MANAGED restrictions
-# This function handles errors
+# - Disables systemd-networkd-wait-online.service for faster boot
-error_handler() {
+# - Exits with error if network unavailable after retries
-  printf "\e[?25h"
+# ------------------------------------------------------------------------------
-  local exit_code="$?"
-  local line_number="$1"
-  local command="$2"
-  local error_message="${RD}[ERROR]${CL} in line ${RD}$line_number${CL}: exit code ${RD}$exit_code${CL}: while executing command ${YW}$command${CL}"
-  echo -e "\n$error_message"
-  if [[ "$line_number" -eq 51 ]]; then
-    echo -e "The silent function has suppressed the error, run the script with verbose mode enabled, which will provide more detailed output.\n"
-    post_update_to_api "failed" "No error message, script ran in silent mode"
-  else
-    post_update_to_api "failed" "${command}"
-  fi
-}
-
-# This function sets up the Container OS by generating the locale, setting the timezone, and checking the network connection
 setting_up_container() {
   msg_info "Setting up Container OS"
+
+  # Fix Debian 13 LXC template bug where / is owned by nobody
+  # Only attempt in privileged containers (unprivileged cannot chown /)
+  if [[ "$(stat -c '%U' /)" != "root" ]]; then
+    (chown root:root / 2>/dev/null) || true
+  fi
+
   for ((i = RETRY_NUM; i > 0; i--)); do
     if [ "$(hostname -I)" != "" ]; then
       break
@@ -64,8 +105,17 @@ setting_up_container() {
   msg_ok "Network Connected: ${BL}$(hostname -I)"
 }
 
-# This function checks the network connection by pinging a known IP address and prompts the user to continue if the internet is not connected
+# ------------------------------------------------------------------------------
-# This function checks the network connection by pinging a known IP address and prompts the user to continue if the internet is not connected
+# network_check()
+#
+# - Comprehensive network connectivity check for IPv4 and IPv6
+# - Tests connectivity to multiple DNS servers:
+#   * IPv4: 1.1.1.1 (Cloudflare), 8.8.8.8 (Google), 9.9.9.9 (Quad9)
+#   * IPv6: 2606:4700:4700::1111, 2001:4860:4860::8888, 2620:fe::fe
+# - Verifies DNS resolution for GitHub and Community-Scripts domains
+# - Prompts user to continue if no internet detected
+# - Uses fatal() on DNS resolution failure for critical hosts
+# ------------------------------------------------------------------------------
 network_check() {
   set +e
   trap - ERR
@@ -125,7 +175,19 @@ network_check() {
   trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 }
 
-# This function updates the Container OS by running apt-get update and upgrade
+# ==============================================================================
+# SECTION 3: OS UPDATE & PACKAGE MANAGEMENT
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# update_os()
+#
+# - Updates container OS via apt-get update and dist-upgrade
+# - Configures APT cacher proxy if CACHER=yes (accelerates package downloads)
+# - Removes Python EXTERNALLY-MANAGED restrictions for pip
+# - Sources tools.func for additional setup functions after update
+# - Uses $STD wrapper to suppress output unless VERBOSE=yes
+# ------------------------------------------------------------------------------
 update_os() {
   msg_info "Updating Container OS"
   if [[ "$CACHER" == "yes" ]]; then
@@ -145,29 +207,37 @@ EOF
   rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED
   msg_ok "Updated Container OS"
 
-  # tools.func is included in FUNCTIONS_FILE_PATH
+  source "$(dirname "${BASH_SOURCE[0]}")/tools.func"
 }
 
-# This function modifies the message of the day (motd) and SSH settings
+# ==============================================================================
+# SECTION 4: MOTD & SSH CONFIGURATION
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# motd_ssh()
+#
+# - Configures Message of the Day (MOTD) with container information
+# - Creates /etc/profile.d/00_lxc-details.sh with:
+#   * Application name
+#   * Warning banner (DEV repository)
+#   * OS name and version
+#   * Hostname and IP address
+#   * GitHub repository link
+# - Disables executable flag on /etc/update-motd.d/* scripts
+# - Enables root SSH access if SSH_ROOT=yes
+# - Configures TERM environment variable for better terminal support
+# ------------------------------------------------------------------------------
 motd_ssh() {
   # Set terminal to 256-color mode
   grep -qxF "export TERM='xterm-256color'" /root/.bashrc || echo "export TERM='xterm-256color'" >>/root/.bashrc
 
-  # Get OS information (Debian / Ubuntu)
-  if [ -f "/etc/os-release" ]; then
-    OS_NAME=$(grep ^NAME /etc/os-release | cut -d= -f2 | tr -d '"')
-    OS_VERSION=$(grep ^VERSION_ID /etc/os-release | cut -d= -f2 | tr -d '"')
-  elif [ -f "/etc/debian_version" ]; then
-    OS_NAME="Debian"
-    OS_VERSION=$(cat /etc/debian_version)
-  fi
-
   PROFILE_FILE="/etc/profile.d/00_lxc-details.sh"
   echo "echo -e \"\"" >"$PROFILE_FILE"
   echo -e "echo -e \"${BOLD}${APPLICATION} LXC Container${CL}"\" >>"$PROFILE_FILE"
   echo -e "echo -e \"${TAB}${GATEWAY}${YW} Provided by: ${GN}community-scripts ORG ${YW}| GitHub: ${GN}https://github.com/community-scripts/ProxmoxVE${CL}\"" >>"$PROFILE_FILE"
   echo "echo \"\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${TAB}${OS}${YW} OS: ${GN}${OS_NAME} - Version: ${OS_VERSION}${CL}\"" >>"$PROFILE_FILE"
+  echo -e "echo -e \"${TAB}${OS}${YW} OS: ${GN}\$(grep ^NAME /etc/os-release | cut -d= -f2 | tr -d '\"') - Version: \$(grep ^VERSION_ID /etc/os-release | cut -d= -f2 | tr -d '\"')${CL}\"" >>"$PROFILE_FILE"
   echo -e "echo -e \"${TAB}${HOSTNAME}${YW} Hostname: ${GN}\$(hostname)${CL}\"" >>"$PROFILE_FILE"
   echo -e "echo -e \"${TAB}${INFO}${YW} IP Address: ${GN}\$(hostname -I | awk '{print \$1}')${CL}\"" >>"$PROFILE_FILE"
 
@@ -180,7 +250,19 @@ motd_ssh() {
   fi
 }
 
-# This function customizes the container by modifying the getty service and enabling auto-login for the root user
+# ==============================================================================
+# SECTION 5: CONTAINER CUSTOMIZATION
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# customize()
+#
+# - Customizes container for passwordless root login if PASSWORD is empty
+# - Configures getty for auto-login via /etc/systemd/system/container-getty@1.service.d/override.conf
+# - Creates /usr/bin/update script for easy application updates
+# - Injects SSH authorized keys if SSH_AUTHORIZED_KEY variable is set
+# - Sets proper permissions on SSH directories and key files
+# ------------------------------------------------------------------------------
 customize() {
   if [[ "$PASSWORD" == "" ]]; then
     msg_info "Customizing Container"

scripts/ct/debian.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+SCRIPT_DIR="$(dirname "$0")" 
+source "$SCRIPT_DIR/../core/build.func"
+# Copyright (c) 2021-2026 tteck
+# Author: tteck (tteckster)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.debian.org/
+
+APP="Debian"
+var_tags="${var_tags:-os}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-2}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -d /var ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  msg_info "Updating $APP LXC"
+  $STD apt update
+  $STD apt -y upgrade
+  msg_ok "Updated $APP LXC"
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"

scripts/install/debian-install.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 tteck
+# Author: tteck (tteckster)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.debian.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+motd_ssh
+customize
+cleanup_lxc

server.js

@@ -3,6 +3,7 @@ import { parse } from 'url';
 import next from 'next';
 import { WebSocketServer } from 'ws';
 import { spawn } from 'child_process';
+import { existsSync } from 'fs';
 import { join, resolve } from 'path';
 import stripAnsi from 'strip-ansi';
 import { spawn as ptySpawn } from 'node-pty';
@@ -56,6 +57,8 @@ const handle = app.getRequestHandler();
  * @property {string} user
  * @property {string} password
  * @property {number} [id]
+ * @property {string} [auth_type]
+ * @property {string} [ssh_key_path]
  */
 
 /**
@@ -75,9 +78,14 @@ const handle = app.getRequestHandler();
  * @property {boolean} [isUpdate]
  * @property {boolean} [isShell]
  * @property {boolean} [isBackup]
+ * @property {boolean} [isClone]
  * @property {string} [containerId]
  * @property {string} [storage]
  * @property {string} [backupStorage]
+ * @property {number} [cloneCount]
+ * @property {string[]} [hostnames]
+ * @property {'lxc'|'vm'} [containerType]
+ * @property {Record<string, string|number|boolean>} [envVars]
  */
 
 class ScriptExecutionHandler {
@@ -290,24 +298,45 @@ class ScriptExecutionHandler {
     });
   }
 
+  /**
+   * Resolve full server from DB when client sends server with id but no ssh_key_path (e.g. for Shell/Update over SSH).
+   * @param {ServerInfo|null} server - Server from WebSocket message
+   * @returns {Promise<ServerInfo|null>} Same server or full server from DB
+   */
+  async resolveServerForSSH(server) {
+    if (!server?.id) return server;
+    if (server.auth_type === 'key' && (!server.ssh_key_path || !existsSync(server.ssh_key_path))) {
+      const full = await this.db.getServerById(server.id);
+      return /** @type {ServerInfo|null} */ (full ?? server);
+    }
+    return server;
+  }
+
   /**
    * @param {ExtendedWebSocket} ws
    * @param {WebSocketMessage} message
    */
   async handleMessage(ws, message) {
-    const { action, scriptPath, executionId, input, mode, server, isUpdate, isShell, isBackup, containerId, storage, backupStorage } = message;
+    const { action, scriptPath, executionId, input, mode, server, isUpdate, isShell, isBackup, isClone, containerId, storage, backupStorage, cloneCount, hostnames, containerType, envVars } = message;
 
     switch (action) {
       case 'start':
         if (scriptPath && executionId) {
-          if (isBackup && containerId && storage) {
+          let serverToUse = server;
-            await this.startBackupExecution(ws, containerId, executionId, storage, mode, server);
+          if (serverToUse?.id) {
+            serverToUse = await this.resolveServerForSSH(serverToUse) ?? serverToUse;
+          }
+          const resolved = serverToUse ?? server;
+          if (isClone && containerId && storage && server && cloneCount && hostnames && containerType) {
+            await this.startSSHCloneExecution(ws, containerId, executionId, storage, /** @type {ServerInfo} */ (resolved), containerType, cloneCount, hostnames);
+          } else if (isBackup && containerId && storage) {
+            await this.startBackupExecution(ws, containerId, executionId, storage, mode, resolved);
           } else if (isUpdate && containerId) {
-            await this.startUpdateExecution(ws, containerId, executionId, mode, server, backupStorage);
+            await this.startUpdateExecution(ws, containerId, executionId, mode, resolved, backupStorage);
           } else if (isShell && containerId) {
-            await this.startShellExecution(ws, containerId, executionId, mode, server);
+            await this.startShellExecution(ws, containerId, executionId, mode, resolved, containerType);
           } else {
-            await this.startScriptExecution(ws, scriptPath, executionId, mode, server);
+            await this.startScriptExecution(ws, scriptPath, executionId, mode, resolved, envVars);
           }
         } else {
           this.sendMessage(ws, {
@@ -345,8 +374,9 @@ class ScriptExecutionHandler {
    * @param {string} executionId
    * @param {string} mode
    * @param {ServerInfo|null} server
+   * @param {Object} [envVars] - Optional environment variables to pass to the script
    */
-  async startScriptExecution(ws, scriptPath, executionId, mode = 'local', server = null) {
+  async startScriptExecution(ws, scriptPath, executionId, mode = 'local', server = null, envVars = {}) {
     /** @type {number|null} */
     let installationId = null;
     
@@ -375,7 +405,7 @@ class ScriptExecutionHandler {
 
       // Handle SSH execution
       if (mode === 'ssh' && server) {
-        await this.startSSHScriptExecution(ws, scriptPath, executionId, server, installationId);
+        await this.startSSHScriptExecution(ws, scriptPath, executionId, server, installationId, envVars);
         return;
       }
       
@@ -401,19 +431,32 @@ class ScriptExecutionHandler {
         return;
       }
 
+      // Format environment variables for local execution
+      // Convert envVars object to environment variables
+      const envWithVars = {
+        ...process.env,
+        TERM: 'xterm-256color', // Enable proper terminal support
+        FORCE_ANSI: 'true', // Allow ANSI codes for proper display
+        COLUMNS: '80', // Set terminal width
+        LINES: '24' // Set terminal height
+      };
+
+      // Add envVars to environment
+      if (envVars && typeof envVars === 'object') {
+        for (const [key, value] of Object.entries(envVars)) {
+          /** @type {Record<string, string>} */
+          const envRecord = envWithVars;
+          envRecord[key] = String(value);
+        }
+      }
+
       // Start script execution with pty for proper TTY support
       const childProcess = ptySpawn('bash', [resolvedPath], {
         cwd: scriptsDir,
         name: 'xterm-256color',
         cols: 80,
         rows: 24,
-        env: {
+        env: envWithVars
-          ...process.env,
-          TERM: 'xterm-256color', // Enable proper terminal support
-          FORCE_ANSI: 'true', // Allow ANSI codes for proper display
-          COLUMNS: '80', // Set terminal width
-          LINES: '24' // Set terminal height
-        }
       });
 
       // pty handles encoding automatically
@@ -516,8 +559,9 @@ class ScriptExecutionHandler {
    * @param {string} executionId
    * @param {ServerInfo} server
    * @param {number|null} installationId
+   * @param {Object} [envVars] - Optional environment variables to pass to the script
    */
-  async startSSHScriptExecution(ws, scriptPath, executionId, server, installationId = null) {
+  async startSSHScriptExecution(ws, scriptPath, executionId, server, installationId = null, envVars = {}) {
     const sshService = getSSHExecutionService();
 
     // Send start message
@@ -606,7 +650,8 @@ class ScriptExecutionHandler {
           
           // Clean up
           this.activeExecutions.delete(executionId);
-        }
+        },
+        envVars
       ));
 
       // Store the execution with installation ID
@@ -832,6 +877,423 @@ class ScriptExecutionHandler {
     });
   }
 
+  /**
+   * Start SSH clone execution
+   * Gets next IDs sequentially: get next ID → clone → get next ID → clone, etc.
+   * @param {ExtendedWebSocket} ws
+   * @param {string} containerId
+   * @param {string} executionId
+   * @param {string} storage
+   * @param {ServerInfo} server
+   * @param {'lxc'|'vm'} containerType
+   * @param {number} cloneCount
+   * @param {string[]} hostnames
+   */
+  async startSSHCloneExecution(ws, containerId, executionId, storage, server, containerType, cloneCount, hostnames) {
+    const sshService = getSSHExecutionService();
+    
+    this.sendMessage(ws, {
+      type: 'start',
+      data: `Starting clone operation: Creating ${cloneCount} clone(s) of ${containerType.toUpperCase()} ${containerId}...`,
+      timestamp: Date.now()
+    });
+
+    try {
+      // Step 1: Stop source container/VM
+      this.sendMessage(ws, {
+        type: 'output',
+        data: `\n[Step 1/${4 + cloneCount}] Stopping source ${containerType.toUpperCase()} ${containerId}...\n`,
+        timestamp: Date.now()
+      });
+
+      const stopCommand = containerType === 'lxc' ? `pct stop ${containerId}` : `qm stop ${containerId}`;
+      await new Promise(/** @type {(resolve: (value?: void) => void, reject: (error?: any) => void) => void} */ ((resolve, reject) => {
+        sshService.executeCommand(
+          server,
+          stopCommand,
+          /** @param {string} data */
+          (data) => {
+            this.sendMessage(ws, {
+              type: 'output',
+              data: data,
+              timestamp: Date.now()
+            });
+          },
+          /** @param {string} error */
+          (error) => {
+            this.sendMessage(ws, {
+              type: 'error',
+              data: error,
+              timestamp: Date.now()
+            });
+          },
+          /** @param {number} code */
+          (code) => {
+            if (code === 0) {
+              this.sendMessage(ws, {
+                type: 'output',
+                data: `\n[Step 1/${4 + cloneCount}] Source ${containerType.toUpperCase()} stopped successfully.\n`,
+                timestamp: Date.now()
+              });
+              resolve();
+            } else {
+              // Continue even if stop fails (might already be stopped)
+              this.sendMessage(ws, {
+                type: 'output',
+                data: `\n[Step 1/${4 + cloneCount}] Stop command completed with exit code ${code} (container may already be stopped).\n`,
+                timestamp: Date.now()
+              });
+              resolve();
+            }
+          }
+        );
+      }));
+
+      // Step 2: Clone for each clone count (get next ID sequentially before each clone)
+      const clonedIds = [];
+      for (let i = 0; i < cloneCount; i++) {
+        const cloneNumber = i + 1;
+        const hostname = hostnames[i];
+
+        // Get next ID for this clone
+        this.sendMessage(ws, {
+          type: 'output',
+          data: `\n[Step ${2 + i}/${4 + cloneCount}] Getting next available ID for clone ${cloneNumber}...\n`,
+          timestamp: Date.now()
+        });
+
+        let nextId = '';
+        try {
+          let output = '';
+          await new Promise(/** @type {(resolve: (value?: void) => void, reject: (error?: any) => void) => void} */ ((resolve, reject) => {
+            sshService.executeCommand(
+              server,
+              'pvesh get /cluster/nextid',
+              /** @param {string} data */
+              (data) => {
+                output += data;
+              },
+              /** @param {string} error */
+              (error) => {
+                reject(new Error(`Failed to get next ID: ${error}`));
+              },
+              /** @param {number} exitCode */
+              (exitCode) => {
+                if (exitCode === 0) {
+                  resolve();
+                } else {
+                  reject(new Error(`pvesh command failed with exit code ${exitCode}`));
+                }
+              }
+            );
+          }));
+
+          nextId = output.trim();
+          if (!nextId || !/^\d+$/.test(nextId)) {
+            throw new Error('Invalid next ID received');
+          }
+
+          this.sendMessage(ws, {
+            type: 'output',
+            data: `\n[Step ${2 + i}/${4 + cloneCount}] Got next ID: ${nextId}\n`,
+            timestamp: Date.now()
+          });
+        } catch (error) {
+          this.sendMessage(ws, {
+            type: 'error',
+            data: `\n[Step ${2 + i}/${4 + cloneCount}] Failed to get next ID: ${error instanceof Error ? error.message : String(error)}\n`,
+            timestamp: Date.now()
+          });
+          throw error;
+        }
+
+        clonedIds.push(nextId);
+
+        // Clone the container/VM
+        this.sendMessage(ws, {
+          type: 'output',
+          data: `\n[Step ${2 + i}/${4 + cloneCount}] Cloning ${containerType.toUpperCase()} ${containerId} to ${nextId} with hostname ${hostname}...\n`,
+          timestamp: Date.now()
+        });
+
+        const cloneCommand = containerType === 'lxc'
+          ? `pct clone ${containerId} ${nextId} --hostname ${hostname} --storage ${storage}`
+          : `qm clone ${containerId} ${nextId} --name ${hostname} --storage ${storage}`;
+
+        await new Promise(/** @type {(resolve: (value?: void) => void, reject: (error?: any) => void) => void} */ ((resolve, reject) => {
+          sshService.executeCommand(
+            server,
+            cloneCommand,
+            /** @param {string} data */
+            (data) => {
+              this.sendMessage(ws, {
+                type: 'output',
+                data: data,
+                timestamp: Date.now()
+              });
+            },
+            /** @param {string} error */
+            (error) => {
+              this.sendMessage(ws, {
+                type: 'error',
+                data: error,
+                timestamp: Date.now()
+              });
+            },
+            /** @param {number} code */
+            (code) => {
+              if (code === 0) {
+                this.sendMessage(ws, {
+                  type: 'output',
+                  data: `\n[Step ${2 + i}/${4 + cloneCount}] Clone ${cloneNumber} created successfully.\n`,
+                  timestamp: Date.now()
+                });
+                resolve();
+              } else {
+                this.sendMessage(ws, {
+                  type: 'error',
+                  data: `\nClone ${cloneNumber} failed with exit code: ${code}\n`,
+                  timestamp: Date.now()
+                });
+                reject(new Error(`Clone ${cloneNumber} failed with exit code ${code}`));
+              }
+            }
+          );
+        }));
+      }
+
+      // Step 3: Start source container/VM
+      this.sendMessage(ws, {
+        type: 'output',
+        data: `\n[Step ${2 + cloneCount + 1}/${4 + cloneCount}] Starting source ${containerType.toUpperCase()} ${containerId}...\n`,
+        timestamp: Date.now()
+      });
+
+      const startSourceCommand = containerType === 'lxc' ? `pct start ${containerId}` : `qm start ${containerId}`;
+      await new Promise(/** @type {(resolve: (value?: void) => void, reject: (error?: any) => void) => void} */ ((resolve) => {
+        sshService.executeCommand(
+          server,
+          startSourceCommand,
+          /** @param {string} data */
+          (data) => {
+            this.sendMessage(ws, {
+              type: 'output',
+              data: data,
+              timestamp: Date.now()
+            });
+          },
+          /** @param {string} error */
+          (error) => {
+            this.sendMessage(ws, {
+              type: 'error',
+              data: error,
+              timestamp: Date.now()
+            });
+          },
+          /** @param {number} code */
+          (code) => {
+            if (code === 0) {
+              this.sendMessage(ws, {
+                type: 'output',
+                data: `\n[Step ${2 + cloneCount + 1}/${4 + cloneCount}] Source ${containerType.toUpperCase()} started successfully.\n`,
+                timestamp: Date.now()
+              });
+            } else {
+              this.sendMessage(ws, {
+                type: 'output',
+                data: `\n[Step ${2 + cloneCount + 1}/${4 + cloneCount}] Start command completed with exit code ${code}.\n`,
+                timestamp: Date.now()
+              });
+            }
+            resolve();
+          }
+        );
+      }));
+
+      // Step 4: Start target containers/VMs
+      this.sendMessage(ws, {
+        type: 'output',
+        data: `\n[Step ${2 + cloneCount + 2}/${4 + cloneCount}] Starting cloned ${containerType.toUpperCase()}(s)...\n`,
+        timestamp: Date.now()
+      });
+
+      for (let i = 0; i < cloneCount; i++) {
+        const cloneNumber = i + 1;
+        const nextId = clonedIds[i];
+
+        const startTargetCommand = containerType === 'lxc' ? `pct start ${nextId}` : `qm start ${nextId}`;
+        await new Promise(/** @type {(resolve: (value?: void) => void, reject: (error?: any) => void) => void} */ ((resolve) => {
+          sshService.executeCommand(
+            server,
+            startTargetCommand,
+            /** @param {string} data */
+            (data) => {
+              this.sendMessage(ws, {
+                type: 'output',
+                data: data,
+                timestamp: Date.now()
+              });
+            },
+            /** @param {string} error */
+            (error) => {
+              this.sendMessage(ws, {
+                type: 'error',
+                data: error,
+                timestamp: Date.now()
+              });
+            },
+            /** @param {number} code */
+            (code) => {
+              if (code === 0) {
+                this.sendMessage(ws, {
+                  type: 'output',
+                  data: `\nClone ${cloneNumber} (ID: ${nextId}) started successfully.\n`,
+                  timestamp: Date.now()
+                });
+              } else {
+                this.sendMessage(ws, {
+                  type: 'output',
+                  data: `\nClone ${cloneNumber} (ID: ${nextId}) start completed with exit code ${code}.\n`,
+                  timestamp: Date.now()
+                });
+              }
+              resolve();
+            }
+          );
+        }));
+      }
+
+      // Step 5: Add to database
+      this.sendMessage(ws, {
+        type: 'output',
+        data: `\n[Step ${2 + cloneCount + 3}/${4 + cloneCount}] Adding cloned ${containerType.toUpperCase()}(s) to database...\n`,
+        timestamp: Date.now()
+      });
+
+      for (let i = 0; i < cloneCount; i++) {
+        const nextId = clonedIds[i];
+        const hostname = hostnames[i];
+        
+        try {
+          // Read config file to get hostname/name (node-specific path)
+          const nodeName = server.name;
+          const configPath = containerType === 'lxc' 
+            ? `/etc/pve/nodes/${nodeName}/lxc/${nextId}.conf`
+            : `/etc/pve/nodes/${nodeName}/qemu-server/${nextId}.conf`;
+          
+          let configContent = '';
+          await new Promise(/** @type {(resolve: (value?: void) => void) => void} */ ((resolve) => {
+            sshService.executeCommand(
+              server,
+              `cat "${configPath}" 2>/dev/null || echo ""`,
+              /** @param {string} data */
+              (data) => {
+                configContent += data;
+              },
+              () => resolve(),
+              () => resolve()
+            );
+          }));
+
+          // Parse config for hostname/name
+          let finalHostname = hostname;
+          if (configContent.trim()) {
+            const lines = configContent.split('\n');
+            for (const line of lines) {
+              const trimmed = line.trim();
+              if (containerType === 'lxc' && trimmed.startsWith('hostname:')) {
+                finalHostname = trimmed.substring(9).trim();
+                break;
+              } else if (containerType === 'vm' && trimmed.startsWith('name:')) {
+                finalHostname = trimmed.substring(5).trim();
+                break;
+              }
+            }
+          }
+
+          if (!finalHostname) {
+            finalHostname = `${containerType}-${nextId}`;
+          }
+
+          // Create installed script record
+          const script = await this.db.createInstalledScript({
+            script_name: finalHostname,
+            script_path: `cloned/${finalHostname}`,
+            container_id: nextId,
+            server_id: server.id,
+            execution_mode: 'ssh',
+            status: 'success',
+            output_log: `Cloned ${containerType.toUpperCase()}`
+          });
+
+          // For LXC, store config in database
+          if (containerType === 'lxc' && configContent.trim()) {
+            // Simple config parser
+            /** @type {any} */
+            const configData = {};
+            const lines = configContent.split('\n');
+            for (const line of lines) {
+              const trimmed = line.trim();
+              if (!trimmed || trimmed.startsWith('#')) continue;
+              
+              const [key, ...valueParts] = trimmed.split(':');
+              const value = valueParts.join(':').trim();
+              
+              if (key === 'hostname') configData.hostname = value;
+              else if (key === 'arch') configData.arch = value;
+              else if (key === 'cores') configData.cores = parseInt(value) || null;
+              else if (key === 'memory') configData.memory = parseInt(value) || null;
+              else if (key === 'swap') configData.swap = parseInt(value) || null;
+              else if (key === 'onboot') configData.onboot = parseInt(value) || null;
+              else if (key === 'ostype') configData.ostype = value;
+              else if (key === 'unprivileged') configData.unprivileged = parseInt(value) || null;
+              else if (key === 'tags') configData.tags = value;
+              else if (key === 'rootfs') {
+                const match = value.match(/^([^:]+):([^,]+)/);
+                if (match) {
+                  configData.rootfs_storage = match[1];
+                  const sizeMatch = value.match(/size=([^,]+)/);
+                  if (sizeMatch) {
+                    configData.rootfs_size = sizeMatch[1];
+                  }
+                }
+              }
+            }
+            
+            await this.db.createLXCConfig(script.id, configData);
+          }
+
+          this.sendMessage(ws, {
+            type: 'output',
+            data: `\nClone ${i + 1} (ID: ${nextId}, Hostname: ${finalHostname}) added to database successfully.\n`,
+            timestamp: Date.now()
+          });
+        } catch (error) {
+          this.sendMessage(ws, {
+            type: 'error',
+            data: `\nError adding clone ${i + 1} (ID: ${nextId}) to database: ${error instanceof Error ? error.message : String(error)}\n`,
+            timestamp: Date.now()
+          });
+        }
+      }
+
+      this.sendMessage(ws, {
+        type: 'output',
+        data: `\n\n[Clone operation completed successfully!]\nCreated ${cloneCount} clone(s) of ${containerType.toUpperCase()} ${containerId}.\n`,
+        timestamp: Date.now()
+      });
+
+      this.activeExecutions.delete(executionId);
+    } catch (error) {
+      this.sendMessage(ws, {
+        type: 'error',
+        data: `\n\n[Clone operation failed!]\nError: ${error instanceof Error ? error.message : String(error)}\n`,
+        timestamp: Date.now()
+      });
+      this.activeExecutions.delete(executionId);
+    }
+  }
+
   /**
    * Start update execution (pct enter + update command)
    * @param {ExtendedWebSocket} ws
@@ -1035,21 +1497,21 @@ class ScriptExecutionHandler {
    * @param {string} executionId
    * @param {string} mode
    * @param {ServerInfo|null} server
+   * @param {'lxc'|'vm'} [containerType='lxc']
    */
-  async startShellExecution(ws, containerId, executionId, mode = 'local', server = null) {
+  async startShellExecution(ws, containerId, executionId, mode = 'local', server = null, containerType = 'lxc') {
     try {
-      
+      const typeLabel = containerType === 'vm' ? 'VM' : 'container';
-      // Send start message
       this.sendMessage(ws, {
         type: 'start',
-        data: `Starting shell session for container ${containerId}...`,
+        data: `Starting shell session for ${typeLabel} ${containerId}...`,
         timestamp: Date.now()
       });
 
       if (mode === 'ssh' && server) {
-        await this.startSSHShellExecution(ws, containerId, executionId, server);
+        await this.startSSHShellExecution(ws, containerId, executionId, server, containerType);
       } else {
-        await this.startLocalShellExecution(ws, containerId, executionId);
+        await this.startLocalShellExecution(ws, containerId, executionId, containerType);
       }
 
     } catch (error) {
@@ -1066,12 +1528,12 @@ class ScriptExecutionHandler {
    * @param {ExtendedWebSocket} ws
    * @param {string} containerId
    * @param {string} executionId
+   * @param {'lxc'|'vm'} [containerType='lxc']
    */
-  async startLocalShellExecution(ws, containerId, executionId) {
+  async startLocalShellExecution(ws, containerId, executionId, containerType = 'lxc') {
     const { spawn } = await import('node-pty');
-    
+    const shellCommand = containerType === 'vm' ? `qm terminal ${containerId}` : `pct enter ${containerId}`;
-    // Create a shell process that will run pct enter
+    const childProcess = spawn('bash', ['-c', shellCommand], {
-    const childProcess = spawn('bash', ['-c', `pct enter ${containerId}`], {
       name: 'xterm-color',
       cols: 80,
       rows: 24,
@@ -1114,14 +1576,15 @@ class ScriptExecutionHandler {
    * @param {string} containerId
    * @param {string} executionId
    * @param {ServerInfo} server
+   * @param {'lxc'|'vm'} [containerType='lxc']
    */
-  async startSSHShellExecution(ws, containerId, executionId, server) {
+  async startSSHShellExecution(ws, containerId, executionId, server, containerType = 'lxc') {
     const sshService = getSSHExecutionService();
-    
+    const shellCommand = containerType === 'vm' ? `qm terminal ${containerId}` : `pct enter ${containerId}`;
     try {
       const execution = await sshService.executeCommand(
         server,
-        `pct enter ${containerId}`,
+        shellCommand,
         /** @param {string} data */
         (data) => {
           this.sendMessage(ws, {
@@ -1171,6 +1634,7 @@ class ScriptExecutionHandler {
 // TerminalHandler removed - not used by current application
 
 app.prepare().then(() => {
+  console.log('> Next.js app prepared successfully');
   const httpServer = createServer(async (req, res) => {
     try {
       // Be sure to pass `true` as the second argument to `url.parse`.
@@ -1276,4 +1740,9 @@ app.prepare().then(() => {
         autoSyncModule.setupGracefulShutdown();
       }
     });
+}).catch((err) => {
+  console.error('> Failed to start server:', err.message);
+  console.error('> If you see "Could not find a production build", run: npm run build');
+  console.error('> Full error:', err);
+  process.exit(1);
 });

src/app/_components/CloneCountInputModal.tsx

@@ -0,0 +1,129 @@
+'use client';
+
+import { useState, useEffect } from 'react';
+import { Button } from './ui/button';
+import { Input } from './ui/input';
+import { Copy, X } from 'lucide-react';
+import { useRegisterModal } from './modal/ModalStackProvider';
+
+interface CloneCountInputModalProps {
+  isOpen: boolean;
+  onClose: () => void;
+  onSubmit: (count: number) => void;
+  storageName: string;
+}
+
+export function CloneCountInputModal({
+  isOpen,
+  onClose,
+  onSubmit,
+  storageName
+}: CloneCountInputModalProps) {
+  const [cloneCount, setCloneCount] = useState<number>(1);
+  
+  useRegisterModal(isOpen, { id: 'clone-count-input-modal', allowEscape: true, onClose });
+
+  useEffect(() => {
+    if (isOpen) {
+      setCloneCount(1); // Reset to default when modal opens
+    }
+  }, [isOpen]);
+
+  if (!isOpen) return null;
+
+  const handleSubmit = () => {
+    if (cloneCount >= 1) {
+      onSubmit(cloneCount);
+      setCloneCount(1); // Reset after submit
+    }
+  };
+
+  const handleClose = () => {
+    setCloneCount(1); // Reset on close
+    onClose();
+  };
+
+  return (
+    <div className="fixed inset-0 backdrop-blur-sm bg-black/50 flex items-center justify-center z-50 p-4">
+      <div className="bg-card rounded-lg shadow-xl max-w-md w-full border border-border">
+        {/* Header */}
+        <div className="flex items-center justify-between p-6 border-b border-border">
+          <div className="flex items-center gap-3">
+            <Copy className="h-6 w-6 text-primary" />
+            <h2 className="text-2xl font-bold text-card-foreground">Clone Count</h2>
+          </div>
+          <Button
+            onClick={handleClose}
+            variant="ghost"
+            size="icon"
+            className="text-muted-foreground hover:text-foreground"
+          >
+            <X className="h-5 w-5" />
+          </Button>
+        </div>
+
+        {/* Content */}
+        <div className="p-6">
+          <p className="text-sm text-muted-foreground mb-4">
+            How many clones would you like to create?
+          </p>
+          
+          {storageName && (
+            <div className="mb-4 p-3 bg-muted/50 rounded-lg">
+              <p className="text-sm text-muted-foreground">Storage:</p>
+              <p className="text-sm font-medium text-foreground">{storageName}</p>
+            </div>
+          )}
+
+          <div className="space-y-2 mb-6">
+            <label htmlFor="cloneCount" className="block text-sm font-medium text-foreground">
+              Number of Clones
+            </label>
+            <Input
+              id="cloneCount"
+              type="number"
+              min="1"
+              max="100"
+              value={cloneCount}
+              onChange={(e) => {
+                const value = parseInt(e.target.value, 10);
+                if (!isNaN(value) && value >= 1 && value <= 100) {
+                  setCloneCount(value);
+                } else if (e.target.value === '') {
+                  setCloneCount(1);
+                }
+              }}
+              className="w-full"
+              placeholder="1"
+            />
+            <p className="text-xs text-muted-foreground">
+              Enter a number between 1 and 100
+            </p>
+          </div>
+
+          {/* Action Buttons */}
+          <div className="flex flex-col sm:flex-row justify-end gap-3">
+            <Button
+              onClick={handleClose}
+              variant="outline"
+              size="default"
+              className="w-full sm:w-auto"
+            >
+              Cancel
+            </Button>
+            <Button
+              onClick={handleSubmit}
+              disabled={cloneCount < 1 || cloneCount > 100}
+              variant="default"
+              size="default"
+              className="w-full sm:w-auto"
+            >
+              Continue
+            </Button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
+

src/app/_components/DownloadedScriptsTab.tsx

@@ -8,7 +8,9 @@ import { ScriptDetailModal } from "./ScriptDetailModal";
 import { CategorySidebar } from "./CategorySidebar";
 import { FilterBar, type FilterState } from "./FilterBar";
 import { ViewToggle } from "./ViewToggle";
+import { ConfirmationModal } from "./ConfirmationModal";
 import { Button } from "./ui/button";
+import { RefreshCw } from "lucide-react";
 import type { ScriptCard as ScriptCardType } from "~/types/script";
 import type { Server } from "~/types/server";
 import { getDefaultFilters, mergeFiltersWithDefaults } from "./filterUtils";
@@ -32,8 +34,15 @@ export function DownloadedScriptsTab({
   const [filters, setFilters] = useState<FilterState>(getDefaultFilters());
   const [saveFiltersEnabled, setSaveFiltersEnabled] = useState(false);
   const [isLoadingFilters, setIsLoadingFilters] = useState(true);
+  const [updateAllConfirmOpen, setUpdateAllConfirmOpen] = useState(false);
+  const [updateResult, setUpdateResult] = useState<{
+    successCount: number;
+    failCount: number;
+    failed: { slug: string; error: string }[];
+  } | null>(null);
   const gridRef = useRef<HTMLDivElement>(null);
 
+  const utils = api.useUtils();
   const {
     data: scriptCardsData,
     isLoading: githubLoading,
@@ -50,6 +59,30 @@ export function DownloadedScriptsTab({
     { enabled: !!selectedSlug },
   );
 
+  const loadMultipleScriptsMutation = api.scripts.loadMultipleScripts.useMutation({
+    onSuccess: (data) => {
+      void utils.scripts.getAllDownloadedScripts.invalidate();
+      void utils.scripts.getScriptCardsWithCategories.invalidate();
+      setUpdateResult({
+        successCount: data.successful?.length ?? 0,
+        failCount: data.failed?.length ?? 0,
+        failed: (data.failed ?? []).map((f) => ({
+          slug: f.slug,
+          error: f.error ?? "Unknown error",
+        })),
+      });
+      setTimeout(() => setUpdateResult(null), 8000);
+    },
+    onError: (error) => {
+      setUpdateResult({
+        successCount: 0,
+        failCount: 1,
+        failed: [{ slug: "Request failed", error: error.message }],
+      });
+      setTimeout(() => setUpdateResult(null), 8000);
+    },
+  });
+
   // Load SAVE_FILTER setting, saved filters, and view mode on component mount
   useEffect(() => {
     const loadSettings = async () => {
@@ -416,6 +449,21 @@ export function DownloadedScriptsTab({
     setSelectedSlug(null);
   };
 
+  const handleUpdateAllClick = () => {
+    setUpdateResult(null);
+    setUpdateAllConfirmOpen(true);
+  };
+
+  const handleUpdateAllConfirm = () => {
+    setUpdateAllConfirmOpen(false);
+    const slugs = downloadedScripts
+      .map((s) => s.slug)
+      .filter((slug): slug is string => Boolean(slug));
+    if (slugs.length > 0) {
+      loadMultipleScriptsMutation.mutate({ slugs });
+    }
+  };
+
   if (githubLoading || localLoading) {
     return (
       <div className="flex items-center justify-center py-12">
@@ -508,6 +556,43 @@ export function DownloadedScriptsTab({
 
         {/* Main Content */}
         <div className="order-1 min-w-0 flex-1 lg:order-2" ref={gridRef}>
+          {/* Update all downloaded scripts */}
+          <div className="mb-4 flex flex-wrap items-center gap-3">
+            <Button
+              onClick={handleUpdateAllClick}
+              disabled={loadMultipleScriptsMutation.isPending}
+              variant="secondary"
+              size="default"
+              className="flex items-center gap-2"
+            >
+              {loadMultipleScriptsMutation.isPending ? (
+                <>
+                  <RefreshCw className="h-4 w-4 animate-spin" />
+                  <span>Updating...</span>
+                </>
+              ) : (
+                <>
+                  <RefreshCw className="h-4 w-4" />
+                  <span>Update all downloaded scripts</span>
+                </>
+              )}
+            </Button>
+            {updateResult && (
+              <span className="text-muted-foreground text-sm">
+                Updated {updateResult.successCount} successfully
+                {updateResult.failCount > 0
+                  ? `, ${updateResult.failCount} failed`
+                  : ""}
+                .
+                {updateResult.failCount > 0 && updateResult.failed.length > 0 && (
+                  <span className="ml-1" title={updateResult.failed.map((f) => `${f.slug}: ${f.error}`).join("\n")}>
+                    (hover for details)
+                  </span>
+                )}
+              </span>
+            )}
+          </div>
+
           {/* Enhanced Filter Bar */}
           <FilterBar
             filters={filters}
@@ -621,6 +706,17 @@ export function DownloadedScriptsTab({
             onClose={handleCloseModal}
             onInstallScript={onInstallScript}
           />
+
+          <ConfirmationModal
+            isOpen={updateAllConfirmOpen}
+            onClose={() => setUpdateAllConfirmOpen(false)}
+            onConfirm={handleUpdateAllConfirm}
+            title="Update all downloaded scripts"
+            message={`Update all ${downloadedScripts.length} downloaded scripts? This may take several minutes.`}
+            variant="simple"
+            confirmButtonText="Update all"
+            cancelButtonText="Cancel"
+          />
         </div>
       </div>
     </div>

src/app/_components/ExecutionModeModal.tsx

@@ -2,26 +2,31 @@
 
 import { useState, useEffect } from 'react';
 import type { Server } from '../../types/server';
+import type { Script } from '../../types/script';
 import { Button } from './ui/button';
 import { ColorCodedDropdown } from './ColorCodedDropdown';
 import { SettingsModal } from './SettingsModal';
+import { ConfigurationModal, type EnvVars } from './ConfigurationModal';
 import { useRegisterModal } from './modal/ModalStackProvider';
 
 
 interface ExecutionModeModalProps {
   isOpen: boolean;
   onClose: () => void;
-  onExecute: (mode: 'local' | 'ssh', server?: Server) => void;
+  onExecute: (mode: 'local' | 'ssh', server?: Server, envVars?: EnvVars) => void;
   scriptName: string;
+  script?: Script | null;
 }
 
-export function ExecutionModeModal({ isOpen, onClose, onExecute, scriptName }: ExecutionModeModalProps) {
+export function ExecutionModeModal({ isOpen, onClose, onExecute, scriptName, script }: ExecutionModeModalProps) {
   useRegisterModal(isOpen, { id: 'execution-mode-modal', allowEscape: true, onClose });
   const [servers, setServers] = useState<Server[]>([]);
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [selectedServer, setSelectedServer] = useState<Server | null>(null);
   const [settingsModalOpen, setSettingsModalOpen] = useState(false);
+  const [configModalOpen, setConfigModalOpen] = useState(false);
+  const [configMode, setConfigMode] = useState<'default' | 'advanced'>('default');
 
   useEffect(() => {
     if (isOpen) {
@@ -64,19 +69,25 @@ export function ExecutionModeModal({ isOpen, onClose, onExecute, scriptName }: E
     }
   };
 
-  const handleExecute = () => {
+  const handleConfigModeSelect = (mode: 'default' | 'advanced') => {
     if (!selectedServer) {
-      setError('Please select a server for SSH execution');
+      setError('Please select a server first');
       return;
     }
-    
+    setConfigMode(mode);
-    onExecute('ssh', selectedServer);
+    setConfigModalOpen(true);
+  };
+
+  const handleConfigConfirm = (envVars: EnvVars) => {
+    if (!selectedServer) return;
+    setConfigModalOpen(false);
+    onExecute('ssh', selectedServer, envVars);
     onClose();
   };
 
-
   const handleServerSelect = (server: Server | null) => {
     setSelectedServer(server);
+    setError(null); // Clear error when server is selected
   };
 
 
@@ -164,6 +175,31 @@ export function ExecutionModeModal({ isOpen, onClose, onExecute, scriptName }: E
                   </div>
                 </div>
 
+                {/* Configuration Mode Selection */}
+                <div className="space-y-3">
+                  <p className="text-sm text-muted-foreground text-center">
+                    Choose configuration mode:
+                  </p>
+                  <div className="flex gap-3">
+                    <Button
+                      onClick={() => handleConfigModeSelect('default')}
+                      variant="default"
+                      size="default"
+                      className="flex-1"
+                    >
+                      Default
+                    </Button>
+                    <Button
+                      onClick={() => handleConfigModeSelect('advanced')}
+                      variant="outline"
+                      size="default"
+                      className="flex-1"
+                    >
+                      Advanced (Beta)
+                    </Button>
+                  </div>
+                </div>
+
                 {/* Action Buttons */}
                 <div className="flex justify-end space-x-3">
                   <Button
@@ -173,13 +209,6 @@ export function ExecutionModeModal({ isOpen, onClose, onExecute, scriptName }: E
                   >
                     Cancel
                   </Button>
-                  <Button
-                    onClick={handleExecute}
-                    variant="default"
-                    size="default"
-                  >
-                    Install
-                  </Button>
                 </div>
               </div>
             ) : (
@@ -204,6 +233,33 @@ export function ExecutionModeModal({ isOpen, onClose, onExecute, scriptName }: E
                   />
                 </div>
 
+                {/* Configuration Mode Selection - only show when server is selected */}
+                {selectedServer && (
+                  <div className="space-y-3 pt-4 border-t border-border">
+                    <p className="text-sm text-muted-foreground text-center">
+                      Choose configuration mode:
+                    </p>
+                    <div className="flex gap-3">
+                      <Button
+                        onClick={() => handleConfigModeSelect('default')}
+                        variant="default"
+                        size="default"
+                        className="flex-1"
+                      >
+                        Default
+                      </Button>
+                      <Button
+                        onClick={() => handleConfigModeSelect('advanced')}
+                        variant="outline"
+                        size="default"
+                        className="flex-1"
+                      >
+                        Advanced
+                      </Button>
+                    </div>
+                  </div>
+                )}
+
                 {/* Action Buttons */}
                 <div className="flex justify-end space-x-3">
                   <Button
@@ -213,15 +269,6 @@ export function ExecutionModeModal({ isOpen, onClose, onExecute, scriptName }: E
                   >
                     Cancel
                   </Button>
-                  <Button
-                    onClick={handleExecute}
-                    disabled={!selectedServer}
-                    variant="default"
-                    size="default"
-                    className={!selectedServer ? 'bg-muted-foreground cursor-not-allowed' : ''}
-                  >
-                    Run on Server
-                  </Button>
                 </div>
               </div>
             )}
@@ -234,6 +281,16 @@ export function ExecutionModeModal({ isOpen, onClose, onExecute, scriptName }: E
         isOpen={settingsModalOpen} 
         onClose={handleSettingsModalClose} 
       />
+
+      {/* Configuration Modal */}
+      <ConfigurationModal
+        isOpen={configModalOpen}
+        onClose={() => setConfigModalOpen(false)}
+        onConfirm={handleConfigConfirm}
+        script={script ?? null}
+        server={selectedServer}
+        mode={configMode}
+      />
     </>
   );
 }

src/app/_components/Footer.tsx

@@ -16,7 +16,7 @@ export function Footer({ onOpenReleaseNotes }: FooterProps) {
       <div className="container mx-auto px-4">
         <div className="flex flex-col sm:flex-row items-center justify-between gap-2 text-sm text-muted-foreground">
           <div className="flex items-center gap-2">
-            <span>© 2024 PVE Scripts Local</span>
+            <span>© 2026 PVE Scripts Local</span>
             {versionData?.success && versionData.version && (
               <Button
                 variant="ghost"

src/app/_components/GeneralSettingsModal.tsx

@@ -1617,7 +1617,7 @@ export function GeneralSettingsModal({
                       <Input
                         id="new-repo-url"
                         type="url"
-                        placeholder="https://github.com/owner/repo"
+                        placeholder="https://github.com/owner/repo or https://git.example.com/owner/repo"
                         value={newRepoUrl}
                         onChange={(e: React.ChangeEvent<HTMLInputElement>) =>
                           setNewRepoUrl(e.target.value)
@@ -1626,8 +1626,9 @@ export function GeneralSettingsModal({
                         className="w-full"
                       />
                       <p className="text-muted-foreground mt-1 text-xs">
-                        Enter a GitHub repository URL (e.g.,
+                        Supported: GitHub, GitLab, Bitbucket, or custom Git
-                        https://github.com/owner/repo)
+                        servers (e.g. https://github.com/owner/repo,
+                        https://gitlab.com/owner/repo)
                       </p>
                     </div>
                     <div className="border-border flex items-center justify-between gap-3 rounded-lg border p-3">

src/app/_components/InstalledScriptsTab.tsx

@@ -12,6 +12,7 @@ import { LoadingModal } from "./LoadingModal";
 import { LXCSettingsModal } from "./LXCSettingsModal";
 import { StorageSelectionModal } from "./StorageSelectionModal";
 import { BackupWarningModal } from "./BackupWarningModal";
+import { CloneCountInputModal } from "./CloneCountInputModal";
 import type { Storage } from "~/server/services/storageService";
 import { getContrastColor } from "../../lib/colorUtils";
 import {
@@ -68,11 +69,18 @@ export function InstalledScriptsTab() {
     server?: any;
     backupStorage?: string;
     isBackupOnly?: boolean;
+    isClone?: boolean;
+    executionId?: string;
+    cloneCount?: number;
+    hostnames?: string[];
+    containerType?: 'lxc' | 'vm';
+    storage?: string;
   } | null>(null);
   const [openingShell, setOpeningShell] = useState<{
     id: number;
     containerId: string;
     server?: any;
+    containerType?: 'lxc' | 'vm';
   } | null>(null);
   const [showBackupPrompt, setShowBackupPrompt] = useState(false);
   const [showStorageSelection, setShowStorageSelection] = useState(false);
@@ -82,6 +90,14 @@ export function InstalledScriptsTab() {
   const [isLoadingStorages, setIsLoadingStorages] = useState(false);
   const [showBackupWarning, setShowBackupWarning] = useState(false);
   const [isPreUpdateBackup, setIsPreUpdateBackup] = useState(false); // Track if storage selection is for pre-update backup
+  const [pendingCloneScript, setPendingCloneScript] = useState<InstalledScript | null>(null);
+  const [cloneStorages, setCloneStorages] = useState<Storage[]>([]);
+  const [isLoadingCloneStorages, setIsLoadingCloneStorages] = useState(false);
+  const [showCloneStorageSelection, setShowCloneStorageSelection] = useState(false);
+  const [showCloneCountInput, setShowCloneCountInput] = useState(false);
+  const [cloneContainerType, setCloneContainerType] = useState<'lxc' | 'vm' | null>(null);
+  const [selectedCloneStorage, setSelectedCloneStorage] = useState<Storage | null>(null);
+  // cloneCount is passed as parameter to handleCloneCountSubmit, no need for state
   const [editingScriptId, setEditingScriptId] = useState<number | null>(null);
   const [editFormData, setEditFormData] = useState<{
     script_name: string;
@@ -925,6 +941,201 @@ export function InstalledScriptsTab() {
     setShowStorageSelection(true);
   };
 
+  // Clone queries
+
+  const getContainerHostnameQuery = api.installedScripts.getContainerHostname.useQuery(
+    { 
+      containerId: pendingCloneScript?.container_id ?? '', 
+      serverId: pendingCloneScript?.server_id ?? 0,
+      containerType: cloneContainerType ?? 'lxc'
+    },
+    { enabled: false }
+  );
+
+  const executeCloneMutation = api.installedScripts.executeClone.useMutation();
+  const utils = api.useUtils();
+
+  const fetchCloneStorages = async (serverId: number, _forceRefresh = false) => {
+    setIsLoadingCloneStorages(true);
+    try {
+      // Use utils.fetch to call with the correct serverId
+      const result = await utils.installedScripts.getCloneStorages.fetch({
+        serverId,
+        forceRefresh: _forceRefresh
+      });
+      if (result?.success && result.storages) {
+        setCloneStorages(result.storages as Storage[]);
+      } else {
+        setErrorModal({
+          isOpen: true,
+          title: 'Failed to Fetch Storages',
+          message: result?.error ?? 'Unknown error occurred',
+          type: 'error'
+        });
+      }
+    } catch (error) {
+      setErrorModal({
+        isOpen: true,
+        title: 'Failed to Fetch Storages',
+        message: error instanceof Error ? error.message : 'Unknown error occurred',
+        type: 'error'
+      });
+    } finally {
+      setIsLoadingCloneStorages(false);
+    }
+  };
+
+  const handleCloneScript = async (script: InstalledScript) => {
+    if (!script.container_id) {
+      setErrorModal({
+        isOpen: true,
+        title: 'Clone Failed',
+        message: 'No Container ID available for this script',
+        details: 'This script does not have a valid container ID and cannot be cloned.'
+      });
+      return;
+    }
+
+    if (!script.server_id) {
+      setErrorModal({
+        isOpen: true,
+        title: 'Clone Not Available',
+        message: 'Clone is only available for SSH scripts with a configured server.',
+        type: 'error'
+      });
+      return;
+    }
+
+    // Store the script and determine container type using is_vm property
+    setPendingCloneScript(script);
+    
+    // Use is_vm property from batch detection (from main branch)
+    // If not available, default to LXC
+    const containerType = script.is_vm ? 'vm' : 'lxc';
+    setCloneContainerType(containerType);
+    
+    // Fetch storages and show selection modal
+    void fetchCloneStorages(script.server_id, false);
+    setShowCloneStorageSelection(true);
+  };
+
+  const handleCloneStorageSelected = (storage: Storage) => {
+    setShowCloneStorageSelection(false);
+    setSelectedCloneStorage(storage);
+    setShowCloneCountInput(true);
+  };
+
+  const handleCloneCountSubmit = async (count: number) => {
+    setShowCloneCountInput(false);
+
+    if (!pendingCloneScript || !cloneContainerType) {
+      setErrorModal({
+        isOpen: true,
+        title: 'Clone Failed',
+        message: 'Missing required information for cloning.',
+        type: 'error'
+      });
+      return;
+    }
+
+    try {
+      // Get original hostname
+      const hostnameResult = await getContainerHostnameQuery.refetch();
+
+      if (!hostnameResult.data?.success || !hostnameResult.data.hostname) {
+        setErrorModal({
+          isOpen: true,
+          title: 'Clone Failed',
+          message: 'Could not retrieve container hostname.',
+          type: 'error'
+        });
+        return;
+      }
+
+      const originalHostname = hostnameResult.data.hostname;
+
+      // Generate clone hostnames using utils to call with originalHostname
+      const hostnamesResult = await utils.installedScripts.generateCloneHostnames.fetch({
+        originalHostname,
+        containerType: cloneContainerType ?? 'lxc',
+        serverId: pendingCloneScript.server_id!,
+        count
+      });
+
+      if (!hostnamesResult?.success || !hostnamesResult.hostnames.length) {
+        setErrorModal({
+          isOpen: true,
+          title: 'Clone Failed',
+          message: hostnamesResult?.error ?? 'Could not generate clone hostnames.',
+          type: 'error'
+        });
+        return;
+      }
+
+      const hostnames = hostnamesResult.hostnames;
+
+      // Execute clone (nextIds will be obtained sequentially in server.js)
+      const cloneResult = await executeCloneMutation.mutateAsync({
+        containerId: pendingCloneScript.container_id!,
+        serverId: pendingCloneScript.server_id!,
+        storage: selectedCloneStorage!.name,
+        cloneCount: count,
+        hostnames: hostnames,
+        containerType: cloneContainerType
+      });
+
+      if (!cloneResult.success || !cloneResult.executionId) {
+        setErrorModal({
+          isOpen: true,
+          title: 'Clone Failed',
+          message: cloneResult.error ?? 'Failed to start clone operation.',
+          type: 'error'
+        });
+        return;
+      }
+
+      // Get server info for websocket
+      const server = pendingCloneScript.server_id && pendingCloneScript.server_user ? {
+        id: pendingCloneScript.server_id,
+        name: pendingCloneScript.server_name,
+        ip: pendingCloneScript.server_ip,
+        user: pendingCloneScript.server_user,
+        password: pendingCloneScript.server_password,
+        auth_type: pendingCloneScript.server_auth_type ?? 'password',
+        ssh_key: pendingCloneScript.server_ssh_key,
+        ssh_key_passphrase: pendingCloneScript.server_ssh_key_passphrase,
+        ssh_port: pendingCloneScript.server_ssh_port ?? 22,
+      } : null;
+
+      // Set up terminal for clone execution
+      setUpdatingScript({
+        id: pendingCloneScript.id,
+        containerId: pendingCloneScript.container_id!,
+        server: server,
+        isClone: true,
+        executionId: cloneResult.executionId,
+        cloneCount: count,
+        hostnames: hostnames,
+        containerType: cloneContainerType,
+        storage: selectedCloneStorage!.name
+      });
+
+      // Reset clone state
+      setPendingCloneScript(null);
+      setCloneStorages([]);
+      setSelectedCloneStorage(null);
+      setCloneContainerType(null);
+      // Reset clone count (no state variable needed, count is passed as parameter)
+    } catch (error) {
+      setErrorModal({
+        isOpen: true,
+        title: 'Clone Failed',
+        message: error instanceof Error ? error.message : 'Unknown error occurred',
+        type: 'error'
+      });
+    }
+  };
+
   const handleOpenShell = (script: InstalledScript) => {
     if (!script.container_id) {
       setErrorModal({
@@ -957,6 +1168,7 @@ export function InstalledScriptsTab() {
       id: script.id,
       containerId: script.container_id,
       server: server,
+      containerType: script.is_vm ? 'vm' : 'lxc',
     });
   };
 
@@ -1216,26 +1428,25 @@ export function InstalledScriptsTab() {
         <div className="mb-8" data-terminal="update">
           <Terminal
             scriptPath={
-              updatingScript.isBackupOnly
+              updatingScript.isClone 
+                ? `clone-${updatingScript.containerId}`
+                : updatingScript.isBackupOnly
                 ? `backup-${updatingScript.containerId}`
                 : `update-${updatingScript.containerId}`
             }
             onClose={handleCloseUpdateTerminal}
             mode={updatingScript.server ? "ssh" : "local"}
             server={updatingScript.server}
-            isUpdate={!updatingScript.isBackupOnly}
+            isUpdate={!updatingScript.isBackupOnly && !updatingScript.isClone}
             isBackup={updatingScript.isBackupOnly}
+            isClone={updatingScript.isClone}
             containerId={updatingScript.containerId}
-            storage={
+            executionId={updatingScript.executionId}
-              updatingScript.isBackupOnly
+            cloneCount={updatingScript.cloneCount}
-                ? updatingScript.backupStorage
+            hostnames={updatingScript.hostnames}
-                : undefined
+            containerType={updatingScript.containerType}
-            }
+            storage={updatingScript.isClone ? updatingScript.storage : (updatingScript.isBackupOnly ? updatingScript.backupStorage : undefined)}
-            backupStorage={
+            backupStorage={!updatingScript.isBackupOnly && !updatingScript.isClone ? updatingScript.backupStorage : undefined}
-              !updatingScript.isBackupOnly
-                ? updatingScript.backupStorage
-                : undefined
-            }
           />
         </div>
       )}
@@ -1243,6 +1454,13 @@ export function InstalledScriptsTab() {
       {/* Shell Terminal */}
       {openingShell && (
         <div className="mb-8" data-terminal="shell">
+          {openingShell.containerType === 'vm' && (
+            <p className="text-muted-foreground mb-2 text-sm">
+              VM shell uses the Proxmox serial console. The VM must have a
+              serial port configured (e.g. <code className="bg-muted rounded px-1">qm set {openingShell.containerId} -serial0 socket</code>).
+              Detach with <kbd className="bg-muted rounded px-1">Ctrl+O</kbd>.
+            </p>
+          )}
           <Terminal
             scriptPath={`shell-${openingShell.containerId}`}
             onClose={handleCloseShellTerminal}
@@ -1250,6 +1468,7 @@ export function InstalledScriptsTab() {
             server={openingShell.server}
             isShell={true}
             containerId={openingShell.containerId}
+            containerType={openingShell.containerType}
           />
         </div>
       )}
@@ -1329,7 +1548,7 @@ export function InstalledScriptsTab() {
           >
             {showAutoDetectForm
               ? "Cancel Auto-Detect"
-              : '🔍 Auto-Detect LXC Containers (Must contain a tag with "community-script")'}
+              : '🔍 Auto-Detect Containers & VMs (tag: community-script)'}
           </Button>
           <Button
             onClick={() => {
@@ -1555,12 +1774,11 @@ export function InstalledScriptsTab() {
           </div>
         )}
 
-        {/* Auto-Detect LXC Containers Form */}
+        {/* Auto-Detect Containers & VMs Form */}
         {showAutoDetectForm && (
           <div className="bg-card border-border mb-6 rounded-lg border p-4 shadow-sm sm:p-6">
             <h3 className="text-foreground mb-4 text-lg font-semibold sm:mb-6">
-              Auto-Detect LXC Containers (Must contain a tag with
+              Auto-Detect Containers &amp; VMs (tag: community-script)
-              &quot;community-script&quot;)
             </h3>
             <div className="space-y-4 sm:space-y-6">
               <div className="bg-muted/30 border-muted rounded-lg border p-4">
@@ -1586,12 +1804,12 @@ export function InstalledScriptsTab() {
                       <p>This feature will:</p>
                       <ul className="mt-1 list-inside list-disc space-y-1">
                         <li>Connect to the selected server via SSH</li>
-                        <li>Scan all LXC config files in /etc/pve/lxc/</li>
+                        <li>Scan LXC configs in /etc/pve/lxc/ and VM configs in /etc/pve/qemu-server/</li>
                         <li>
-                          Find containers with &quot;community-script&quot; in
+                          Find containers and VMs with &quot;community-script&quot; in
                           their tags
                         </li>
-                        <li>Extract the container ID and hostname</li>
+                        <li>Extract the container/VM ID and hostname or name</li>
                         <li>Add them as installed script entries</li>
                       </ul>
                     </div>
@@ -1716,6 +1934,7 @@ export function InstalledScriptsTab() {
                   onCancel={handleCancelEdit}
                   onUpdate={() => handleUpdateScript(script)}
                   onBackup={() => handleBackupScript(script)}
+                  onClone={() => handleCloneScript(script)}
                   onShell={() => handleOpenShell(script)}
                   onDelete={() => handleDeleteScript(Number(script.id))}
                   isUpdating={updateScriptMutation.isPending}
@@ -2067,8 +2286,22 @@ export function InstalledScriptsTab() {
                                         </DropdownMenuItem>
                                       )}
                                     {script.container_id &&
-                                      script.execution_mode === "ssh" &&
+                                      script.execution_mode === "ssh" && (
-                                      !script.is_vm && (
+                                        <DropdownMenuItem
+                                          onClick={() =>
+                                            handleCloneScript(script)
+                                          }
+                                          disabled={
+                                            containerStatuses.get(script.id) ===
+                                            "stopped"
+                                          }
+                                          className="text-muted-foreground hover:text-foreground hover:bg-muted/20 focus:bg-muted/20"
+                                        >
+                                          Clone
+                                        </DropdownMenuItem>
+                                      )}
+                                    {script.container_id &&
+                                      script.execution_mode === "ssh" && (
                                         <DropdownMenuItem
                                           onClick={() =>
                                             handleOpenShell(script)
@@ -2078,6 +2311,11 @@ export function InstalledScriptsTab() {
                                             "stopped"
                                           }
                                           className="text-muted-foreground hover:text-foreground hover:bg-muted/20 focus:bg-muted/20"
+                                          title={
+                                            script.is_vm
+                                              ? "VM serial console (requires serial port; detach with Ctrl+O)"
+                                              : undefined
+                                          }
                                         >
                                           Shell
                                         </DropdownMenuItem>
@@ -2357,6 +2595,43 @@ export function InstalledScriptsTab() {
         }}
       />
 
+      {/* Clone Storage Selection Modal */}
+      <StorageSelectionModal
+        isOpen={showCloneStorageSelection}
+        onClose={() => {
+          setShowCloneStorageSelection(false);
+          setPendingCloneScript(null);
+          setCloneStorages([]);
+        }}
+        onSelect={handleCloneStorageSelected}
+        storages={cloneStorages}
+        isLoading={isLoadingCloneStorages}
+        onRefresh={() => {
+          if (pendingCloneScript?.server_id) {
+            void fetchCloneStorages(pendingCloneScript.server_id, true);
+          }
+        }}
+        title="Select Clone Storage"
+        description="Select a storage to use for cloning. Only storages with rootdir content are shown."
+        filterFn={(storage) => {
+          return storage.content.includes('rootdir');
+        }}
+        showBackupTag={false}
+      />
+
+      {/* Clone Count Input Modal */}
+      <CloneCountInputModal
+        isOpen={showCloneCountInput}
+        onClose={() => {
+          setShowCloneCountInput(false);
+          setPendingCloneScript(null);
+          setCloneStorages([]);
+          setSelectedCloneStorage(null);
+        }}
+        onSubmit={handleCloneCountSubmit}
+        storageName={selectedCloneStorage?.name ?? ''}
+      />
+
       {/* LXC Settings Modal */}
       <LXCSettingsModal
         isOpen={lxcSettingsModal.isOpen}

src/app/_components/PBSCredentialsModal.tsx

@@ -270,22 +270,21 @@ export function PBSCredentialsModal({
                 htmlFor="pbs-fingerprint"
                 className="text-foreground mb-1 block text-sm font-medium"
               >
-                Fingerprint <span className="text-error">*</span>
+                Fingerprint
               </label>
               <input
                 type="text"
                 id="pbs-fingerprint"
                 value={pbsFingerprint}
                 onChange={(e) => setPbsFingerprint(e.target.value)}
-                required
                 disabled={isLoading}
                 className="bg-card text-foreground placeholder-muted-foreground focus:ring-ring focus:border-ring border-border w-full rounded-md border px-3 py-2 shadow-sm focus:ring-2 focus:outline-none"
                 placeholder="e.g., 7b:e5:87:38:5e:16:05:d1:12:22:7f:73:d2:e2:d0:cf:8c:cb:28:e2:74:0c:78:91:1a:71:74:2e:79:20:5a:02"
               />
               <p className="text-muted-foreground mt-1 text-xs">
-                Server fingerprint for auto-acceptance. You can find this on
+                Leave empty if PBS uses a trusted CA (e.g. Let&apos;s Encrypt).
-                your PBS dashboard by clicking the &quot;Show Fingerprint&quot;
+                For self-signed certificates, enter the server fingerprint from
-                button.
+                the PBS dashboard (&quot;Show Fingerprint&quot;).
               </p>
             </div>
 

src/app/_components/ScriptDetailModal.tsx

@@ -28,6 +28,7 @@ interface ScriptDetailModalProps {
     scriptName: string,
     mode?: "local" | "ssh",
     server?: Server,
+    envVars?: Record<string, string | number | boolean>,
   ) => void;
 }
 
@@ -183,7 +184,7 @@ export function ScriptDetailModal({
     setExecutionModeOpen(true);
   };
 
-  const handleExecuteScript = (mode: "local" | "ssh", server?: Server) => {
+  const handleExecuteScript = (mode: "local" | "ssh", server?: Server, envVars?: Record<string, string | number | boolean>) => {
     if (!script || !onInstallScript) return;
 
     // Find the script path based on selected version type
@@ -197,8 +198,8 @@ export function ScriptDetailModal({
       const scriptPath = `scripts/${scriptMethod.script}`;
       const scriptName = script.name;
 
-      // Pass execution mode and server info to the parent
+      // Pass execution mode, server info, and envVars to the parent
-      onInstallScript(scriptPath, scriptName, mode, server);
+      onInstallScript(scriptPath, scriptName, mode, server, envVars);
 
       onClose(); // Close the modal when starting installation
     }
@@ -935,6 +936,7 @@ export function ScriptDetailModal({
       {script && (
         <ExecutionModeModal
           scriptName={script.name}
+          script={script}
           isOpen={executionModeOpen}
           onClose={() => setExecutionModeOpen(false)}
           onExecute={handleExecuteScript}

src/app/_components/ScriptInstallationCard.tsx

@@ -46,6 +46,7 @@ interface ScriptInstallationCardProps {
   onCancel: () => void;
   onUpdate: () => void;
   onBackup?: () => void;
+  onClone?: () => void;
   onShell: () => void;
   onDelete: () => void;
   isUpdating: boolean;
@@ -71,6 +72,7 @@ export function ScriptInstallationCard({
   onCancel,
   onUpdate,
   onBackup,
+  onClone,
   onShell,
   onDelete,
   isUpdating,
@@ -319,7 +321,16 @@ export function ScriptInstallationCard({
                       Backup
                     </DropdownMenuItem>
                   )}
-                  {script.container_id && script.execution_mode === 'ssh' && !script.is_vm && (
+                  {script.container_id && script.execution_mode === 'ssh' && onClone && (
+                    <DropdownMenuItem
+                      onClick={onClone}
+                      disabled={containerStatus === 'stopped'}
+                      className="text-muted-foreground hover:text-foreground hover:bg-muted/20 focus:bg-muted/20"
+                    >
+                      Clone
+                    </DropdownMenuItem>
+                  )}
+                  {script.container_id && script.execution_mode === 'ssh' && (
                     <DropdownMenuItem
                       onClick={onShell}
                       disabled={containerStatus === 'stopped'}

src/app/_components/ServerForm.tsx

@@ -438,6 +438,11 @@ export function ServerForm({
             {errors.password && (
               <p className="text-destructive mt-1 text-sm">{errors.password}</p>
             )}
+            <p className="text-muted-foreground mt-1 text-xs">
+              SSH key is recommended when possible. Special characters (e.g.{" "}
+              <code className="rounded bg-muted px-0.5">{"{ } $ \" '"}</code>) are
+              supported.
+            </p>
           </div>
         )}
 

src/app/_components/StorageSelectionModal.tsx

@@ -13,6 +13,10 @@ interface StorageSelectionModalProps {
   storages: Storage[];
   isLoading: boolean;
   onRefresh: () => void;
+  title?: string;
+  description?: string;
+  filterFn?: (storage: Storage) => boolean;
+  showBackupTag?: boolean;
 }
 
 export function StorageSelectionModal({
@@ -21,7 +25,11 @@ export function StorageSelectionModal({
   onSelect,
   storages,
   isLoading,
-  onRefresh
+  onRefresh,
+  title = 'Select Storage',
+  description = 'Select a storage to use.',
+  filterFn,
+  showBackupTag = true
 }: StorageSelectionModalProps) {
   const [selectedStorage, setSelectedStorage] = useState<Storage | null>(null);
   
@@ -41,8 +49,8 @@ export function StorageSelectionModal({
     onClose();
   };
 
-  // Filter to show only backup-capable storages
+  // Filter storages using filterFn if provided, otherwise filter to show only backup-capable storages
-  const backupStorages = storages.filter(s => s.supportsBackup);
+  const filteredStorages = filterFn ? storages.filter(filterFn) : storages.filter(s => s.supportsBackup);
 
   return (
     <div className="fixed inset-0 backdrop-blur-sm bg-black/50 flex items-center justify-center z-50 p-4">
@@ -51,7 +59,7 @@ export function StorageSelectionModal({
         <div className="flex items-center justify-between p-6 border-b border-border">
           <div className="flex items-center gap-3">
             <Database className="h-6 w-6 text-primary" />
-            <h2 className="text-2xl font-bold text-card-foreground">Select Backup Storage</h2>
+            <h2 className="text-2xl font-bold text-card-foreground">{title}</h2>
           </div>
           <Button
             onClick={handleClose}
@@ -72,7 +80,7 @@ export function StorageSelectionModal({
               <div className="inline-block animate-spin rounded-full h-8 w-8 border-b-2 border-primary mb-4"></div>
               <p className="text-muted-foreground">Loading storages...</p>
             </div>
-          ) : backupStorages.length === 0 ? (
+          ) : filteredStorages.length === 0 ? (
             <div className="text-center py-8">
               <Database className="h-12 w-12 text-muted-foreground mx-auto mb-4" />
               <p className="text-foreground mb-2">No backup-capable storages found</p>
@@ -87,12 +95,12 @@ export function StorageSelectionModal({
           ) : (
             <>
               <p className="text-sm text-muted-foreground mb-4">
-                Select a storage to use for the backup. Only storages that support backups are shown.
+                {description}
               </p>
 
               {/* Storage List */}
               <div className="space-y-2 max-h-96 overflow-y-auto mb-4">
-                {backupStorages.map((storage) => (
+                {filteredStorages.map((storage) => (
                   <div
                     key={storage.name}
                     onClick={() => setSelectedStorage(storage)}
@@ -106,9 +114,11 @@ export function StorageSelectionModal({
                       <div className="flex-1">
                         <div className="flex items-center gap-2 mb-1">
                           <h3 className="font-medium text-foreground">{storage.name}</h3>
-                          <span className="px-2 py-0.5 text-xs font-medium rounded bg-success/20 text-success border border-success/30">
+                          {showBackupTag && (
-                            Backup
+                            <span className="px-2 py-0.5 text-xs font-medium rounded bg-success/20 text-success border border-success/30">
-                          </span>
+                              Backup
+                            </span>
+                          )}
                           <span className="px-2 py-0.5 text-xs font-medium rounded bg-muted text-muted-foreground">
                             {storage.type}
                           </span>

src/app/_components/Terminal.tsx

@@ -13,9 +13,15 @@ interface TerminalProps {
   isUpdate?: boolean;
   isShell?: boolean;
   isBackup?: boolean;
+  isClone?: boolean;
   containerId?: string;
   storage?: string;
   backupStorage?: string;
+  executionId?: string;
+  cloneCount?: number;
+  hostnames?: string[];
+  containerType?: 'lxc' | 'vm';
+  envVars?: Record<string, string | number | boolean>;
 }
 
 interface TerminalMessage {
@@ -24,7 +30,7 @@ interface TerminalMessage {
   timestamp: number;
 }
 
-export function Terminal({ scriptPath, onClose, mode = 'local', server, isUpdate = false, isShell = false, isBackup = false, containerId, storage, backupStorage }: TerminalProps) {
+export function Terminal({ scriptPath, onClose, mode = 'local', server, isUpdate = false, isShell = false, isBackup = false, isClone = false, containerId, storage, backupStorage, executionId: propExecutionId, cloneCount, hostnames, containerType, envVars }: TerminalProps) {
   const [isConnected, setIsConnected] = useState(false);
   const [isRunning, setIsRunning] = useState(false);
   const [isClient, setIsClient] = useState(false);
@@ -39,7 +45,16 @@ export function Terminal({ scriptPath, onClose, mode = 'local', server, isUpdate
   const fitAddonRef = useRef<any>(null);
   const wsRef = useRef<WebSocket | null>(null);
   const inputHandlerRef = useRef<((data: string) => void) | null>(null);
-  const [executionId, setExecutionId] = useState(() => `exec_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`);
+  const [executionId, setExecutionId] = useState(() => propExecutionId ?? `exec_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`);
+  
+  // Update executionId when propExecutionId changes
+  useEffect(() => {
+    if (propExecutionId) {
+      setExecutionId(propExecutionId);
+    }
+  }, [propExecutionId]);
+  
+  const effectiveExecutionId = propExecutionId ?? executionId;
   const isConnectingRef = useRef<boolean>(false);
   const hasConnectedRef = useRef<boolean>(false);
 
@@ -277,7 +292,7 @@ export function Terminal({ scriptPath, onClose, mode = 'local', server, isUpdate
       if (wsRef.current && wsRef.current.readyState === WebSocket.OPEN) {
         const message = {
           action: 'input',
-          executionId,
+          executionId: effectiveExecutionId,
           input: data
         };
         wsRef.current.send(JSON.stringify(message));
@@ -325,9 +340,11 @@ export function Terminal({ scriptPath, onClose, mode = 'local', server, isUpdate
         
         // Only auto-start on initial connection, not on reconnections
         if (isInitialConnection && !isRunning) {
-          // Generate a new execution ID for the initial run
+          // Use propExecutionId if provided, otherwise generate a new one
-          const newExecutionId = `exec_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
+          const newExecutionId = propExecutionId ?? `exec_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
-          setExecutionId(newExecutionId);
+          if (!propExecutionId) {
+            setExecutionId(newExecutionId);
+          }
           
           const message = {
             action: 'start',
@@ -338,9 +355,14 @@ export function Terminal({ scriptPath, onClose, mode = 'local', server, isUpdate
             isUpdate,
             isShell,
             isBackup,
+            isClone,
             containerId,
             storage,
-            backupStorage
+            backupStorage,
+            cloneCount,
+            hostnames,
+            containerType,
+            envVars
           };
           ws.send(JSON.stringify(message));
         }
@@ -380,13 +402,15 @@ export function Terminal({ scriptPath, onClose, mode = 'local', server, isUpdate
         wsRef.current.close();
       }
     };
-  }, [scriptPath, mode, server, isUpdate, isShell, containerId, isMobile]);  
+  }, [scriptPath, mode, server, isUpdate, isShell, containerId, isMobile, envVars]);  
 
   const startScript = () => {
     if (wsRef.current && wsRef.current.readyState === WebSocket.OPEN && !isRunning) {
-      // Generate a new execution ID for each script run
+      // Generate a new execution ID for each script run (unless propExecutionId is provided)
-      const newExecutionId = `exec_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
+      const newExecutionId = propExecutionId ?? `exec_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
-      setExecutionId(newExecutionId);
+      if (!propExecutionId) {
+        setExecutionId(newExecutionId);
+      }
       
       setIsStopped(false);
       wsRef.current.send(JSON.stringify({
@@ -395,9 +419,17 @@ export function Terminal({ scriptPath, onClose, mode = 'local', server, isUpdate
         executionId: newExecutionId,
         mode,
         server,
+        envVars,
         isUpdate,
         isShell,
-        containerId
+        isBackup,
+        isClone,
+        containerId,
+        storage,
+        backupStorage,
+        cloneCount,
+        hostnames,
+        containerType
       }));
     }
   };

src/app/_components/VersionDisplay.tsx

@@ -416,11 +416,20 @@ export function VersionDisplay({ onOpenReleaseNotes }: VersionDisplayProps = {})
     setShowUpdateConfirmation(true);
   };
 
+  // Helper to generate secure random string
+  function getSecureRandomString(length: number): string {
+    const array = new Uint8Array(length);
+    window.crypto.getRandomValues(array);
+    // Convert to base36 string (alphanumeric)
+    return Array.from(array, b => b.toString(36)).join('').substr(0, length);
+  }
+
   const handleConfirmUpdate = () => {
     // Close the confirmation modal
     setShowUpdateConfirmation(false);
     // Start the actual update process
-    const sessionId = `update_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
+    const randomSuffix = getSecureRandomString(9);
+    const sessionId = `update_${Date.now()}_${randomSuffix}`;
     const startTime = Date.now();
     
     setIsUpdating(true);

src/app/api/servers/[id]/discover-ssh-keys/route.ts

@@ -0,0 +1,96 @@
+import type { NextRequest } from 'next/server';
+import { NextResponse } from 'next/server';
+import { getDatabase } from '../../../../../server/database-prisma';
+import { getSSHExecutionService } from '../../../../../server/ssh-execution-service';
+import type { Server } from '~/types/server';
+
+const DISCOVER_TIMEOUT_MS = 10_000;
+
+/** Match lines that look like SSH public keys (same as build.func) */
+const SSH_PUBKEY_RE = /^(ssh-(rsa|ed25519)|ecdsa-sha2-nistp256|sk-(ssh-ed25519|ecdsa-sha2-nistp256))\s+/;
+
+/**
+ * Run a command on the Proxmox host and return buffered stdout.
+ * Resolves when the process exits or rejects on timeout/spawn error.
+ */
+function runRemoteCommand(
+  server: Server,
+  command: string,
+  timeoutMs: number
+): Promise<{ stdout: string; exitCode: number }> {
+  const ssh = getSSHExecutionService();
+  return new Promise((resolve, reject) => {
+    const chunks: string[] = [];
+    let settled = false;
+
+    const finish = (stdout: string, exitCode: number) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ stdout, exitCode });
+    };
+
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      reject(new Error('SSH discover keys timeout'));
+    }, timeoutMs);
+
+    ssh
+      .executeCommand(
+        server,
+        command,
+        (data: string) => chunks.push(data),
+        () => {},
+        (code: number) => finish(chunks.join(''), code)
+      )
+      .catch((err) => {
+        if (!settled) {
+          settled = true;
+          clearTimeout(timer);
+          reject(err);
+        }
+      });
+  });
+}
+
+export async function GET(
+  _request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  try {
+    const { id: idParam } = await params;
+    const id = parseInt(idParam);
+    if (isNaN(id)) {
+      return NextResponse.json({ error: 'Invalid server ID' }, { status: 400 });
+    }
+
+    const db = getDatabase();
+    const server = await db.getServerById(id) as Server | null;
+
+    if (!server) {
+      return NextResponse.json({ error: 'Server not found' }, { status: 404 });
+    }
+
+    // Same paths as native build.func ssh_discover_default_files()
+    const remoteScript = `bash -c 'for f in /root/.ssh/authorized_keys /root/.ssh/authorized_keys2 /root/.ssh/*.pub /etc/ssh/authorized_keys /etc/ssh/authorized_keys.d/* 2>/dev/null; do [ -f "$f" ] && [ -r "$f" ] && grep -E "^(ssh-(rsa|ed25519)|ecdsa-sha2-nistp256|sk-)" "$f" 2>/dev/null; done | sort -u'`;
+
+    const { stdout } = await runRemoteCommand(server, remoteScript, DISCOVER_TIMEOUT_MS);
+
+    const keys = stdout
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .filter((line) => line.length > 0 && SSH_PUBKEY_RE.test(line));
+
+    return NextResponse.json({ keys });
+  } catch (error) {
+    console.error('Error discovering SSH keys:', error);
+    return NextResponse.json(
+      {
+        success: false,
+        error: error instanceof Error ? error.message : String(error),
+      },
+      { status: 500 }
+    );
+  }
+}

src/app/page.tsx

@@ -32,6 +32,7 @@ export default function Home() {
     name: string;
     mode?: "local" | "ssh";
     server?: Server;
+    envVars?: Record<string, string | number | boolean>;
   } | null>(null);
   const [activeTab, setActiveTab] = useState<
     "scripts" | "downloaded" | "installed" | "backups"
@@ -209,8 +210,9 @@ export default function Home() {
     scriptName: string,
     mode?: "local" | "ssh",
     server?: Server,
+    envVars?: Record<string, string | number | boolean>,
   ) => {
-    setRunningScript({ path: scriptPath, name: scriptName, mode, server });
+    setRunningScript({ path: scriptPath, name: scriptName, mode, server, envVars });
     // Scroll to terminal after a short delay to ensure it's rendered
     setTimeout(scrollToTerminal, 100);
   };
@@ -360,6 +362,7 @@ export default function Home() {
               onClose={handleCloseTerminal}
               mode={runningScript.mode}
               server={runningScript.server}
+              envVars={runningScript.envVars}
             />
           </div>
         )}

src/env.js

@@ -23,8 +23,11 @@ export const env = createEnv({
     ALLOWED_SCRIPT_PATHS: z.string().default("scripts/"),
     // WebSocket Configuration
     WEBSOCKET_PORT: z.string().default("3001"),
-    // GitHub Configuration
+    // Git provider tokens (optional, for private repos)
     GITHUB_TOKEN: z.string().optional(),
+    GITLAB_TOKEN: z.string().optional(),
+    BITBUCKET_APP_PASSWORD: z.string().optional(),
+    BITBUCKET_TOKEN: z.string().optional(),
     // Authentication Configuration
     AUTH_USERNAME: z.string().optional(),
     AUTH_PASSWORD_HASH: z.string().optional(),
@@ -62,8 +65,10 @@ export const env = createEnv({
     ALLOWED_SCRIPT_PATHS: process.env.ALLOWED_SCRIPT_PATHS,
     // WebSocket Configuration
     WEBSOCKET_PORT: process.env.WEBSOCKET_PORT,
-    // GitHub Configuration
     GITHUB_TOKEN: process.env.GITHUB_TOKEN,
+    GITLAB_TOKEN: process.env.GITLAB_TOKEN,
+    BITBUCKET_APP_PASSWORD: process.env.BITBUCKET_APP_PASSWORD,
+    BITBUCKET_TOKEN: process.env.BITBUCKET_TOKEN,
     // Authentication Configuration
     AUTH_USERNAME: process.env.AUTH_USERNAME,
     AUTH_PASSWORD_HASH: process.env.AUTH_PASSWORD_HASH,

src/server/api/routers/installedScripts.ts

@@ -418,48 +418,46 @@ async function isVM(scriptId: number, containerId: string, serverId: number | nu
       return false; // Default to LXC if SSH fails
     }
     
-    // Check both config file paths
+    // Node-specific paths (multi-node Proxmox: /etc/pve/nodes/NODENAME/...)
-    const vmConfigPath = `/etc/pve/qemu-server/${containerId}.conf`;
+    const nodeName = (server as Server).name;
-    const lxcConfigPath = `/etc/pve/lxc/${containerId}.conf`;
+    const vmConfigPathNode = `/etc/pve/nodes/${nodeName}/qemu-server/${containerId}.conf`;
-    
+    const lxcConfigPathNode = `/etc/pve/nodes/${nodeName}/lxc/${containerId}.conf`;
-    // Check VM config file
+    // Fallback for single-node or when server.name is not the Proxmox node name
-    let vmConfigExists = false;
+    const vmConfigPathFallback = `/etc/pve/qemu-server/${containerId}.conf`;
-    await new Promise<void>((resolve) => {
+    const lxcConfigPathFallback = `/etc/pve/lxc/${containerId}.conf`;
-      void sshExecutionService.executeCommand(
-        server as Server,
-        `test -f "${vmConfigPath}" && echo "exists" || echo "not_exists"`,
-        (data: string) => {
-          if (data.includes('exists')) {
-            vmConfigExists = true;
-          }
-        },
-        () => resolve(),
-        () => resolve()
-      );
-    });
-    
-    if (vmConfigExists) {
-      return true; // VM config file exists
-    }
-    
-    // Check LXC config file
-    let lxcConfigExists = false;
-    await new Promise<void>((resolve) => {
-      void sshExecutionService.executeCommand(
-        server as Server,
-        `test -f "${lxcConfigPath}" && echo "exists" || echo "not_exists"`,
-        (data: string) => {
-          if (data.includes('exists')) {
-            lxcConfigExists = true;
-          }
-        },
-        () => resolve(),
-        () => resolve()
-      );
-    });
-    
 
-    return false; // Always LXC since VM config doesn't exist
+    const checkPathExists = (path: string): Promise<boolean> =>
+      new Promise<boolean>((resolve) => {
+        let exists = false;
+        void sshExecutionService.executeCommand(
+          server as Server,
+          `test -f "${path}" && echo "exists" || echo "not_exists"`,
+          (data: string) => {
+            if (data.includes('exists')) exists = true;
+          },
+          () => resolve(exists),
+          () => resolve(exists)
+        );
+      });
+
+    // Prefer node-specific paths first
+    const vmConfigExistsNode = await checkPathExists(vmConfigPathNode);
+    if (vmConfigExistsNode) {
+      return true; // VM config file exists on node
+    }
+
+    const lxcConfigExistsNode = await checkPathExists(lxcConfigPathNode);
+    if (lxcConfigExistsNode) {
+      return false; // LXC config file exists on node
+    }
+
+    // Fallback: single-node or server.name not matching Proxmox node name
+    const vmConfigExistsFallback = await checkPathExists(vmConfigPathFallback);
+    if (vmConfigExistsFallback) {
+      return true;
+    }
+
+    return false; // LXC (or neither path exists)
   } catch (error) {
     console.error('Error determining container type:', error);
     return false; // Default to LXC on error
@@ -510,7 +508,7 @@ async function batchDetectContainerTypes(server: Server): Promise<Map<string, bo
     
     // Get containers from pct list
     let pctOutput = '';
-    await new Promise<void>((resolve, reject) => {
+    await new Promise<void>((resolve) => {
       void sshExecutionService.executeCommand(
         server,
         'pct list',
@@ -530,7 +528,7 @@ async function batchDetectContainerTypes(server: Server): Promise<Map<string, bo
     
     // Get VMs from qm list
     let qmOutput = '';
-    await new Promise<void>((resolve, reject) => {
+    await new Promise<void>((resolve) => {
       void sshExecutionService.executeCommand(
         server,
         'qm list',
@@ -975,10 +973,11 @@ export const installedScriptsRouter = createTRPCRouter({
         };
 
         // Helper function to check config file for community-script tag and extract hostname/name
+        const nodeName = (server as Server).name;
         const checkConfigAndExtractInfo = async (id: string, isVM: boolean): Promise<any> => {
           const configPath = isVM 
-            ? `/etc/pve/qemu-server/${id}.conf`
+            ? `/etc/pve/nodes/${nodeName}/qemu-server/${id}.conf`
-            : `/etc/pve/lxc/${id}.conf`;
+            : `/etc/pve/nodes/${nodeName}/lxc/${id}.conf`;
           
           const readCommand = `cat "${configPath}" 2>/dev/null`;
           
@@ -1064,7 +1063,7 @@ export const installedScriptsRouter = createTRPCRouter({
               reject(new Error(`pct list failed: ${error}`));
             },
             (_exitCode: number) => {
-              resolve();
+              setImmediate(() => resolve());
             }
           );
         });
@@ -1083,7 +1082,7 @@ export const installedScriptsRouter = createTRPCRouter({
               reject(new Error(`qm list failed: ${error}`));
             },
             (_exitCode: number) => {
-              resolve();
+              setImmediate(() => resolve());
             }
           );
         });
@@ -1322,10 +1321,10 @@ export const installedScriptsRouter = createTRPCRouter({
                 
                 // Check if ID exists in either pct list (containers) or qm list (VMs)
                 if (!existingIds.has(containerId)) {
-                  // Also verify config file doesn't exist as a double-check
+                  // Also verify config file doesn't exist as a double-check (node-specific paths)
-                  // Check both container and VM config paths
+                  const nodeName = (server as Server).name;
-                  const checkContainerCommand = `test -f "/etc/pve/lxc/${containerId}.conf" && echo "exists" || echo "not_found"`;
+                  const checkContainerCommand = `test -f "/etc/pve/nodes/${nodeName}/lxc/${containerId}.conf" && echo "exists" || echo "not_found"`;
-                  const checkVMCommand = `test -f "/etc/pve/qemu-server/${containerId}.conf" && echo "exists" || echo "not_found"`;
+                  const checkVMCommand = `test -f "/etc/pve/nodes/${nodeName}/qemu-server/${containerId}.conf" && echo "exists" || echo "not_found"`;
                   
                   const configExists = await new Promise<boolean>((resolve) => {
                     let combinedOutput = '';
@@ -2072,32 +2071,72 @@ export const installedScriptsRouter = createTRPCRouter({
           };
         }
 
-        // Get the script's interface_port from metadata (prioritize metadata over existing database values)
+        // Resolve app slug from /usr/bin/update (community-scripts) when available; else from hostname/suffix.
-        let detectedPort = 80; // Default fallback
+        let slugFromUpdate: string | null = null;
-        
+        try {
+          const updateCommand = `pct exec ${scriptData.container_id} -- cat /usr/bin/update 2>/dev/null`;
+          let updateOutput = '';
+          await new Promise<void>((resolve) => {
+            void sshExecutionService.executeCommand(
+              server as Server,
+              updateCommand,
+              (data: string) => { updateOutput += data; },
+              () => {},
+              () => resolve()
+            );
+          });
+          const ctSlugMatch = /ct\/([a-zA-Z0-9_.-]+)\.sh/.exec(updateOutput);
+          if (ctSlugMatch?.[1]) {
+            slugFromUpdate = ctSlugMatch[1].trim().toLowerCase();
+            console.log('🔍 Slug from /usr/bin/update:', slugFromUpdate);
+          }
+        } catch {
+          // Container may not be from community-scripts; use hostname fallback
+        }
+
+        // Get the script's interface_port from metadata. Primary: slug from /usr/bin/update; fallback: hostname/suffix.
+        let detectedPort = 80; // Default fallback
+
         try {
-          // Import localScriptsService to get script metadata
           const { localScriptsService } = await import('~/server/services/localScripts');
-          
-          // Get all scripts and find the one matching our script name
           const allScripts = await localScriptsService.getAllScripts();
-          
+
-          // Extract script slug from script_name (remove .sh extension)
+          const nameFromHostname = scriptData.script_name.replace(/\.sh$/, '').toLowerCase();
-          const scriptSlug = scriptData.script_name.replace(/\.sh$/, '');
+
-          console.log('🔍 Looking for script with slug:', scriptSlug);
+          // Primary: slug from /usr/bin/update (community-scripts)
-          
+          let scriptMetadata =
-          const scriptMetadata = allScripts.find(script => script.slug === scriptSlug);
+            slugFromUpdate != null
-          
+              ? allScripts.find((s) => s.slug === slugFromUpdate)
+              : undefined;
+          if (scriptMetadata) {
+            console.log('🔍 Using slug from /usr/bin/update for metadata:', scriptMetadata.slug);
+          }
+
+          // Fallback: exact hostname then hostname ends with slug (longest wins)
+          if (!scriptMetadata) {
+            scriptMetadata = allScripts.find((script) => script.slug === nameFromHostname);
+            if (!scriptMetadata) {
+              const suffixMatches = allScripts.filter((script) => nameFromHostname.endsWith(script.slug));
+              scriptMetadata =
+                suffixMatches.length > 0
+                  ? suffixMatches.reduce((a, b) => (a.slug.length >= b.slug.length ? a : b))
+                  : undefined;
+              if (scriptMetadata) {
+                console.log('🔍 Matched metadata by slug suffix in hostname:', scriptMetadata.slug);
+              }
+            }
+          }
+
           if (scriptMetadata?.interface_port) {
             detectedPort = scriptMetadata.interface_port;
             console.log('📋 Found interface_port in metadata:', detectedPort);
           } else {
             console.log('📋 No interface_port found in metadata, using default port 80');
-            detectedPort = 80; // Default to port 80 if no metadata port found
+            detectedPort = 80;
           }
         } catch (error) {
           console.log('⚠️ Error getting script metadata, using default port 80:', error);
-          detectedPort = 80; // Default to port 80 if metadata lookup fails
+          detectedPort = 80;
         }
         
         console.log('🎯 Final detected port:', detectedPort);
@@ -2201,8 +2240,9 @@ export const installedScriptsRouter = createTRPCRouter({
           };
         }
 
-        // Read config file
+        // Read config file (node-specific path)
-        const configPath = `/etc/pve/lxc/${script.container_id}.conf`;
+        const nodeName = (server as Server).name;
+        const configPath = `/etc/pve/nodes/${nodeName}/lxc/${script.container_id}.conf`;
         const readCommand = `cat "${configPath}" 2>/dev/null`;
         let rawConfig = '';
         
@@ -2332,8 +2372,9 @@ export const installedScriptsRouter = createTRPCRouter({
           };
         }
 
-        // Write config file using heredoc for safe escaping
+        // Write config file using heredoc for safe escaping (node-specific path)
-        const configPath = `/etc/pve/lxc/${script.container_id}.conf`;
+        const nodeName = (server as Server).name;
+        const configPath = `/etc/pve/nodes/${nodeName}/lxc/${script.container_id}.conf`;
         const writeCommand = `cat > "${configPath}" << 'EOFCONFIG'
 ${rawConfig}
 EOFCONFIG`;
@@ -2651,5 +2692,564 @@ EOFCONFIG`;
           executionId: null
         };
       }
+    }),
+
+  // Get next free ID from cluster (single ID for sequential cloning)
+  getClusterNextId: publicProcedure
+    .input(z.object({ 
+      serverId: z.number()
+    }))
+    .query(async ({ input }) => {
+      try {
+        const db = getDatabase();
+        const server = await db.getServerById(input.serverId);
+        
+        if (!server) {
+          return {
+            success: false,
+            error: 'Server not found',
+            nextId: null
+          };
+        }
+
+        const { getSSHExecutionService } = await import('~/server/ssh-execution-service');
+        const sshExecutionService = getSSHExecutionService();
+        
+        let output = '';
+        await new Promise<void>((resolve, reject) => {
+          sshExecutionService.executeCommand(
+            server as Server,
+            'pvesh get /cluster/nextid',
+            (data: string) => {
+              output += data;
+            },
+            (error: string) => {
+              reject(new Error(`Failed to get next ID: ${error}`));
+            },
+            (exitCode: number) => {
+              if (exitCode === 0) {
+                resolve();
+              } else {
+                reject(new Error(`pvesh command failed with exit code ${exitCode}`));
+              }
+            }
+          );
+        });
+
+        const nextId = output.trim();
+        if (!nextId || !/^\d+$/.test(nextId)) {
+          return {
+            success: false,
+            error: 'Invalid next ID received',
+            nextId: null
+          };
+        }
+
+        return {
+          success: true,
+          nextId
+        };
+      } catch (error) {
+        console.error('Error in getClusterNextId:', error);
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : 'Failed to get next ID',
+          nextId: null
+        };
+      }
+    }),
+
+  // Get container hostname/name
+  getContainerHostname: publicProcedure
+    .input(z.object({ 
+      containerId: z.string(),
+      serverId: z.number(),
+      containerType: z.enum(['lxc', 'vm'])
+    }))
+    .query(async ({ input }) => {
+      try {
+        const db = getDatabase();
+        const server = await db.getServerById(input.serverId);
+        
+        if (!server) {
+          return {
+            success: false,
+            error: 'Server not found',
+            hostname: null
+          };
+        }
+
+        const { getSSHExecutionService } = await import('~/server/ssh-execution-service');
+        const sshExecutionService = getSSHExecutionService();
+        
+        const nodeName = (server as Server).name;
+        const configPath = input.containerType === 'lxc' 
+          ? `/etc/pve/nodes/${nodeName}/lxc/${input.containerId}.conf`
+          : `/etc/pve/nodes/${nodeName}/qemu-server/${input.containerId}.conf`;
+        
+        let configContent = '';
+        await new Promise<void>((resolve) => {
+          sshExecutionService.executeCommand(
+            server as Server,
+            `cat "${configPath}" 2>/dev/null || echo ""`,
+            (data: string) => {
+              configContent += data;
+            },
+            () => resolve(), // Don't fail on error
+            () => resolve() // Always resolve
+          );
+        });
+
+        if (!configContent.trim()) {
+          return {
+            success: true,
+            hostname: null
+          };
+        }
+
+        // Parse config for hostname (LXC) or name (VM)
+        const lines = configContent.split('\n');
+        for (const line of lines) {
+          const trimmed = line.trim();
+          if (input.containerType === 'lxc' && trimmed.startsWith('hostname:')) {
+            const hostname = trimmed.substring(9).trim();
+            return {
+              success: true,
+              hostname
+            };
+          } else if (input.containerType === 'vm' && trimmed.startsWith('name:')) {
+            const name = trimmed.substring(5).trim();
+            return {
+              success: true,
+              hostname: name
+            };
+          }
+        }
+
+        return {
+          success: true,
+          hostname: null
+        };
+      } catch (error) {
+        console.error('Error in getContainerHostname:', error);
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : 'Failed to get container hostname',
+          hostname: null
+        };
+      }
+    }),
+
+  // Get clone storages (rootdir or images content)
+  getCloneStorages: publicProcedure
+    .input(z.object({ 
+      serverId: z.number(), 
+      forceRefresh: z.boolean().optional().default(false) 
+    }))
+    .query(async ({ input }) => {
+      try {
+        const db = getDatabase();
+        const server = await db.getServerById(input.serverId);
+        
+        if (!server) {
+          return {
+            success: false,
+            error: 'Server not found',
+            storages: [],
+            cached: false
+          };
+        }
+
+        const storageService = getStorageService();
+        const { default: SSHService } = await import('~/server/ssh-service');
+        const { getSSHExecutionService } = await import('~/server/ssh-execution-service');
+        const sshService = new SSHService();
+        const sshExecutionService = getSSHExecutionService();
+        
+        // Test SSH connection first
+        const connectionTest = await sshService.testSSHConnection(server as Server);
+        if (!(connectionTest as any).success) {
+          return {
+            success: false,
+            error: `SSH connection failed: ${(connectionTest as any).error ?? 'Unknown error'}`,
+            storages: [],
+            cached: false
+          };
+        }
+
+        // Get server hostname to filter storages
+        let serverHostname = '';
+        try {
+          await new Promise<void>((resolve, reject) => {
+            sshExecutionService.executeCommand(
+              server as Server,
+              'hostname',
+              (data: string) => {
+                serverHostname += data;
+              },
+              (error: string) => {
+                reject(new Error(`Failed to get hostname: ${error}`));
+              },
+              (exitCode: number) => {
+                if (exitCode === 0) {
+                  resolve();
+                } else {
+                  reject(new Error(`hostname command failed with exit code ${exitCode}`));
+                }
+              }
+            );
+          });
+        } catch (error) {
+          console.error('Error getting server hostname:', error);
+          // Continue without filtering if hostname can't be retrieved
+        }
+        
+        const normalizedHostname = serverHostname.trim().toLowerCase();
+        
+        // Check if we have cached data
+        const wasCached = !input.forceRefresh;
+        
+        // Fetch storages (will use cache if not forcing refresh)
+        const allStorages = await storageService.getStorages(server as Server, input.forceRefresh);
+        
+        // Filter storages by node hostname matching and content type (only rootdir for cloning)
+        const applicableStorages = allStorages.filter(storage => {
+          // Check content type - must have rootdir for cloning
+          const hasRootdir = storage.content.includes('rootdir');
+          if (!hasRootdir) {
+            return false;
+          }
+          
+          // If storage has no nodes specified, it's available on all nodes
+          if (!storage.nodes || storage.nodes.length === 0) {
+            return true;
+          }
+          
+          // If we couldn't get hostname, include all storages (fallback)
+          if (!normalizedHostname) {
+            return true;
+          }
+          
+          // Check if server hostname is in the nodes array (case-insensitive, trimmed)
+          const normalizedNodes = storage.nodes.map(node => node.trim().toLowerCase());
+          return normalizedNodes.includes(normalizedHostname);
+        });
+        
+        return {
+          success: true,
+          storages: applicableStorages,
+          cached: wasCached && applicableStorages.length > 0
+        };
+      } catch (error) {
+        console.error('Error in getCloneStorages:', error);
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : 'Failed to fetch storages',
+          storages: [],
+          cached: false
+        };
+      }
+    }),
+
+  // Generate clone hostnames
+  generateCloneHostnames: publicProcedure
+    .input(z.object({ 
+      originalHostname: z.string(),
+      containerType: z.enum(['lxc', 'vm']),
+      serverId: z.number(),
+      count: z.number().min(1).max(100)
+    }))
+    .query(async ({ input }) => {
+      try {
+        const db = getDatabase();
+        const server = await db.getServerById(input.serverId);
+        
+        if (!server) {
+          return {
+            success: false,
+            error: 'Server not found',
+            hostnames: []
+          };
+        }
+
+        const { getSSHExecutionService } = await import('~/server/ssh-execution-service');
+        const sshExecutionService = getSSHExecutionService();
+        
+        // Get all existing containers/VMs to find existing clones (check both LXC and VM)
+        const existingHostnames = new Set<string>();
+        
+        // Check LXC containers
+        let lxcOutput = '';
+        try {
+          await new Promise<void>((resolve) => {
+            sshExecutionService.executeCommand(
+              server as Server,
+              'pct list',
+              (data: string) => {
+                lxcOutput += data;
+              },
+              (error: string) => {
+                console.error(`pct list error for server ${server.name}:`, error);
+                resolve();
+              },
+              () => resolve()
+            );
+          });
+          
+          const lxcLines = lxcOutput.split('\n').filter(line => line.trim());
+          for (const line of lxcLines) {
+            if (line.includes('CTID') || line.includes('NAME')) continue;
+            const parts = line.trim().split(/\s+/);
+            if (parts.length >= 3) {
+              const name = parts.slice(2).join(' ').trim();
+              if (name) {
+                existingHostnames.add(name.toLowerCase());
+              }
+            }
+          }
+        } catch {
+          // Continue even if LXC list fails
+        }
+        
+        // Check VMs
+        let vmOutput = '';
+        try {
+          await new Promise<void>((resolve) => {
+            sshExecutionService.executeCommand(
+              server as Server,
+              'qm list',
+              (data: string) => {
+                vmOutput += data;
+              },
+              (error: string) => {
+                console.error(`qm list error for server ${server.name}:`, error);
+                resolve();
+              },
+              () => resolve()
+            );
+          });
+          
+          const vmLines = vmOutput.split('\n').filter(line => line.trim());
+          for (const line of vmLines) {
+            if (line.includes('VMID') || line.includes('NAME')) continue;
+            const parts = line.trim().split(/\s+/);
+            if (parts.length >= 3) {
+              const name = parts.slice(2).join(' ').trim();
+              if (name) {
+                existingHostnames.add(name.toLowerCase());
+              }
+            }
+          }
+        } catch {
+          // Continue even if VM list fails
+        }
+
+        // Find next available clone number
+        const clonePattern = new RegExp(`^${input.originalHostname.toLowerCase()}-clone-(\\d+)$`);
+        const existingCloneNumbers: number[] = [];
+        
+        for (const hostname of existingHostnames) {
+          const match = hostname.match(clonePattern);
+          if (match) {
+            existingCloneNumbers.push(parseInt(match[1] ?? '0', 10));
+          }
+        }
+
+        // Determine starting number
+        let nextNumber = 1;
+        if (existingCloneNumbers.length > 0) {
+          existingCloneNumbers.sort((a, b) => a - b);
+          const lastNumber = existingCloneNumbers[existingCloneNumbers.length - 1];
+          if (lastNumber !== undefined) {
+            nextNumber = lastNumber + 1;
+          }
+        }
+
+        // Generate hostnames
+        const hostnames: string[] = [];
+        for (let i = 0; i < input.count; i++) {
+          hostnames.push(`${input.originalHostname}-clone-${nextNumber + i}`);
+        }
+
+        return {
+          success: true,
+          hostnames
+        };
+      } catch (error) {
+        console.error('Error in generateCloneHostnames:', error);
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : 'Failed to generate clone hostnames',
+          hostnames: []
+        };
+      }
+    }),
+
+  // Execute clone (prepare for websocket execution)
+  // Note: nextIds will be obtained sequentially during cloning in server.js
+  executeClone: publicProcedure
+    .input(z.object({ 
+      containerId: z.string(),
+      serverId: z.number(),
+      storage: z.string(),
+      cloneCount: z.number().min(1).max(100),
+      hostnames: z.array(z.string()),
+      containerType: z.enum(['lxc', 'vm'])
+    }))
+    .mutation(async ({ input }) => {
+      try {
+        const db = getDatabase();
+        const server = await db.getServerById(input.serverId);
+        
+        if (!server) {
+          return {
+            success: false,
+            error: 'Server not found',
+            executionId: null
+          };
+        }
+
+        const { default: SSHService } = await import('~/server/ssh-service');
+        const sshService = new SSHService();
+        
+        // Test SSH connection first
+        const connectionTest = await sshService.testSSHConnection(server as Server);
+        if (!(connectionTest as any).success) {
+          return {
+            success: false,
+            error: `SSH connection failed: ${(connectionTest as any).error ?? 'Unknown error'}`,
+            executionId: null
+          };
+        }
+
+        // Validate inputs
+        if (input.hostnames.length !== input.cloneCount) {
+          return {
+            success: false,
+            error: 'Hostnames count must match clone count',
+            executionId: null
+          };
+        }
+
+        // Generate execution ID for websocket tracking
+        const executionId = `clone_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
+        
+        return {
+          success: true,
+          executionId,
+          containerId: input.containerId,
+          storage: input.storage,
+          cloneCount: input.cloneCount,
+          hostnames: input.hostnames,
+          containerType: input.containerType,
+          server: server as Server
+        };
+      } catch (error) {
+        console.error('Error in executeClone:', error);
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : 'Failed to execute clone',
+          executionId: null
+        };
+      }
+    }),
+
+  // Add cloned container to database
+  addClonedContainerToDatabase: publicProcedure
+    .input(z.object({ 
+      containerId: z.string(),
+      serverId: z.number(),
+      containerType: z.enum(['lxc', 'vm'])
+    }))
+    .mutation(async ({ input }) => {
+      try {
+        const db = getDatabase();
+        const server = await db.getServerById(input.serverId);
+        
+        if (!server) {
+          return {
+            success: false,
+            error: 'Server not found',
+            scriptId: null
+          };
+        }
+
+        const { getSSHExecutionService } = await import('~/server/ssh-execution-service');
+        const sshExecutionService = getSSHExecutionService();
+        
+        // Read config file to get hostname/name (node-specific path)
+        const nodeName = (server as Server).name;
+        const configPath = input.containerType === 'lxc' 
+          ? `/etc/pve/nodes/${nodeName}/lxc/${input.containerId}.conf`
+          : `/etc/pve/nodes/${nodeName}/qemu-server/${input.containerId}.conf`;
+        
+        let configContent = '';
+        await new Promise<void>((resolve) => {
+          sshExecutionService.executeCommand(
+            server as Server,
+            `cat "${configPath}" 2>/dev/null || echo ""`,
+            (data: string) => {
+              configContent += data;
+            },
+            () => resolve(),
+            () => resolve()
+          );
+        });
+
+        if (!configContent.trim()) {
+          return {
+            success: false,
+            error: 'Config file not found',
+            scriptId: null
+          };
+        }
+
+        // Parse config for hostname/name
+        let hostname = '';
+        const lines = configContent.split('\n');
+        for (const line of lines) {
+          const trimmed = line.trim();
+          if (input.containerType === 'lxc' && trimmed.startsWith('hostname:')) {
+            hostname = trimmed.substring(9).trim();
+            break;
+          } else if (input.containerType === 'vm' && trimmed.startsWith('name:')) {
+            hostname = trimmed.substring(5).trim();
+            break;
+          }
+        }
+
+        if (!hostname) {
+          hostname = `${input.containerType}-${input.containerId}`;
+        }
+
+        // Create installed script record
+        const script = await db.createInstalledScript({
+          script_name: hostname,
+          script_path: `cloned/${hostname}`,
+          container_id: input.containerId,
+          server_id: input.serverId,
+          execution_mode: 'ssh',
+          status: 'success',
+          output_log: `Cloned container/VM`
+        });
+
+        // For LXC, store config in database
+        if (input.containerType === 'lxc') {
+          const parsedConfig = parseRawConfig(configContent);
+          await db.createLXCConfig(script.id, parsedConfig);
+        }
+
+        return {
+          success: true,
+          scriptId: script.id
+        };
+      } catch (error) {
+        console.error('Error in addClonedContainerToDatabase:', error);
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : 'Failed to add cloned container to database',
+          scriptId: null
+        };
+      }
     })
 });

src/server/api/routers/scripts.ts

@@ -7,7 +7,10 @@ import { localScriptsService } from "~/server/services/localScripts";
 import { scriptDownloaderService } from "~/server/services/scriptDownloader.js";
 import { AutoSyncService } from "~/server/services/autoSyncService";
 import { repositoryService } from "~/server/services/repositoryService";
+import { getStorageService } from "~/server/services/storageService";
+import { getDatabase } from "~/server/database-prisma";
 import type { ScriptCard } from "~/types/script";
+import type { Server } from "~/types/server";
 
 export const scriptsRouter = createTRPCRouter({
   // Get all available scripts
@@ -637,5 +640,194 @@ export const scriptsRouter = createTRPCRouter({
           status: null
         };
       }
+    }),
+
+  // Get rootfs storages for a server (for container creation)
+  getRootfsStorages: publicProcedure
+    .input(z.object({ 
+      serverId: z.number(),
+      forceRefresh: z.boolean().optional().default(false)
+    }))
+    .query(async ({ input }) => {
+      try {
+        const db = getDatabase();
+        const server = await db.getServerById(input.serverId);
+        
+        if (!server) {
+          return {
+            success: false,
+            error: 'Server not found',
+            storages: []
+          };
+        }
+
+        // Get server hostname to filter storages by node assignment
+        const { getSSHExecutionService } = await import('~/server/ssh-execution-service');
+        const sshExecutionService = getSSHExecutionService();
+        let serverHostname = '';
+        try {
+          await new Promise<void>((resolve, reject) => {
+            void sshExecutionService.executeCommand(
+              server as Server,
+              'hostname',
+              (data: string) => {
+                serverHostname += data;
+              },
+              (error: string) => {
+                reject(new Error(`Failed to get hostname: ${error}`));
+              },
+              (exitCode: number) => {
+                if (exitCode === 0) {
+                  resolve();
+                } else {
+                  reject(new Error(`hostname command failed with exit code ${exitCode}`));
+                }
+              }
+            );
+          });
+        } catch (error) {
+          console.error('Error getting server hostname:', error);
+          // Continue without filtering if hostname can't be retrieved
+        }
+        
+        const normalizedHostname = serverHostname.trim().toLowerCase();
+
+        const storageService = getStorageService();
+        const allStorages = await storageService.getStorages(server as Server, input.forceRefresh);
+        
+        // Filter storages by node hostname matching and content type (rootdir for containers)
+        const rootfsStorages = allStorages.filter(storage => {
+          // Check content type - must have rootdir for containers
+          const hasRootdir = storage.content.includes('rootdir');
+          if (!hasRootdir) {
+            return false;
+          }
+          
+          // If storage has no nodes specified, it's available on all nodes
+          if (!storage.nodes || storage.nodes.length === 0) {
+            return true;
+          }
+          
+          // If we couldn't get hostname, include all storages (fallback)
+          if (!normalizedHostname) {
+            return true;
+          }
+          
+          // Check if server hostname is in the nodes array (case-insensitive, trimmed)
+          const normalizedNodes = storage.nodes.map(node => node.trim().toLowerCase());
+          return normalizedNodes.includes(normalizedHostname);
+        });
+
+        return {
+          success: true,
+          storages: rootfsStorages.map(s => ({
+            name: s.name,
+            type: s.type,
+            content: s.content
+          }))
+        };
+      } catch (error) {
+        console.error('Error fetching rootfs storages:', error);
+        // Return empty array on error (as per plan requirement)
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : 'Failed to fetch storages',
+          storages: []
+        };
+      }
+    }),
+
+  // Get template storages for a server (for template storage selection)
+  getTemplateStorages: publicProcedure
+    .input(z.object({ 
+      serverId: z.number(),
+      forceRefresh: z.boolean().optional().default(false)
+    }))
+    .query(async ({ input }) => {
+      try {
+        const db = getDatabase();
+        const server = await db.getServerById(input.serverId);
+        
+        if (!server) {
+          return {
+            success: false,
+            error: 'Server not found',
+            storages: []
+          };
+        }
+
+        // Get server hostname to filter storages by node assignment
+        const { getSSHExecutionService } = await import('~/server/ssh-execution-service');
+        const sshExecutionService = getSSHExecutionService();
+        let serverHostname = '';
+        try {
+          await new Promise<void>((resolve, reject) => {
+            void sshExecutionService.executeCommand(
+              server as Server,
+              'hostname',
+              (data: string) => {
+                serverHostname += data;
+              },
+              (error: string) => {
+                reject(new Error(`Failed to get hostname: ${error}`));
+              },
+              (exitCode: number) => {
+                if (exitCode === 0) {
+                  resolve();
+                } else {
+                  reject(new Error(`hostname command failed with exit code ${exitCode}`));
+                }
+              }
+            );
+          });
+        } catch (error) {
+          console.error('Error getting server hostname:', error);
+          // Continue without filtering if hostname can't be retrieved
+        }
+        
+        const normalizedHostname = serverHostname.trim().toLowerCase();
+
+        const storageService = getStorageService();
+        const allStorages = await storageService.getStorages(server as Server, input.forceRefresh);
+        
+        // Filter storages by node hostname matching and content type (vztmpl for templates)
+        const templateStorages = allStorages.filter(storage => {
+          // Check content type - must have vztmpl for templates
+          const hasVztmpl = storage.content.includes('vztmpl');
+          if (!hasVztmpl) {
+            return false;
+          }
+          
+          // If storage has no nodes specified, it's available on all nodes
+          if (!storage.nodes || storage.nodes.length === 0) {
+            return true;
+          }
+          
+          // If we couldn't get hostname, include all storages (fallback)
+          if (!normalizedHostname) {
+            return true;
+          }
+          
+          // Check if server hostname is in the nodes array (case-insensitive, trimmed)
+          const normalizedNodes = storage.nodes.map(node => node.trim().toLowerCase());
+          return normalizedNodes.includes(normalizedHostname);
+        });
+
+        return {
+          success: true,
+          storages: templateStorages.map(s => ({
+            name: s.name,
+            type: s.type,
+            content: s.content
+          }))
+        };
+      } catch (error) {
+        console.error('Error fetching template storages:', error);
+        return {
+          success: false,
+          error: error instanceof Error ? error.message : 'Failed to fetch storages',
+          storages: []
+        };
+      }
     })
 });

src/server/api/routers/version.ts

@@ -238,6 +238,27 @@ export const versionRouter = createTRPCRouter({
         // Clear/create the log file
         await writeFile(logPath, '', 'utf-8');
         
+        // Always fetch the latest update.sh from GitHub before running
+        // This ensures we always use the newest update script, avoiding
+        // the "chicken-and-egg" problem where old scripts can't update properly
+        const updateScriptUrl = 'https://raw.githubusercontent.com/community-scripts/ProxmoxVE-Local/main/update.sh';
+        try {
+          const response = await fetch(updateScriptUrl);
+          if (response.ok) {
+            const latestScript = await response.text();
+            await writeFile(updateScriptPath, latestScript, { mode: 0o755 });
+            // Log that we fetched the latest script
+            await writeFile(logPath, '[INFO] Fetched latest update.sh from GitHub\n', { flag: 'a' });
+          } else {
+            // If fetch fails, log warning but continue with local script
+            await writeFile(logPath, `[WARNING] Could not fetch latest update.sh (HTTP ${response.status}), using local version\n`, { flag: 'a' });
+          }
+        } catch (fetchError) {
+          // If fetch fails, log warning but continue with local script
+          const errorMsg = fetchError instanceof Error ? fetchError.message : 'Unknown error';
+          await writeFile(logPath, `[WARNING] Could not fetch latest update.sh: ${errorMsg}, using local version\n`, { flag: 'a' });
+        }
+        
         // Spawn the update script as a detached process using nohup
         // This allows it to run independently and kill the parent Node.js process
         // Redirect output to log file

src/server/db.js

@@ -1,9 +1,22 @@
 import 'dotenv/config'
 import { PrismaClient } from '../../prisma/generated/prisma/client.ts'
 import { PrismaBetterSqlite3 } from '@prisma/adapter-better-sqlite3'
+import { existsSync, mkdirSync } from 'fs'
+import { dirname } from 'path'
 
 const globalForPrisma = globalThis;
 
+// Ensure database directory exists before initializing Prisma
+// DATABASE_URL format: file:/path/to/database.db
+const dbUrl = process.env.DATABASE_URL || 'file:./data/settings.db';
+const dbPath = dbUrl.replace(/^file:/, '');
+const dbDir = dirname(dbPath);
+
+if (!existsSync(dbDir)) {
+  console.log(`Creating database directory: ${dbDir}`);
+  mkdirSync(dbDir, { recursive: true });
+}
+
 const adapter = new PrismaBetterSqlite3({ url: process.env.DATABASE_URL });
 
 export const prisma = globalForPrisma.prisma ?? new PrismaClient({ adapter });

src/server/db.ts

@@ -1,9 +1,22 @@
 import 'dotenv/config'
 import { PrismaClient } from '../../prisma/generated/prisma/client'
 import { PrismaBetterSqlite3 } from '@prisma/adapter-better-sqlite3'
+import { existsSync, mkdirSync } from 'fs'
+import { dirname } from 'path'
 
 const globalForPrisma = globalThis as { prisma?: PrismaClient };
 
+// Ensure database directory exists before initializing Prisma
+// DATABASE_URL format: file:/path/to/database.db
+const dbUrl = process.env.DATABASE_URL || 'file:./data/settings.db';
+const dbPath = dbUrl.replace(/^file:/, '');
+const dbDir = dirname(dbPath);
+
+if (!existsSync(dbDir)) {
+  console.log(`Creating database directory: ${dbDir}`);
+  mkdirSync(dbDir, { recursive: true });
+}
+
 const adapter = new PrismaBetterSqlite3({ url: process.env.DATABASE_URL! });
 
 export const prisma: PrismaClient = globalForPrisma.prisma ?? new PrismaClient({

src/server/lib/gitProvider/bitbucket.ts

@@ -0,0 +1,55 @@
+import type { DirEntry, GitProvider } from './types';
+import { parseRepoUrl } from '../repositoryUrlValidation';
+
+export class BitbucketProvider implements GitProvider {
+  async listDirectory(repoUrl: string, path: string, branch: string): Promise<DirEntry[]> {
+    const { owner, repo } = parseRepoUrl(repoUrl);
+    const listUrl = `https://api.bitbucket.org/2.0/repositories/${owner}/${repo}/src/${encodeURIComponent(branch)}/${path}`;
+    const headers: Record<string, string> = {
+      'User-Agent': 'PVEScripts-Local/1.0',
+    };
+    const token = process.env.BITBUCKET_APP_PASSWORD ?? process.env.BITBUCKET_TOKEN;
+    if (token) {
+      const auth = Buffer.from(`:${token}`).toString('base64');
+      headers.Authorization = `Basic ${auth}`;
+    }
+
+    const response = await fetch(listUrl, { headers });
+    if (!response.ok) {
+      throw new Error(`Bitbucket API error: ${response.status} ${response.statusText}`);
+    }
+
+    const body = (await response.json()) as { values?: { path: string; type: string }[] };
+    const data = body.values ?? (Array.isArray(body) ? body : []);
+    if (!Array.isArray(data)) {
+      throw new Error('Bitbucket API returned unexpected response');
+    }
+    return data.map((item: { path: string; type: string }) => {
+      const name = item.path.split('/').pop() ?? item.path;
+      return {
+        name,
+        path: item.path,
+        type: item.type === 'commit_directory' ? ('dir' as const) : ('file' as const),
+      };
+    });
+  }
+
+  async downloadRawFile(repoUrl: string, filePath: string, branch: string): Promise<string> {
+    const { owner, repo } = parseRepoUrl(repoUrl);
+    const rawUrl = `https://api.bitbucket.org/2.0/repositories/${owner}/${repo}/src/${encodeURIComponent(branch)}/${filePath}`;
+    const headers: Record<string, string> = {
+      'User-Agent': 'PVEScripts-Local/1.0',
+    };
+    const token = process.env.BITBUCKET_APP_PASSWORD ?? process.env.BITBUCKET_TOKEN;
+    if (token) {
+      const auth = Buffer.from(`:${token}`).toString('base64');
+      headers.Authorization = `Basic ${auth}`;
+    }
+
+    const response = await fetch(rawUrl, { headers });
+    if (!response.ok) {
+      throw new Error(`Failed to download ${filePath}: ${response.status} ${response.statusText}`);
+    }
+    return response.text();
+  }
+}

src/server/lib/gitProvider/custom.ts

@@ -0,0 +1,44 @@
+import type { DirEntry, GitProvider } from "./types";
+import { parseRepoUrl } from "../repositoryUrlValidation";
+
+export class CustomProvider implements GitProvider {
+  async listDirectory(repoUrl: string, path: string, branch: string): Promise<DirEntry[]> {
+    const { origin, owner, repo } = parseRepoUrl(repoUrl);
+    const apiUrl = `${origin}/api/v1/repos/${owner}/${repo}/contents/${path}?ref=${encodeURIComponent(branch)}`;
+    const headers: Record<string, string> = { "User-Agent": "PVEScripts-Local/1.0" };
+    const token = process.env.GITEA_TOKEN ?? process.env.GIT_TOKEN;
+    if (token) headers.Authorization = `token ${token}`;
+
+    const response = await fetch(apiUrl, { headers });
+    if (!response.ok) {
+      throw new Error(`Custom Git server: list directory failed (${response.status}).`);
+    }
+    const data = (await response.json()) as { type: string; name: string; path: string }[];
+    if (!Array.isArray(data)) {
+      const single = data as unknown as { type?: string; name?: string; path?: string };
+      if (single?.name) {
+        return [{ name: single.name, path: single.path ?? path, type: single.type === "dir" ? "dir" : "file" }];
+      }
+      throw new Error("Custom Git server returned unexpected response");
+    }
+    return data.map((item) => ({
+      name: item.name,
+      path: item.path,
+      type: item.type === "dir" ? ("dir" as const) : ("file" as const),
+    }));
+  }
+
+  async downloadRawFile(repoUrl: string, filePath: string, branch: string): Promise<string> {
+    const { origin, owner, repo } = parseRepoUrl(repoUrl);
+    const rawUrl = `${origin}/${owner}/${repo}/raw/${encodeURIComponent(branch)}/${filePath}`;
+    const headers: Record<string, string> = { "User-Agent": "PVEScripts-Local/1.0" };
+    const token = process.env.GITEA_TOKEN ?? process.env.GIT_TOKEN;
+    if (token) headers.Authorization = `token ${token}`;
+
+    const response = await fetch(rawUrl, { headers });
+    if (!response.ok) {
+      throw new Error(`Failed to download ${filePath} from custom Git server (${response.status}).`);
+    }
+    return response.text();
+  }
+}

src/server/lib/gitProvider/github.ts

@@ -0,0 +1,60 @@
+import type { DirEntry, GitProvider } from './types';
+import { parseRepoUrl } from '../repositoryUrlValidation';
+
+export class GitHubProvider implements GitProvider {
+  async listDirectory(repoUrl: string, path: string, branch: string): Promise<DirEntry[]> {
+    const { owner, repo } = parseRepoUrl(repoUrl);
+    const apiUrl = `https://api.github.com/repos/${owner}/${repo}/contents/${path}?ref=${encodeURIComponent(branch)}`;
+    const headers: Record<string, string> = {
+      Accept: 'application/vnd.github.v3+json',
+      'User-Agent': 'PVEScripts-Local/1.0',
+    };
+    const token = process.env.GITHUB_TOKEN;
+    if (token) headers.Authorization = `token ${token}`;
+
+    const response = await fetch(apiUrl, { headers });
+    if (!response.ok) {
+      if (response.status === 403) {
+        const err = new Error(
+          `GitHub API rate limit exceeded. Consider setting GITHUB_TOKEN. Status: ${response.status} ${response.statusText}`
+        );
+        (err as Error & { name: string }).name = 'RateLimitError';
+        throw err;
+      }
+      throw new Error(`GitHub API error: ${response.status} ${response.statusText}`);
+    }
+
+    const data = (await response.json()) as { type: string; name: string; path: string }[];
+    if (!Array.isArray(data)) {
+      throw new Error('GitHub API returned unexpected response');
+    }
+    return data.map((item) => ({
+      name: item.name,
+      path: item.path,
+      type: item.type === 'dir' ? ('dir' as const) : ('file' as const),
+    }));
+  }
+
+  async downloadRawFile(repoUrl: string, filePath: string, branch: string): Promise<string> {
+    const { owner, repo } = parseRepoUrl(repoUrl);
+    const rawUrl = `https://raw.githubusercontent.com/${owner}/${repo}/${encodeURIComponent(branch)}/${filePath}`;
+    const headers: Record<string, string> = {
+      'User-Agent': 'PVEScripts-Local/1.0',
+    };
+    const token = process.env.GITHUB_TOKEN;
+    if (token) headers.Authorization = `token ${token}`;
+
+    const response = await fetch(rawUrl, { headers });
+    if (!response.ok) {
+      if (response.status === 403) {
+        const err = new Error(
+          `GitHub rate limit exceeded while downloading ${filePath}. Consider setting GITHUB_TOKEN.`
+        );
+        (err as Error & { name: string }).name = 'RateLimitError';
+        throw err;
+      }
+      throw new Error(`Failed to download ${filePath}: ${response.status} ${response.statusText}`);
+    }
+    return response.text();
+  }
+}

src/server/lib/gitProvider/gitlab.ts

@@ -0,0 +1,58 @@
+import type { DirEntry, GitProvider } from './types';
+import { parseRepoUrl } from '../repositoryUrlValidation';
+
+export class GitLabProvider implements GitProvider {
+  private getBaseUrl(repoUrl: string): string {
+    const { origin } = parseRepoUrl(repoUrl);
+    return origin;
+  }
+
+  private getProjectId(repoUrl: string): string {
+    const { owner, repo } = parseRepoUrl(repoUrl);
+    return encodeURIComponent(`${owner}/${repo}`);
+  }
+
+  async listDirectory(repoUrl: string, path: string, branch: string): Promise<DirEntry[]> {
+    const baseUrl = this.getBaseUrl(repoUrl);
+    const projectId = this.getProjectId(repoUrl);
+    const apiUrl = `${baseUrl}/api/v4/projects/${projectId}/repository/tree?path=${encodeURIComponent(path)}&ref=${encodeURIComponent(branch)}&per_page=100`;
+    const headers: Record<string, string> = {
+      'User-Agent': 'PVEScripts-Local/1.0',
+    };
+    const token = process.env.GITLAB_TOKEN;
+    if (token) headers['PRIVATE-TOKEN'] = token;
+
+    const response = await fetch(apiUrl, { headers });
+    if (!response.ok) {
+      throw new Error(`GitLab API error: ${response.status} ${response.statusText}`);
+    }
+
+    const data = (await response.json()) as { type: string; name: string; path: string }[];
+    if (!Array.isArray(data)) {
+      throw new Error('GitLab API returned unexpected response');
+    }
+    return data.map((item) => ({
+      name: item.name,
+      path: item.path,
+      type: item.type === 'tree' ? ('dir' as const) : ('file' as const),
+    }));
+  }
+
+  async downloadRawFile(repoUrl: string, filePath: string, branch: string): Promise<string> {
+    const baseUrl = this.getBaseUrl(repoUrl);
+    const projectId = this.getProjectId(repoUrl);
+    const encodedPath = encodeURIComponent(filePath);
+    const rawUrl = `${baseUrl}/api/v4/projects/${projectId}/repository/files/${encodedPath}/raw?ref=${encodeURIComponent(branch)}`;
+    const headers: Record<string, string> = {
+      'User-Agent': 'PVEScripts-Local/1.0',
+    };
+    const token = process.env.GITLAB_TOKEN;
+    if (token) headers['PRIVATE-TOKEN'] = token;
+
+    const response = await fetch(rawUrl, { headers });
+    if (!response.ok) {
+      throw new Error(`Failed to download ${filePath}: ${response.status} ${response.statusText}`);
+    }
+    return response.text();
+  }
+}

src/server/lib/gitProvider/index.js

@@ -0,0 +1 @@
+export { listDirectory, downloadRawFile, getRepoProvider } from "./index.ts";

src/server/lib/gitProvider/index.ts

@@ -0,0 +1,28 @@
+import type { DirEntry, GitProvider } from "./types";
+import { getRepoProvider } from "../repositoryUrlValidation";
+import { GitHubProvider } from "./github";
+import { GitLabProvider } from "./gitlab";
+import { BitbucketProvider } from "./bitbucket";
+import { CustomProvider } from "./custom";
+
+const providers: Record<string, GitProvider> = {
+  github: new GitHubProvider(),
+  gitlab: new GitLabProvider(),
+  bitbucket: new BitbucketProvider(),
+  custom: new CustomProvider(),
+};
+
+export type { DirEntry, GitProvider };
+export { getRepoProvider };
+
+export function getGitProvider(repoUrl: string): GitProvider {
+  return providers[getRepoProvider(repoUrl)]!;
+}
+
+export async function listDirectory(repoUrl: string, path: string, branch: string): Promise<DirEntry[]> {
+  return getGitProvider(repoUrl).listDirectory(repoUrl, path, branch);
+}
+
+export async function downloadRawFile(repoUrl: string, filePath: string, branch: string): Promise<string> {
+  return getGitProvider(repoUrl).downloadRawFile(repoUrl, filePath, branch);
+}

src/server/lib/gitProvider/types.ts

@@ -0,0 +1,14 @@
+/**
+ * Git provider interface for listing and downloading repository files.
+ */
+
+export type DirEntry = {
+  name: string;
+  path: string;
+  type: 'file' | 'dir';
+};
+
+export interface GitProvider {
+  listDirectory(repoUrl: string, path: string, branch: string): Promise<DirEntry[]>;
+  downloadRawFile(repoUrl: string, filePath: string, branch: string): Promise<string>;
+}

src/server/lib/repositoryUrlValidation.js

@@ -0,0 +1,37 @@
+/**
+ * Repository URL validation (JS mirror for server.js).
+ */
+const VALID_REPO_URL =
+  /^(https?:\/\/)(github\.com|gitlab\.com|bitbucket\.org|[^/]+)\/[^/]+\/[^/]+$/;
+
+export const REPO_URL_ERROR_MESSAGE =
+  'Invalid repository URL. Supported: GitHub, GitLab, Bitbucket, and custom Git servers (e.g. https://host/owner/repo).';
+
+export function isValidRepositoryUrl(url) {
+  if (typeof url !== 'string' || !url.trim()) return false;
+  return VALID_REPO_URL.test(url.trim());
+}
+
+export function getRepoProvider(url) {
+  if (!isValidRepositoryUrl(url)) throw new Error(REPO_URL_ERROR_MESSAGE);
+  const normalized = url.trim().toLowerCase();
+  if (normalized.includes('github.com')) return 'github';
+  if (normalized.includes('gitlab.com')) return 'gitlab';
+  if (normalized.includes('bitbucket.org')) return 'bitbucket';
+  return 'custom';
+}
+
+export function parseRepoUrl(url) {
+  if (!isValidRepositoryUrl(url)) throw new Error(REPO_URL_ERROR_MESSAGE);
+  try {
+    const u = new URL(url.trim());
+    const pathParts = u.pathname.replace(/^\/+/, '').replace(/\.git\/?$/, '').split('/');
+    return {
+      origin: u.origin,
+      owner: pathParts[0] ?? '',
+      repo: pathParts[1] ?? '',
+    };
+  } catch {
+    throw new Error(REPO_URL_ERROR_MESSAGE);
+  }
+}

src/server/lib/repositoryUrlValidation.ts

@@ -0,0 +1,57 @@
+/**
+ * Repository URL validation and provider detection.
+ * Supports GitHub, GitLab, Bitbucket, and custom Git servers.
+ */
+
+const VALID_REPO_URL =
+  /^(https?:\/\/)(github\.com|gitlab\.com|bitbucket\.org|[^/]+)\/[^/]+\/[^/]+$/;
+
+export const REPO_URL_ERROR_MESSAGE =
+  'Invalid repository URL. Supported: GitHub, GitLab, Bitbucket, and custom Git servers (e.g. https://host/owner/repo).';
+
+export type RepoProvider = 'github' | 'gitlab' | 'bitbucket' | 'custom';
+
+/**
+ * Check if a string is a valid repository URL (format only).
+ */
+export function isValidRepositoryUrl(url: string): boolean {
+  if (typeof url !== 'string' || !url.trim()) return false;
+  return VALID_REPO_URL.test(url.trim());
+}
+
+/**
+ * Detect the Git provider from a repository URL.
+ */
+export function getRepoProvider(url: string): RepoProvider {
+  if (!isValidRepositoryUrl(url)) {
+    throw new Error(REPO_URL_ERROR_MESSAGE);
+  }
+  const normalized = url.trim().toLowerCase();
+  if (normalized.includes('github.com')) return 'github';
+  if (normalized.includes('gitlab.com')) return 'gitlab';
+  if (normalized.includes('bitbucket.org')) return 'bitbucket';
+  return 'custom';
+}
+
+/**
+ * Parse owner and repo from a repository URL (path segments).
+ * Works for GitHub, GitLab, Bitbucket, and custom (host/owner/repo).
+ */
+export function parseRepoUrl(url: string): { origin: string; owner: string; repo: string } {
+  if (!isValidRepositoryUrl(url)) {
+    throw new Error(REPO_URL_ERROR_MESSAGE);
+  }
+  try {
+    const u = new URL(url.trim());
+    const pathParts = u.pathname.replace(/^\/+/, '').replace(/\.git\/?$/, '').split('/');
+    const owner = pathParts[0] ?? '';
+    const repo = pathParts[1] ?? '';
+    return {
+      origin: u.origin,
+      owner,
+      repo,
+    };
+  } catch {
+    throw new Error(REPO_URL_ERROR_MESSAGE);
+  }
+}

src/server/services/backupService.ts

@@ -1,4 +1,3 @@
-/* eslint-disable @typescript-eslint/no-floating-promises, @typescript-eslint/prefer-nullish-coalescing, @typescript-eslint/no-unused-vars, @typescript-eslint/prefer-regexp-exec, @typescript-eslint/prefer-optional-chain */
 import { getSSHExecutionService } from '../ssh-execution-service';
 import { getStorageService } from './storageService';
 import { getDatabase } from '../database-prisma';
@@ -328,13 +327,16 @@ class BackupService {
     // PBS supports PBS_PASSWORD and PBS_REPOSITORY environment variables for non-interactive login
     const repository = `root@pam@${pbsIp}:${pbsDatastore}`;
     
-    // Escape password for shell safety (single quotes)
+    // Escape password and fingerprint for shell safety (single quotes)
     const escapedPassword = credential.pbs_password.replace(/'/g, "'\\''");
-    
+    const fingerprint = credential.pbs_fingerprint?.trim() ?? '';
-    // Use PBS_PASSWORD environment variable for non-interactive authentication
+    const escapedFingerprint = fingerprint ? fingerprint.replace(/'/g, "'\\''") : '';
-    // Auto-accept fingerprint by piping "y" to stdin
+    const envParts = [`PBS_PASSWORD='${escapedPassword}'`, `PBS_REPOSITORY='${repository}'`];
-    // PBS will use PBS_PASSWORD env var if available, avoiding interactive prompt
+    if (escapedFingerprint) {
-    const fullCommand = `echo "y" | PBS_PASSWORD='${escapedPassword}' PBS_REPOSITORY='${repository}' timeout 10 proxmox-backup-client login --repository ${repository} 2>&1`;
+      envParts.push(`PBS_FINGERPRINT='${escapedFingerprint}'`);
+    }
+    const envStr = envParts.join(' ');
+    const fullCommand = `${envStr} timeout 10 proxmox-backup-client login --repository ${repository} 2>&1`;
     
     console.log(`[BackupService] Logging into PBS: ${repository}`);
     
@@ -420,9 +422,12 @@ class BackupService {
     
     // Build full repository string: root@pam@<IP>:<DATASTORE>
     const repository = `root@pam@${pbsIp}:${pbsDatastore}`;
-    
+    const fingerprint = credential.pbs_fingerprint?.trim() ?? '';
+    const escapedFingerprint = fingerprint ? fingerprint.replace(/'/g, "'\\''") : '';
+    const snapshotEnvParts = escapedFingerprint ? [`PBS_FINGERPRINT='${escapedFingerprint}'`] : [];
+    const snapshotEnvStr = snapshotEnvParts.length ? snapshotEnvParts.join(' ') + ' ' : '';
     // Use correct command: snapshot list ct/<CT_ID> --repository <full_repo_string>
-    const command = `timeout 30 proxmox-backup-client snapshot list ct/${ctId} --repository ${repository} 2>&1 || echo "PBS_ERROR"`;
+    const command = `${snapshotEnvStr}timeout 30 proxmox-backup-client snapshot list ct/${ctId} --repository ${repository} 2>&1 || echo "PBS_ERROR"`;
     let output = '';
     
     console.log(`[BackupService] Discovering PBS backups for CT ${ctId} on repository ${repository}`);

src/server/services/githubJsonService.js

@@ -1,7 +1,8 @@
 // JavaScript wrapper for githubJsonService (for use with node server.js)
-import { writeFile, mkdir, readdir, readFile } from 'fs/promises';
+import { writeFile, mkdir, readdir, readFile, unlink } from 'fs/promises';
 import { join } from 'path';
 import { repositoryService } from './repositoryService.js';
+import { listDirectory, downloadRawFile } from '../lib/gitProvider/index.js';
 
 // Get environment variables
 const getEnv = () => ({
@@ -28,76 +29,9 @@ class GitHubJsonService {
     }
   }
 
-  getBaseUrl(repoUrl) {
-    const urlMatch = /github\.com\/([^\/]+)\/([^\/]+)/.exec(repoUrl);
-    if (!urlMatch) {
-      throw new Error(`Invalid GitHub repository URL: ${repoUrl}`);
-    }
-    
-    const [, owner, repo] = urlMatch;
-    return `https://api.github.com/repos/${owner}/${repo}`;
-  }
-
-  extractRepoPath(repoUrl) {
-    const match = /github\.com\/([^\/]+)\/([^\/]+)/.exec(repoUrl);
-    if (!match) {
-      throw new Error('Invalid GitHub repository URL');
-    }
-    return `${match[1]}/${match[2]}`;
-  }
-
-  async fetchFromGitHub(repoUrl, endpoint) {
-    const baseUrl = this.getBaseUrl(repoUrl);
-    const env = getEnv();
-    
-    const headers = {
-      'Accept': 'application/vnd.github.v3+json',
-      'User-Agent': 'PVEScripts-Local/1.0',
-    };
-    
-    if (env.GITHUB_TOKEN) {
-      headers.Authorization = `token ${env.GITHUB_TOKEN}`;
-    }
-    
-    const response = await fetch(`${baseUrl}${endpoint}`, { headers });
-
-    if (!response.ok) {
-      if (response.status === 403) {
-        const error = new Error(`GitHub API rate limit exceeded. Consider setting GITHUB_TOKEN for higher limits. Status: ${response.status} ${response.statusText}`);
-        error.name = 'RateLimitError';
-        throw error;
-      }
-      throw new Error(`GitHub API error: ${response.status} ${response.statusText}`);
-    }
-
-    return response.json();
-  }
-
   async downloadJsonFile(repoUrl, filePath) {
     this.initializeConfig();
-    const repoPath = this.extractRepoPath(repoUrl);
+    const content = await downloadRawFile(repoUrl, filePath, this.branch);
-    const rawUrl = `https://raw.githubusercontent.com/${repoPath}/${this.branch}/${filePath}`;
-    const env = getEnv();
-    
-    const headers = {
-      'User-Agent': 'PVEScripts-Local/1.0',
-    };
-    
-    if (env.GITHUB_TOKEN) {
-      headers.Authorization = `token ${env.GITHUB_TOKEN}`;
-    }
-    
-    const response = await fetch(rawUrl, { headers });
-    if (!response.ok) {
-      if (response.status === 403) {
-        const error = new Error(`GitHub rate limit exceeded while downloading ${filePath}. Consider setting GITHUB_TOKEN for higher limits.`);
-        error.name = 'RateLimitError';
-        throw error;
-      }
-      throw new Error(`Failed to download ${filePath}: ${response.status} ${response.statusText}`);
-    }
-
-    const content = await response.text();
     const script = JSON.parse(content);
     script.repository_url = repoUrl;
     return script;
@@ -105,16 +39,13 @@ class GitHubJsonService {
 
   async getJsonFiles(repoUrl) {
     this.initializeConfig();
-    
     try {
-      const files = await this.fetchFromGitHub(
+      const entries = await listDirectory(repoUrl, this.jsonFolder, this.branch);
-        repoUrl,
+      return entries
-        `/contents/${this.jsonFolder}?ref=${this.branch}`
+        .filter((e) => e.type === 'file' && e.name.endsWith('.json'))
-      );
+        .map((e) => ({ name: e.name, path: e.path }));
-      
-      return files.filter(file => file.name.endsWith('.json'));
     } catch (error) {
-      console.error(`Error fetching JSON files from GitHub (${repoUrl}):`, error);
+      console.error(`Error fetching JSON files from repository (${repoUrl}):`, error);
       throw new Error(`Failed to fetch script files from repository: ${repoUrl}`);
     }
   }
@@ -232,25 +163,42 @@ class GitHubJsonService {
       const localFiles = await this.getLocalJsonFiles();
       console.log(`Found ${localFiles.length} local JSON files`);
       
+      // Delete local JSON files that belong to this repo but are no longer in the remote
+      const remoteFilenames = new Set(githubFiles.map((f) => f.name));
+      const deletedFiles = await this.deleteLocalFilesRemovedFromRepo(repoUrl, remoteFilenames);
+      if (deletedFiles.length > 0) {
+        console.log(`Removed ${deletedFiles.length} obsolete JSON file(s) no longer in ${repoUrl}`);
+      }
+      
       const filesToSync = await this.findFilesToSyncForRepo(repoUrl, githubFiles, localFiles);
       console.log(`Found ${filesToSync.length} files that need syncing from ${repoUrl}`);
       
       if (filesToSync.length === 0) {
+        const msg =
+          deletedFiles.length > 0
+            ? `All JSON files are up to date for repository: ${repoUrl}. Removed ${deletedFiles.length} obsolete file(s).`
+            : `All JSON files are up to date for repository: ${repoUrl}`;
         return {
           success: true,
-          message: `All JSON files are up to date for repository: ${repoUrl}`,
+          message: msg,
           count: 0,
-          syncedFiles: []
+          syncedFiles: [],
+          deletedFiles
         };
       }
       
       const syncedFiles = await this.syncSpecificFiles(repoUrl, filesToSync);
       
+      const msg =
+        deletedFiles.length > 0
+          ? `Successfully synced ${syncedFiles.length} JSON files from ${repoUrl}, removed ${deletedFiles.length} obsolete file(s).`
+          : `Successfully synced ${syncedFiles.length} JSON files from ${repoUrl}`;
       return {
         success: true,
-        message: `Successfully synced ${syncedFiles.length} JSON files from ${repoUrl}`,
+        message: msg,
         count: syncedFiles.length,
-        syncedFiles
+        syncedFiles,
+        deletedFiles
       };
     } catch (error) {
       console.error(`JSON sync failed for ${repoUrl}:`, error);
@@ -258,7 +206,8 @@ class GitHubJsonService {
         success: false,
         message: `Failed to sync JSON files from ${repoUrl}: ${error instanceof Error ? error.message : 'Unknown error'}`,
         count: 0,
-        syncedFiles: []
+        syncedFiles: [],
+        deletedFiles: []
       };
     }
   }
@@ -274,13 +223,15 @@ class GitHubJsonService {
           success: false,
           message: 'No enabled repositories found',
           count: 0,
-          syncedFiles: []
+          syncedFiles: [],
+          deletedFiles: []
         };
       }
 
       console.log(`Found ${enabledRepos.length} enabled repositories`);
       
       const allSyncedFiles = [];
+      const allDeletedFiles = [];
       const processedSlugs = new Set();
       let totalSynced = 0;
 
@@ -291,6 +242,7 @@ class GitHubJsonService {
           const result = await this.syncJsonFilesForRepo(repo.url);
           
           if (result.success) {
+            allDeletedFiles.push(...(result.deletedFiles ?? []));
             const newFiles = result.syncedFiles.filter(file => {
               const slug = file.replace('.json', '');
               if (processedSlugs.has(slug)) {
@@ -312,11 +264,16 @@ class GitHubJsonService {
 
       await this.updateExistingFilesWithRepositoryUrl();
 
+      const msg =
+        allDeletedFiles.length > 0
+          ? `Successfully synced ${totalSynced} JSON files from ${enabledRepos.length} repositories, removed ${allDeletedFiles.length} obsolete file(s).`
+          : `Successfully synced ${totalSynced} JSON files from ${enabledRepos.length} repositories`;
       return {
         success: true,
-        message: `Successfully synced ${totalSynced} JSON files from ${enabledRepos.length} repositories`,
+        message: msg,
         count: totalSynced,
-        syncedFiles: allSyncedFiles
+        syncedFiles: allSyncedFiles,
+        deletedFiles: allDeletedFiles
       };
     } catch (error) {
       console.error('Multi-repository JSON sync failed:', error);
@@ -324,7 +281,8 @@ class GitHubJsonService {
         success: false,
         message: `Failed to sync JSON files: ${error instanceof Error ? error.message : 'Unknown error'}`,
         count: 0,
-        syncedFiles: []
+        syncedFiles: [],
+        deletedFiles: []
       };
     }
   }
@@ -366,6 +324,32 @@ class GitHubJsonService {
     }
   }
 
+  async deleteLocalFilesRemovedFromRepo(repoUrl, remoteFilenames) {
+    this.initializeConfig();
+    const localFiles = await this.getLocalJsonFiles();
+    const deletedFiles = [];
+
+    for (const file of localFiles) {
+      try {
+        const filePath = join(this.localJsonDirectory, file);
+        const content = await readFile(filePath, 'utf-8');
+        const script = JSON.parse(content);
+
+        if (script.repository_url === repoUrl && !remoteFilenames.has(file)) {
+          await unlink(filePath);
+          const slug = file.replace(/\.json$/, '');
+          this.scriptCache.delete(slug);
+          deletedFiles.push(file);
+          console.log(`Removed obsolete script JSON: ${file} (no longer in ${repoUrl})`);
+        }
+      } catch {
+        // If we can't read or parse the file, skip (do not delete)
+      }
+    }
+
+    return deletedFiles;
+  }
+
   async findFilesToSyncForRepo(repoUrl, githubFiles, localFiles) {
     const filesToSync = [];
     

src/server/services/githubJsonService.ts

@@ -1,9 +1,9 @@
-/* eslint-disable @typescript-eslint/prefer-nullish-coalescing */
+import { writeFile, mkdir, readdir, readFile, unlink } from 'fs/promises';
-import { writeFile, mkdir, readdir, readFile } from 'fs/promises';
 import { join } from 'path';
 import { env } from '../../env.js';
 import type { Script, ScriptCard, GitHubFile } from '../../types/script';
 import { repositoryService } from './repositoryService';
+import { listDirectory, downloadRawFile } from '~/server/lib/gitProvider';
 
 export class GitHubJsonService {
   private branch: string | null = null;
@@ -23,96 +23,24 @@ export class GitHubJsonService {
     }
   }
 
-  private getBaseUrl(repoUrl: string): string {
-    const urlMatch = /github\.com\/([^\/]+)\/([^\/]+)/.exec(repoUrl);
-    if (!urlMatch) {
-      throw new Error(`Invalid GitHub repository URL: ${repoUrl}`);
-    }
-    
-    const [, owner, repo] = urlMatch;
-    return `https://api.github.com/repos/${owner}/${repo}`;
-  }
-
-  private extractRepoPath(repoUrl: string): string {
-    const match = /github\.com\/([^\/]+)\/([^\/]+)/.exec(repoUrl);
-    if (!match) {
-      throw new Error('Invalid GitHub repository URL');
-    }
-    return `${match[1]}/${match[2]}`;
-  }
-
-  private async fetchFromGitHub<T>(repoUrl: string, endpoint: string): Promise<T> {
-    const baseUrl = this.getBaseUrl(repoUrl);
-    
-    const headers: HeadersInit = {
-      'Accept': 'application/vnd.github.v3+json',
-      'User-Agent': 'PVEScripts-Local/1.0',
-    };
-    
-    // Add GitHub token authentication if available
-    if (env.GITHUB_TOKEN) {
-      headers.Authorization = `token ${env.GITHUB_TOKEN}`;
-    }
-    
-    const response = await fetch(`${baseUrl}${endpoint}`, { headers });
-
-    if (!response.ok) {
-      if (response.status === 403) {
-        const error = new Error(`GitHub API rate limit exceeded. Consider setting GITHUB_TOKEN for higher limits. Status: ${response.status} ${response.statusText}`);
-        error.name = 'RateLimitError';
-        throw error;
-      }
-      throw new Error(`GitHub API error: ${response.status} ${response.statusText}`);
-    }
-
-    const data = await response.json();
-    return data as T;
-  }
-
   private async downloadJsonFile(repoUrl: string, filePath: string): Promise<Script> {
     this.initializeConfig();
-    const repoPath = this.extractRepoPath(repoUrl);
+    const content = await downloadRawFile(repoUrl, filePath, this.branch!);
-    const rawUrl = `https://raw.githubusercontent.com/${repoPath}/${this.branch!}/${filePath}`;
-    
-    const headers: HeadersInit = {
-      'User-Agent': 'PVEScripts-Local/1.0',
-    };
-    
-    // Add GitHub token authentication if available
-    if (env.GITHUB_TOKEN) {
-      headers.Authorization = `token ${env.GITHUB_TOKEN}`;
-    }
-    
-    const response = await fetch(rawUrl, { headers });
-    if (!response.ok) {
-      if (response.status === 403) {
-        const error = new Error(`GitHub rate limit exceeded while downloading ${filePath}. Consider setting GITHUB_TOKEN for higher limits. Status: ${response.status} ${response.statusText}`);
-        error.name = 'RateLimitError';
-        throw error;
-      }
-      throw new Error(`Failed to download ${filePath}: ${response.status} ${response.statusText}`);
-    }
-
-    const content = await response.text();
     const script = JSON.parse(content) as Script;
-    // Add repository_url to script
     script.repository_url = repoUrl;
     return script;
   }
 
   async getJsonFiles(repoUrl: string): Promise<GitHubFile[]> {
     this.initializeConfig();
-    
     try {
-      const files = await this.fetchFromGitHub<GitHubFile[]>(
+      const entries = await listDirectory(repoUrl, this.jsonFolder!, this.branch!);
-        repoUrl,
+      const files: GitHubFile[] = entries
-        `/contents/${this.jsonFolder!}?ref=${this.branch!}`
+        .filter((e) => e.type === 'file' && e.name.endsWith('.json'))
-      );
+        .map((e) => ({ name: e.name, path: e.path } as GitHubFile));
-      
+      return files;
-      // Filter for JSON files only
-      return files.filter(file => file.name.endsWith('.json'));
     } catch (error) {
-      console.error(`Error fetching JSON files from GitHub (${repoUrl}):`, error);
+      console.error(`Error fetching JSON files from repository (${repoUrl}):`, error);
       throw new Error(`Failed to fetch script files from repository: ${repoUrl}`);
     }
   }
@@ -230,12 +158,11 @@ export class GitHubJsonService {
   /**
    * Sync JSON files from a specific repository
    */
-  async syncJsonFilesForRepo(repoUrl: string): Promise<{ success: boolean; message: string; count: number; syncedFiles: string[] }> {
+  async syncJsonFilesForRepo(repoUrl: string): Promise<{ success: boolean; message: string; count: number; syncedFiles: string[]; deletedFiles: string[] }> {
     try {
       console.log(`Starting JSON sync from repository: ${repoUrl}`);
       
-      // Get file list from GitHub
+      console.log(`Fetching file list from repository (${repoUrl})...`);
-      console.log(`Fetching file list from GitHub (${repoUrl})...`);
       const githubFiles = await this.getJsonFiles(repoUrl);
       console.log(`Found ${githubFiles.length} JSON files in repository ${repoUrl}`);
       
@@ -243,28 +170,45 @@ export class GitHubJsonService {
       const localFiles = await this.getLocalJsonFiles();
       console.log(`Found ${localFiles.length} local JSON files`);
       
+      // Delete local JSON files that belong to this repo but are no longer in the remote
+      const remoteFilenames = new Set(githubFiles.map((f) => f.name));
+      const deletedFiles = await this.deleteLocalFilesRemovedFromRepo(repoUrl, remoteFilenames);
+      if (deletedFiles.length > 0) {
+        console.log(`Removed ${deletedFiles.length} obsolete JSON file(s) no longer in ${repoUrl}`);
+      }
+      
       // Compare and find files that need syncing
       // For multi-repo support, we need to check if file exists AND if it's from this repo
       const filesToSync = await this.findFilesToSyncForRepo(repoUrl, githubFiles, localFiles);
       console.log(`Found ${filesToSync.length} files that need syncing from ${repoUrl}`);
       
       if (filesToSync.length === 0) {
+        const msg =
+          deletedFiles.length > 0
+            ? `All JSON files are up to date for repository: ${repoUrl}. Removed ${deletedFiles.length} obsolete file(s).`
+            : `All JSON files are up to date for repository: ${repoUrl}`;
         return {
           success: true,
-          message: `All JSON files are up to date for repository: ${repoUrl}`,
+          message: msg,
           count: 0,
-          syncedFiles: []
+          syncedFiles: [],
+          deletedFiles
         };
       }
       
       // Download and save only the files that need syncing
       const syncedFiles = await this.syncSpecificFiles(repoUrl, filesToSync);
       
+      const msg =
+        deletedFiles.length > 0
+          ? `Successfully synced ${syncedFiles.length} JSON files from ${repoUrl}, removed ${deletedFiles.length} obsolete file(s).`
+          : `Successfully synced ${syncedFiles.length} JSON files from ${repoUrl}`;
       return {
         success: true,
-        message: `Successfully synced ${syncedFiles.length} JSON files from ${repoUrl}`,
+        message: msg,
         count: syncedFiles.length,
-        syncedFiles
+        syncedFiles,
+        deletedFiles
       };
     } catch (error) {
       console.error(`JSON sync failed for ${repoUrl}:`, error);
@@ -272,7 +216,8 @@ export class GitHubJsonService {
         success: false,
         message: `Failed to sync JSON files from ${repoUrl}: ${error instanceof Error ? error.message : 'Unknown error'}`,
         count: 0,
-        syncedFiles: []
+        syncedFiles: [],
+        deletedFiles: []
       };
     }
   }
@@ -280,7 +225,7 @@ export class GitHubJsonService {
   /**
    * Sync JSON files from all enabled repositories (main repo has priority)
    */
-  async syncJsonFiles(): Promise<{ success: boolean; message: string; count: number; syncedFiles: string[] }> {
+  async syncJsonFiles(): Promise<{ success: boolean; message: string; count: number; syncedFiles: string[]; deletedFiles: string[] }> {
     try {
       console.log('Starting multi-repository JSON sync...');
       
@@ -291,13 +236,15 @@ export class GitHubJsonService {
           success: false,
           message: 'No enabled repositories found',
           count: 0,
-          syncedFiles: []
+          syncedFiles: [],
+          deletedFiles: []
         };
       }
 
       console.log(`Found ${enabledRepos.length} enabled repositories`);
       
       const allSyncedFiles: string[] = [];
+      const allDeletedFiles: string[] = [];
       const processedSlugs = new Set<string>(); // Track slugs we've already processed
       let totalSynced = 0;
 
@@ -309,6 +256,7 @@ export class GitHubJsonService {
           const result = await this.syncJsonFilesForRepo(repo.url);
           
           if (result.success) {
+            allDeletedFiles.push(...(result.deletedFiles ?? []));
             // Only count files that weren't already processed from a higher priority repo
             const newFiles = result.syncedFiles.filter(file => {
               const slug = file.replace('.json', '');
@@ -332,11 +280,16 @@ export class GitHubJsonService {
       // Also update existing files that don't have repository_url set (backward compatibility)
       await this.updateExistingFilesWithRepositoryUrl();
 
+      const msg =
+        allDeletedFiles.length > 0
+          ? `Successfully synced ${totalSynced} JSON files from ${enabledRepos.length} repositories, removed ${allDeletedFiles.length} obsolete file(s).`
+          : `Successfully synced ${totalSynced} JSON files from ${enabledRepos.length} repositories`;
       return {
         success: true,
-        message: `Successfully synced ${totalSynced} JSON files from ${enabledRepos.length} repositories`,
+        message: msg,
         count: totalSynced,
-        syncedFiles: allSyncedFiles
+        syncedFiles: allSyncedFiles,
+        deletedFiles: allDeletedFiles
       };
     } catch (error) {
       console.error('Multi-repository JSON sync failed:', error);
@@ -344,7 +297,8 @@ export class GitHubJsonService {
         success: false,
         message: `Failed to sync JSON files: ${error instanceof Error ? error.message : 'Unknown error'}`,
         count: 0,
-        syncedFiles: []
+        syncedFiles: [],
+        deletedFiles: []
       };
     }
   }
@@ -389,6 +343,36 @@ export class GitHubJsonService {
     }
   }
 
+  /**
+   * Delete local JSON files that belong to this repo but are no longer in the remote list.
+   * Returns the list of deleted filenames.
+   */
+  private async deleteLocalFilesRemovedFromRepo(repoUrl: string, remoteFilenames: Set<string>): Promise<string[]> {
+    this.initializeConfig();
+    const localFiles = await this.getLocalJsonFiles();
+    const deletedFiles: string[] = [];
+
+    for (const file of localFiles) {
+      try {
+        const filePath = join(this.localJsonDirectory!, file);
+        const content = await readFile(filePath, 'utf-8');
+        const script = JSON.parse(content) as Script;
+
+        if (script.repository_url === repoUrl && !remoteFilenames.has(file)) {
+          await unlink(filePath);
+          const slug = file.replace(/\.json$/, '');
+          this.scriptCache.delete(slug);
+          deletedFiles.push(file);
+          console.log(`Removed obsolete script JSON: ${file} (no longer in ${repoUrl})`);
+        }
+      } catch {
+        // If we can't read or parse the file, skip (do not delete)
+      }
+    }
+
+    return deletedFiles;
+  }
+
   /**
    * Find files that need syncing for a specific repository
    * This checks if file exists locally AND if it's from the same repository

src/server/services/repositoryService.js

@@ -1,5 +1,6 @@
 // JavaScript wrapper for repositoryService (for use with node server.js)
 import { prisma } from '../db.js';
+import { isValidRepositoryUrl, REPO_URL_ERROR_MESSAGE } from '../lib/repositoryUrlValidation.js';
 
 class RepositoryService {
   /**
@@ -89,9 +90,8 @@ class RepositoryService {
    * Create a new repository
    */
   async createRepository(data) {
-    // Validate GitHub URL
+    if (!isValidRepositoryUrl(data.url)) {
-    if (!data.url.match(/^https:\/\/github\.com\/[^\/]+\/[^\/]+$/)) {
+      throw new Error(REPO_URL_ERROR_MESSAGE);
-      throw new Error('Invalid GitHub repository URL. Format: https://github.com/owner/repo');
     }
 
     // Check for duplicates
@@ -122,10 +122,9 @@ class RepositoryService {
    * Update repository
    */
   async updateRepository(id, data) {
-    // If updating URL, validate it
     if (data.url) {
-      if (!data.url.match(/^https:\/\/github\.com\/[^\/]+\/[^\/]+$/)) {
+      if (!isValidRepositoryUrl(data.url)) {
-        throw new Error('Invalid GitHub repository URL. Format: https://github.com/owner/repo');
+        throw new Error(REPO_URL_ERROR_MESSAGE);
       }
 
       // Check for duplicates (excluding current repo)

src/server/services/repositoryService.ts

@@ -1,5 +1,5 @@
-/* eslint-disable @typescript-eslint/prefer-regexp-exec */
 import { prisma } from '../db';
+import { isValidRepositoryUrl, REPO_URL_ERROR_MESSAGE } from '../lib/repositoryUrlValidation';
 
 export class RepositoryService {
   /**
@@ -93,9 +93,8 @@ export class RepositoryService {
     enabled?: boolean;
     priority?: number;
   }) {
-    // Validate GitHub URL
+    if (!isValidRepositoryUrl(data.url)) {
-    if (!data.url.match(/^https:\/\/github\.com\/[^\/]+\/[^\/]+$/)) {
+      throw new Error(REPO_URL_ERROR_MESSAGE);
-      throw new Error('Invalid GitHub repository URL. Format: https://github.com/owner/repo');
     }
 
     // Check for duplicates
@@ -130,10 +129,9 @@ export class RepositoryService {
     url?: string;
     priority?: number;
   }) {
-    // If updating URL, validate it
     if (data.url) {
-      if (!data.url.match(/^https:\/\/github\.com\/[^\/]+\/[^\/]+$/)) {
+      if (!isValidRepositoryUrl(data.url)) {
-        throw new Error('Invalid GitHub repository URL. Format: https://github.com/owner/repo');
+        throw new Error(REPO_URL_ERROR_MESSAGE);
       }
 
       // Check for duplicates (excluding current repo)

src/server/services/restoreService.ts

@@ -250,9 +250,16 @@ class RestoreService {
     const targetFolder = `/var/lib/vz/dump/vzdump-lxc-${ctId}-${snapshotNameForPath}`;
     const targetTar = `${targetFolder}.tar`;
     
-    // Use PBS_PASSWORD env var and add timeout for long downloads
+    // Use PBS_PASSWORD env var and add timeout for long downloads; PBS_FINGERPRINT when set for cert validation
     const escapedPassword = credential.pbs_password.replace(/'/g, "'\\''");
-    const restoreCommand = `PBS_PASSWORD='${escapedPassword}' PBS_REPOSITORY='${repository}' timeout 300 proxmox-backup-client restore "${snapshotPath}" root.pxar "${targetFolder}" --repository '${repository}' 2>&1`;
+    const fingerprint = credential.pbs_fingerprint?.trim() ?? '';
+    const escapedFingerprint = fingerprint ? fingerprint.replace(/'/g, "'\\''") : '';
+    const restoreEnvParts = [`PBS_PASSWORD='${escapedPassword}'`, `PBS_REPOSITORY='${repository}'`];
+    if (escapedFingerprint) {
+      restoreEnvParts.push(`PBS_FINGERPRINT='${escapedFingerprint}'`);
+    }
+    const restoreEnvStr = restoreEnvParts.join(' ');
+    const restoreCommand = `${restoreEnvStr} timeout 300 proxmox-backup-client restore "${snapshotPath}" root.pxar "${targetFolder}" --repository '${repository}' 2>&1`;
     
     let output = '';
     let exitCode = 0;

src/server/services/scriptDownloader.js

@@ -1,6 +1,7 @@
 // Real JavaScript implementation for script downloading
 import { join } from 'path';
 import { writeFile, mkdir, access, readFile, unlink } from 'fs/promises';
+import { downloadRawFile } from '../lib/gitProvider/index.js';
 
 export class ScriptDownloaderService {
   constructor() {
@@ -82,51 +83,18 @@ export class ScriptDownloaderService {
   }
 
   /**
-   * Extract repository path from GitHub URL
+   * Download a file from the repository (GitHub, GitLab, Bitbucket, or custom)
-   * @param {string} repoUrl - The GitHub repository URL
+   * @param {string} repoUrl - The repository URL
-   * @returns {string}
-   */
-  extractRepoPath(repoUrl) {
-    const match = /github\.com\/([^\/]+)\/([^\/]+)/.exec(repoUrl);
-    if (!match) {
-      throw new Error(`Invalid GitHub repository URL: ${repoUrl}`);
-    }
-    return `${match[1]}/${match[2]}`;
-  }
-
-  /**
-   * Download a file from GitHub
-   * @param {string} repoUrl - The GitHub repository URL
    * @param {string} filePath - The file path within the repository
    * @param {string} [branch] - The branch to download from
    * @returns {Promise<string>}
    */
-  async downloadFileFromGitHub(repoUrl, filePath, branch = 'main') {
+  async downloadFileFromRepo(repoUrl, filePath, branch = 'main') {
-    this.initializeConfig();
     if (!repoUrl) {
       throw new Error('Repository URL is not set');
     }
-
+    console.log(`Downloading from repository: ${repoUrl} (${filePath})`);
-    const repoPath = this.extractRepoPath(repoUrl);
+    return downloadRawFile(repoUrl, filePath, branch);
-    const url = `https://raw.githubusercontent.com/${repoPath}/${branch}/${filePath}`;
-    
-    /** @type {Record<string, string>} */
-    const headers = {
-      'User-Agent': 'PVEScripts-Local/1.0',
-    };
-    
-    // Add GitHub token authentication if available
-    if (process.env.GITHUB_TOKEN) {
-      headers.Authorization = `token ${process.env.GITHUB_TOKEN}`;
-    }
-    
-    console.log(`Downloading from GitHub: ${url}`);
-    const response = await fetch(url, { headers });
-    if (!response.ok) {
-      throw new Error(`Failed to download ${filePath} from ${repoUrl}: ${response.status} ${response.statusText}`);
-    }
-
-    return response.text();
   }
 
   /**
@@ -184,9 +152,8 @@ export class ScriptDownloaderService {
             const fileName = scriptPath.split('/').pop();
             
             if (fileName) {
-              // Download from GitHub using the script's repository URL
               console.log(`Downloading script file: ${scriptPath} from ${repoUrl}`);
-              const content = await this.downloadFileFromGitHub(repoUrl, scriptPath, branch);
+              const content = await this.downloadFileFromRepo(repoUrl, scriptPath, branch);
               
               // Determine target directory based on script path
               let targetDir;
@@ -250,7 +217,7 @@ export class ScriptDownloaderService {
         const installScriptName = `${script.slug}-install.sh`;
         try {
           console.log(`Downloading install script: install/${installScriptName} from ${repoUrl}`);
-          const installContent = await this.downloadFileFromGitHub(repoUrl, `install/${installScriptName}`, branch);
+          const installContent = await this.downloadFileFromRepo(repoUrl, `install/${installScriptName}`, branch);
           const localInstallPath = join(this.scriptsDirectory, 'install', installScriptName);
           await writeFile(localInstallPath, installContent, 'utf-8');
           files.push(`install/${installScriptName}`);
@@ -274,7 +241,7 @@ export class ScriptDownloaderService {
         const alpineInstallScriptName = `alpine-${script.slug}-install.sh`;
         try {
           console.log(`[${script.slug}] Downloading alpine install script: install/${alpineInstallScriptName} from ${repoUrl}`);
-          const alpineInstallContent = await this.downloadFileFromGitHub(repoUrl, `install/${alpineInstallScriptName}`, branch);
+          const alpineInstallContent = await this.downloadFileFromRepo(repoUrl, `install/${alpineInstallScriptName}`, branch);
           const localAlpineInstallPath = join(this.scriptsDirectory, 'install', alpineInstallScriptName);
           await writeFile(localAlpineInstallPath, alpineInstallContent, 'utf-8');
           files.push(`install/${alpineInstallScriptName}`);
@@ -681,7 +648,7 @@ export class ScriptDownloaderService {
       console.log(`[Comparison] Local file size: ${localContent.length} bytes`);
       
       // Download remote content from the script's repository
-      const remoteContent = await this.downloadFileFromGitHub(repoUrl, remotePath, branch);
+      const remoteContent = await this.downloadFileFromRepo(repoUrl, remotePath, branch);
       console.log(`[Comparison] Remote file size: ${remoteContent.length} bytes`);
       
       // Apply modification only for CT scripts, not for other script types
@@ -739,7 +706,7 @@ export class ScriptDownloaderService {
             // Find the corresponding script path in install_methods
             const method = script.install_methods?.find(m => m.script === filePath);
             if (method?.script) {
-              const downloadedContent = await this.downloadFileFromGitHub(repoUrl, method.script, branch);
+              const downloadedContent = await this.downloadFileFromRepo(repoUrl, method.script, branch);
               remoteContent = this.modifyScriptContent(downloadedContent);
             }
           } catch {
@@ -756,7 +723,7 @@ export class ScriptDownloaderService {
         }
 
         try {
-          remoteContent = await this.downloadFileFromGitHub(repoUrl, filePath, branch);
+          remoteContent = await this.downloadFileFromRepo(repoUrl, filePath, branch);
         } catch {
           // Error downloading remote install script
         }

src/server/services/storageService.ts

@@ -1,4 +1,3 @@
-/* eslint-disable @typescript-eslint/no-floating-promises, @typescript-eslint/prefer-optional-chain, @typescript-eslint/prefer-nullish-coalescing, @typescript-eslint/prefer-regexp-exec, @typescript-eslint/prefer-for-of */
 import { getSSHExecutionService } from '../ssh-execution-service';
 import type { Server } from '~/types/server';
 

src/server/ssh-execution-service.js

@@ -1,6 +1,8 @@
 import { spawn } from 'child_process';
 import { spawn as ptySpawn } from 'node-pty';
-import { existsSync } from 'fs';
+import { existsSync, writeFileSync, chmodSync, unlinkSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
 
 
 /**
@@ -85,9 +87,10 @@ class SSHExecutionService {
    * @param {Function} onData - Callback for data output
    * @param {Function} onError - Callback for errors
    * @param {Function} onExit - Callback for process exit
+   * @param {Object} [envVars] - Optional environment variables to pass to the script
    * @returns {Promise<Object>} Process information
    */
-  async executeScript(server, scriptPath, onData, onError, onExit) {
+  async executeScript(server, scriptPath, onData, onError, onExit, envVars = {}) {
     try {
       await this.transferScriptsFolder(server, onData, onError);
       
@@ -98,8 +101,43 @@ class SSHExecutionService {
           // Build SSH command based on authentication type
           const { command, args } = this.buildSSHCommand(server);
           
+          // Format environment variables as var_name=value pairs
+          const envVarsString = Object.entries(envVars)
+            .map(([key, value]) => {
+              // Escape special characters in values
+              const escapedValue = String(value).replace(/'/g, "'\\''");
+              return `${key}='${escapedValue}'`;
+            })
+            .join(' ');
+          
+          // Build the command with environment variables
+          let scriptCommand = `cd /tmp/scripts && chmod +x ${relativeScriptPath} && export TERM=xterm-256color && export COLUMNS=120 && export LINES=30 && export COLORTERM=truecolor && export FORCE_COLOR=1 && export NO_COLOR=0 && export CLICOLOR=1 && export CLICOLOR_FORCE=1`;
+          
+          if (envVarsString) {
+            scriptCommand += ` && ${envVarsString} bash ${relativeScriptPath}`;
+          } else {
+            scriptCommand += ` && bash ${relativeScriptPath}`;
+          }
+          
+          // Log the full command that will be executed
+          console.log('='.repeat(80));
+          console.log(`[SSH Execution] Executing on host: ${server.ip} (${server.name || 'Unnamed'})`);
+          console.log(`[SSH Execution] Script path: ${scriptPath}`);
+          console.log(`[SSH Execution] Relative script path: ${relativeScriptPath}`);
+          if (Object.keys(envVars).length > 0) {
+            console.log(`[SSH Execution] Environment variables (${Object.keys(envVars).length} vars):`);
+            Object.entries(envVars).forEach(([key, value]) => {
+              console.log(`  ${key}=${String(value)}`);
+            });
+          } else {
+            console.log(`[SSH Execution] No environment variables provided`);
+          }
+          console.log(`[SSH Execution] Full command:`);
+          console.log(scriptCommand);
+          console.log('='.repeat(80));
+          
           // Add the script execution command to the args
-          args.push(`cd /tmp/scripts && chmod +x ${relativeScriptPath} && export TERM=xterm-256color && export COLUMNS=120 && export LINES=30 && export COLORTERM=truecolor && export FORCE_COLOR=1 && export NO_COLOR=0 && export CLICOLOR=1 && export CLICOLOR_FORCE=1 && bash ${relativeScriptPath}`);
+          args.push(scriptCommand);
           
           // Use ptySpawn for proper terminal emulation and color support
           const sshCommand = ptySpawn(command, args, {
@@ -158,26 +196,45 @@ class SSHExecutionService {
    */
   async transferScriptsFolder(server, onData, onError) {
     const { ip, user, password, auth_type = 'password', ssh_key_passphrase, ssh_key_path, ssh_port = 22 } = server;
-    
+
+    const cleanupTempFile = (/** @type {string | null} */ tempPath) => {
+      if (tempPath) {
+        try {
+          unlinkSync(tempPath);
+        } catch (_) {
+          // ignore
+        }
+      }
+    };
+
     return new Promise((resolve, reject) => {
+      /** @type {string | null} */
+      let tempPath = null;
       try {
-        // Build rsync command based on authentication type
+        // Build rsync command based on authentication type.
+        // Use sshpass -f with a temp file so password/passphrase never go through the shell (safe for special chars like {, $, ").
         let rshCommand;
         if (auth_type === 'key') {
           if (!ssh_key_path || !existsSync(ssh_key_path)) {
             throw new Error('SSH key file not found');
           }
-          
+
           if (ssh_key_passphrase) {
-            rshCommand = `sshpass -P passphrase -p ${ssh_key_passphrase} ssh -i ${ssh_key_path} -p ${ssh_port} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null`;
+            tempPath = join(tmpdir(), `sshpass-${process.pid}-${Date.now()}.tmp`);
+            writeFileSync(tempPath, ssh_key_passphrase);
+            chmodSync(tempPath, 0o600);
+            rshCommand = `sshpass -P passphrase -f ${tempPath} ssh -i ${ssh_key_path} -p ${ssh_port} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null`;
           } else {
             rshCommand = `ssh -i ${ssh_key_path} -p ${ssh_port} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null`;
           }
         } else {
           // Password authentication
-          rshCommand = `sshpass -p ${password} ssh -p ${ssh_port} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null`;
+          tempPath = join(tmpdir(), `sshpass-${process.pid}-${Date.now()}.tmp`);
+          writeFileSync(tempPath, password ?? '');
+          chmodSync(tempPath, 0o600);
+          rshCommand = `sshpass -f ${tempPath} ssh -p ${ssh_port} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null`;
         }
-        
+
         const rsyncCommand = spawn('rsync', [
           '-avz',
           '--delete',
@@ -190,31 +247,31 @@ class SSHExecutionService {
           stdio: ['pipe', 'pipe', 'pipe']
         });
 
-      rsyncCommand.stdout.on('data', (/** @type {Buffer} */ data) => {
+        rsyncCommand.stdout.on('data', (/** @type {Buffer} */ data) => {
-        // Ensure proper UTF-8 encoding for ANSI colors
+          const output = data.toString('utf8');
-        const output = data.toString('utf8');
+          onData(output);
-        onData(output);
+        });
-      });
 
-      rsyncCommand.stderr.on('data', (/** @type {Buffer} */ data) => {
+        rsyncCommand.stderr.on('data', (/** @type {Buffer} */ data) => {
-        // Ensure proper UTF-8 encoding for ANSI colors
+          const output = data.toString('utf8');
-        const output = data.toString('utf8');
+          onError(output);
-        onError(output);
+        });
-      });
 
-      rsyncCommand.on('close', (code) => {
+        rsyncCommand.on('close', (code) => {
-        if (code === 0) {
+          cleanupTempFile(tempPath);
-          resolve();
+          if (code === 0) {
-        } else {
+            resolve();
-          reject(new Error(`rsync failed with code ${code}`));
+          } else {
-        }
+            reject(new Error(`rsync failed with code ${code}`));
-      });
+          }
+        });
 
-      rsyncCommand.on('error', (error) => {
+        rsyncCommand.on('error', (error) => {
-        reject(error);
+          cleanupTempFile(tempPath);
-      });
+          reject(error);
-      
+        });
       } catch (error) {
+        cleanupTempFile(tempPath);
         reject(error);
       }
     });

src/server/ssh-service.js

@@ -169,16 +169,17 @@ class SSHService {
       const timeout = 10000;
       let resolved = false;
       
+      // Pass password via env so it is not embedded in the script (safe for special chars like {, $, ").
       const expectScript = `#!/usr/bin/expect -f
 set timeout 10
 spawn ssh -p ${ssh_port} -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o PasswordAuthentication=yes -o PubkeyAuthentication=no ${user}@${ip} "echo SSH_LOGIN_SUCCESS"
 expect {
   "password:" {
-    send "${password}\r"
+    send "$env(SSH_PASSWORD)\\r"
     exp_continue
   }
   "Password:" {
-    send "${password}\r"
+    send "$env(SSH_PASSWORD)\\r"
     exp_continue
   }
   "SSH_LOGIN_SUCCESS" {
@@ -193,7 +194,8 @@ expect {
 }`;
 
       const expectCommand = spawn('expect', ['-c', expectScript], {
-        stdio: ['pipe', 'pipe', 'pipe']
+        stdio: ['pipe', 'pipe', 'pipe'],
+        env: { ...process.env, SSH_PASSWORD: password ?? '' }
       });
 
       const timer = setTimeout(() => {

update.sh

@@ -4,7 +4,7 @@
 # Enhanced update script for ProxmoxVE-Local
 # Fetches latest release from GitHub and backs up data directory
 
-set -euo pipefail  # Exit on error, undefined vars, pipe failures
+set -euo pipefail # Exit on error, undefined vars, pipe failures
 
 # Add error trap for debugging
 trap 'echo "Error occurred at line $LINENO, command: $BASH_COMMAND"' ERR
@@ -38,7 +38,7 @@ load_github_token() {
         log "Using GitHub token from environment variable"
         return 0
     fi
-    
+
     # Try .env file
     if [ -f ".env" ]; then
         local env_token
@@ -49,21 +49,21 @@ load_github_token() {
             return 0
         fi
     fi
-    
+
     # Try .github_token file
     if [ -f ".github_token" ]; then
         GITHUB_TOKEN=$(cat .github_token | tr -d '\n\r')
         log "Using GitHub token from .github_token file"
         return 0
     fi
-    
+
     # Try ~/.github_token file
     if [ -f "$HOME/.github_token" ]; then
         GITHUB_TOKEN=$(cat "$HOME/.github_token" | tr -d '\n\r')
         log "Using GitHub token from ~/.github_token file"
         return 0
     fi
-    
+
     log_warning "No GitHub token found. Using unauthenticated requests (lower rate limits)"
     log_warning "To use a token, add GITHUB_TOKEN=your_token to .env file or set GITHUB_TOKEN environment variable"
     return 1
@@ -72,7 +72,7 @@ load_github_token() {
 # Initialize log file
 init_log() {
     # Clear/create log file
-    > "$LOG_FILE"
+    >"$LOG_FILE"
     log "Starting ProxmoxVE-Local update process..."
     log "Log file: $LOG_FILE"
 }
@@ -97,40 +97,40 @@ log_warning() {
 # Check if required tools are available
 check_dependencies() {
     log "Checking dependencies..."
-    
+
     local missing_deps=()
-    
+
-    if ! command -v curl &> /dev/null; then
+    if ! command -v curl &>/dev/null; then
         missing_deps+=("curl")
     fi
-    
+
-    if ! command -v jq &> /dev/null; then
+    if ! command -v jq &>/dev/null; then
         missing_deps+=("jq")
     fi
-    
+
-    if ! command -v npm &> /dev/null; then
+    if ! command -v npm &>/dev/null; then
         missing_deps+=("npm")
     fi
-    
+
-    if ! command -v node &> /dev/null; then
+    if ! command -v node &>/dev/null; then
         missing_deps+=("node")
     fi
-    
+
     if [ ${#missing_deps[@]} -ne 0 ]; then
         log_error "Missing dependencies: ${missing_deps[*]}"
         log_error "Please install the missing dependencies and try again."
         exit 1
     fi
-    
+
     log_success "All dependencies are available"
 }
 
 # Get latest release info from GitHub API
 get_latest_release() {
     log "Fetching latest release information from GitHub..."
-    
+
     local curl_opts="-s --connect-timeout 15 --max-time 60 --retry 2 --retry-delay 3"
-    
+
     # Add authentication header if token is available
     if [ -n "$GITHUB_TOKEN" ]; then
         curl_opts="$curl_opts -H \"Authorization: token $GITHUB_TOKEN\""
@@ -138,35 +138,35 @@ get_latest_release() {
     else
         log "Using unauthenticated GitHub API request (lower rate limits)"
     fi
-    
+
     local release_info
     if ! release_info=$(eval "curl $curl_opts \"$GITHUB_API/releases/latest\""); then
         log_error "Failed to fetch release information from GitHub API (timeout or network error)"
         exit 1
     fi
-    
+
     # Check if response is valid JSON
     if ! echo "$release_info" | jq empty 2>/dev/null; then
         log_error "Invalid JSON response from GitHub API"
         log "Response: $release_info"
         exit 1
     fi
-    
+
     local tag_name
     local download_url
     local published_at
-    
+
     tag_name=$(echo "$release_info" | jq -r '.tag_name')
     download_url=$(echo "$release_info" | jq -r '.tarball_url')
     published_at=$(echo "$release_info" | jq -r '.published_at')
-    
+
     if [ "$tag_name" = "null" ] || [ "$download_url" = "null" ] || [ -z "$tag_name" ] || [ -z "$download_url" ]; then
         log_error "Failed to parse release information from API response"
         log "Tag name: $tag_name"
         log "Download URL: $download_url"
         exit 1
     fi
-    
+
     log_success "Latest release: $tag_name (published: $published_at)"
     echo "$tag_name|$download_url"
 }
@@ -174,16 +174,16 @@ get_latest_release() {
 # Backup data directory, .env file, and scripts directories
 backup_data() {
     log "Creating backup directory at $BACKUP_DIR..."
-    
+
     if ! mkdir -p "$BACKUP_DIR"; then
         log_error "Failed to create backup directory"
         exit 1
     fi
-    
+
     # Backup data directory
     if [ -d "$DATA_DIR" ]; then
         log "Backing up data directory..."
-        
+
         if ! cp -r "$DATA_DIR" "$BACKUP_DIR/data"; then
             log_error "Failed to backup data directory"
             exit 1
@@ -193,7 +193,7 @@ backup_data() {
     else
         log_warning "Data directory not found, skipping backup"
     fi
-    
+
     # Backup .env file
     if [ -f ".env" ]; then
         log "Backing up .env file..."
@@ -206,7 +206,7 @@ backup_data() {
     else
         log_warning ".env file not found, skipping backup"
     fi
-    
+
     # Backup scripts directories
     local scripts_dirs=("scripts/ct" "scripts/install" "scripts/tools" "scripts/vm")
     for scripts_dir in "${scripts_dirs[@]}"; do
@@ -230,60 +230,60 @@ download_release() {
     local release_info="$1"
     local tag_name="${release_info%|*}"
     local download_url="${release_info#*|}"
-    
+
     log "Downloading release $tag_name..."
-    
+
     local temp_dir="/tmp/pve-update-$$"
     local archive_file="$temp_dir/release.tar.gz"
-    
+
     # Create temporary directory
     if ! mkdir -p "$temp_dir"; then
         log_error "Failed to create temporary directory"
         exit 1
     fi
-    
+
     # Download release with timeout and progress
     if ! curl -L --connect-timeout 30 --max-time 300 --retry 3 --retry-delay 5 -o "$archive_file" "$download_url" 2>/dev/null; then
         log_error "Failed to download release from GitHub"
         rm -rf "$temp_dir"
         exit 1
     fi
-    
+
     # Verify download
     if [ ! -f "$archive_file" ] || [ ! -s "$archive_file" ]; then
         log_error "Downloaded file is empty or missing"
         rm -rf "$temp_dir"
         exit 1
     fi
-    
+
     log_success "Downloaded release"
-    
+
     # Extract release
     if ! tar -xzf "$archive_file" -C "$temp_dir" 2>/dev/null; then
         log_error "Failed to extract release"
         rm -rf "$temp_dir"
         exit 1
     fi
-    
+
     # Find the extracted directory (GitHub tarballs have a root directory)
     local extracted_dir
     extracted_dir=$(find "$temp_dir" -maxdepth 1 -type d -name "community-scripts-ProxmoxVE-Local-*" 2>/dev/null | head -1)
-    
+
     # Try alternative patterns if not found
     if [ -z "$extracted_dir" ]; then
         extracted_dir=$(find "$temp_dir" -maxdepth 1 -type d -name "${REPO_NAME}-*" 2>/dev/null | head -1)
     fi
-    
+
     if [ -z "$extracted_dir" ]; then
         extracted_dir=$(find "$temp_dir" -maxdepth 1 -type d ! -name "$temp_dir" 2>/dev/null | head -1)
     fi
-    
+
     if [ -z "$extracted_dir" ]; then
         log_error "Could not find extracted directory"
         rm -rf "$temp_dir"
         exit 1
     fi
-    
+
     log_success "Release extracted successfully"
     echo "$extracted_dir"
 }
@@ -291,11 +291,11 @@ download_release() {
 # Clear the original directory before updating
 clear_original_directory() {
     log "Clearing original directory..."
-    
+
     # Remove old lock files and node_modules before update
     rm -f package-lock.json 2>/dev/null
     rm -rf node_modules 2>/dev/null
-    
+
     # List of files/directories to preserve (already backed up)
     local preserve_patterns=(
         "data"
@@ -308,48 +308,48 @@ clear_original_directory() {
         ".git"
         "scripts"
     )
-    
+
     # Remove all files except preserved ones
     while IFS= read -r file; do
         local should_preserve=false
         local filename=$(basename "$file")
-        
+
         for pattern in "${preserve_patterns[@]}"; do
             if [[ "$filename" == $pattern ]]; then
                 should_preserve=true
                 break
             fi
         done
-        
+
         if [ "$should_preserve" = false ]; then
             rm -f "$file"
         fi
     done < <(find . -maxdepth 1 -type f ! -name ".*")
-    
+
     # Remove all directories except preserved ones
     while IFS= read -r dir; do
         local should_preserve=false
         local dirname=$(basename "$dir")
-        
+
         for pattern in "${preserve_patterns[@]}"; do
             if [[ "$dirname" == $pattern ]]; then
                 should_preserve=true
                 break
             fi
         done
-        
+
         if [ "$should_preserve" = false ]; then
             rm -rf "$dir"
         fi
     done < <(find . -maxdepth 1 -type d ! -name "." ! -name "..")
-    
+
     log_success "Original directory cleared"
 }
 
 # Restore backup files before building
 restore_backup_files() {
     log "Restoring .env, data directory, and scripts directories from backup..."
-    
+
     if [ -d "$BACKUP_DIR" ]; then
         # Restore .env file
         if [ -f "$BACKUP_DIR/.env" ]; then
@@ -365,7 +365,7 @@ restore_backup_files() {
         else
             log_warning "No .env file backup found"
         fi
-        
+
         # Restore data directory
         if [ -d "$BACKUP_DIR/data" ]; then
             if [ -d "data" ]; then
@@ -380,24 +380,24 @@ restore_backup_files() {
         else
             log_warning "No data directory backup found"
         fi
-        
+
         # Restore scripts directories
         local scripts_dirs=("ct" "install" "tools" "vm")
         for backup_name in "${scripts_dirs[@]}"; do
             if [ -d "$BACKUP_DIR/$backup_name" ]; then
                 local target_dir="scripts/$backup_name"
                 log "Restoring $target_dir directory from backup..."
-                
+
                 # Ensure scripts directory exists
                 if [ ! -d "scripts" ]; then
                     mkdir -p "scripts"
                 fi
-                
+
                 # Remove existing directory if it exists
                 if [ -d "$target_dir" ]; then
                     rm -rf "$target_dir"
                 fi
-                
+
                 if cp -r "$BACKUP_DIR/$backup_name" "$target_dir"; then
                     log_success "$target_dir directory restored from backup"
                 else
@@ -417,7 +417,13 @@ restore_backup_files() {
 # Verify database was restored correctly
 verify_database_restored() {
     log "Verifying database was restored correctly..."
-    
+
+    # Ensure data directory exists (will be auto-created by app if needed)
+    if [ ! -d "data" ]; then
+        log "Creating data directory..."
+        mkdir -p data
+    fi
+
     # Check for both possible database filenames
     local db_file=""
     if [ -f "data/database.sqlite" ]; then
@@ -425,23 +431,25 @@ verify_database_restored() {
     elif [ -f "data/settings.db" ]; then
         db_file="data/settings.db"
     else
-        log_error "Database file not found after restore! (checked database.sqlite and settings.db)"
+        # Database doesn't exist yet - this is OK for new installations
-        return 1
+        # The app will create it automatically via Prisma migrations
+        log_warning "No existing database file found - will be created automatically on first start"
+        return 0
     fi
-    
+
     local db_size=$(stat -f%z "$db_file" 2>/dev/null || stat -c%s "$db_file" 2>/dev/null)
     if [ "$db_size" -eq 0 ]; then
         log_warning "Database file is empty - will be recreated by Prisma migrations"
-        return 0  # Don't fail the update, let Prisma recreate the database
+        return 0 # Don't fail the update, let Prisma recreate the database
     fi
-    
+
     log_success "Database verified (file: $db_file, size: $db_size bytes)"
 }
 
 # Ensure DATABASE_URL is set in .env file for Prisma
 ensure_database_url() {
     log "Ensuring DATABASE_URL is set in .env file..."
-    
+
     # Check if .env file exists
     if [ ! -f ".env" ]; then
         log_warning ".env file not found, creating from .env.example..."
@@ -452,19 +460,19 @@ ensure_database_url() {
             return 1
         fi
     fi
-    
+
     # Check if DATABASE_URL is already set
     if grep -q "^DATABASE_URL=" .env; then
         log "DATABASE_URL already exists in .env file"
         return 0
     fi
-    
+
     # Add DATABASE_URL to .env file
     log "Adding DATABASE_URL to .env file..."
-    echo "" >> .env
+    echo "" >>.env
-    echo "# Database" >> .env
+    echo "# Database" >>.env
-    echo "DATABASE_URL=\"file:./data/settings.db\"" >> .env
+    echo "DATABASE_URL=\"file:./data/settings.db\"" >>.env
-    
+
     log_success "DATABASE_URL added to .env file"
 }
 
@@ -481,11 +489,9 @@ check_service() {
     fi
 }
 
-
 # Stop the application before updating
 stop_application() {
-    
+
-    
     # Change to the application directory if we're not already there
     local app_dir
     if [ -f "package.json" ] && [ -f "server.js" ]; then
@@ -503,9 +509,9 @@ stop_application() {
             return 1
         fi
     fi
-    
+
     log "Working from application directory: $(pwd)"
-    
+
     # Check if systemd service is running and disable it temporarily
     if check_service && systemctl is-active --quiet pvescriptslocal.service; then
         log "Disabling systemd service temporarily to prevent auto-restart..."
@@ -518,7 +524,7 @@ stop_application() {
     else
         log "No running systemd service found"
     fi
-    
+
     # Kill any remaining npm/node processes
     log "Killing any remaining npm/node processes..."
     local pids
@@ -537,9 +543,9 @@ stop_application() {
 # Update application files
 update_files() {
     local source_dir="$1"
-    
+
     log "Updating application files..."
-    
+
     # List of files/directories to exclude from update
     local exclude_patterns=(
         "data"
@@ -555,48 +561,48 @@ update_files() {
         "scripts/tools"
         "scripts/vm"
     )
-    
+
     # Find the actual source directory (strip the top-level directory)
     local actual_source_dir
     actual_source_dir=$(find "$source_dir" -maxdepth 1 -type d -name "community-scripts-ProxmoxVE-Local-*" | head -1)
-    
+
     if [ -z "$actual_source_dir" ]; then
         log_error "Could not find the actual source directory in $source_dir"
         return 1
     fi
-    
+
     # Verify critical files exist in source
     if [ ! -f "$actual_source_dir/package.json" ]; then
         log_error "package.json not found in source directory!"
         return 1
     fi
-    
+
     # Use process substitution instead of pipe to avoid subshell issues
     local files_copied=0
     local files_excluded=0
-    
+
     # Create a temporary file list to avoid process substitution issues
     local file_list="/tmp/file_list_$$.txt"
-    find "$actual_source_dir" -type f > "$file_list"
+    find "$actual_source_dir" -type f >"$file_list"
-    
+
     while IFS= read -r file; do
         local rel_path="${file#$actual_source_dir/}"
         local should_exclude=false
-        
+
         for pattern in "${exclude_patterns[@]}"; do
             if [[ "$rel_path" == $pattern ]] || [[ "$rel_path" == $pattern/* ]]; then
                 should_exclude=true
                 break
             fi
         done
-        
+
         if [ "$should_exclude" = false ]; then
             local target_dir
             target_dir=$(dirname "$rel_path")
             if [ "$target_dir" != "." ]; then
                 mkdir -p "$target_dir"
             fi
-            
+
             if ! cp "$file" "$rel_path"; then
                 log_error "Failed to copy $rel_path"
                 rm -f "$file_list"
@@ -606,48 +612,47 @@ update_files() {
         else
             files_excluded=$((files_excluded + 1))
         fi
-    done < "$file_list"
+    done <"$file_list"
-    
+
     # Clean up temporary file
     rm -f "$file_list"
-    
+
     # Verify critical files were copied
     if [ ! -f "package.json" ]; then
         log_error "package.json was not copied to target directory!"
         return 1
     fi
-    
+
     if [ ! -f "package-lock.json" ]; then
         log_warning "package-lock.json was not copied!"
     fi
-    
+
     log_success "Application files updated successfully ($files_copied files)"
 }
 
-
 # Install dependencies and build
 install_and_build() {
     log "Installing dependencies..."
-    
+
     # Verify package.json exists
     if [ ! -f "package.json" ]; then
         log_error "package.json not found! Cannot install dependencies."
         return 1
     fi
-    
+
     if [ ! -f "package-lock.json" ]; then
         log_warning "No package-lock.json found, npm will generate one"
     fi
-    
+
     # Create temporary file for npm output
     local npm_log="/tmp/npm_install_$$.log"
-    
+
     # Ensure NODE_ENV is not set to production during install (we need devDependencies for build)
     local old_node_env="${NODE_ENV:-}"
     export NODE_ENV=development
-    
+
     # Run npm install to get ALL dependencies including devDependencies
-    if ! npm install --include=dev > "$npm_log" 2>&1; then
+    if ! npm install --include=dev >"$npm_log" 2>&1; then
         log_error "Failed to install dependencies"
         log_error "npm install output (last 30 lines):"
         tail -30 "$npm_log" | while read -r line; do
@@ -656,20 +661,20 @@ install_and_build() {
         rm -f "$npm_log"
         return 1
     fi
-    
+
     # Restore NODE_ENV
     if [ -n "$old_node_env" ]; then
         export NODE_ENV="$old_node_env"
     else
         unset NODE_ENV
     fi
-    
+
     log_success "Dependencies installed successfully"
     rm -f "$npm_log"
-    
+
     # Generate Prisma client
     log "Generating Prisma client..."
-    if ! npx prisma generate > "$npm_log" 2>&1; then
+    if ! npx prisma generate >"$npm_log" 2>&1; then
         log_error "Failed to generate Prisma client"
         log_error "Prisma generate output:"
         cat "$npm_log" | while read -r line; do
@@ -679,7 +684,7 @@ install_and_build() {
         return 1
     fi
     log_success "Prisma client generated successfully"
-    
+
     # Check if Prisma migrations exist and are compatible
     if [ -d "prisma/migrations" ]; then
         log "Existing migration history detected"
@@ -688,10 +693,10 @@ install_and_build() {
     else
         log_warning "No existing migration history found - this may be a fresh install"
     fi
-    
+
     # Run Prisma migrations
     log "Running Prisma migrations..."
-    if ! npx prisma migrate deploy > "$npm_log" 2>&1; then
+    if ! npx prisma migrate deploy >"$npm_log" 2>&1; then
         log_warning "Prisma migrations failed or no migrations to run"
         log "Prisma migrate output:"
         cat "$npm_log" | while read -r line; do
@@ -701,15 +706,18 @@ install_and_build() {
         log_success "Prisma migrations completed successfully"
     fi
     rm -f "$npm_log"
-    
+
     log "Building application..."
     # Set NODE_ENV to production for build
     export NODE_ENV=production
-    
+    # Unset TURBOPACK to prevent "Multiple bundler flags" error with --webpack
+    unset TURBOPACK 2>/dev/null || true
+    export TURBOPACK=''
+
     # Create temporary file for npm build output
     local build_log="/tmp/npm_build_$$.log"
-    
+
-    if ! npm run build > "$build_log" 2>&1; then
+    if ! TURBOPACK='' npm run build >"$build_log" 2>&1; then
         log_error "Failed to build application"
         log_error "npm run build output:"
         cat "$build_log" | while read -r line; do
@@ -718,18 +726,18 @@ install_and_build() {
         rm -f "$build_log"
         return 1
     fi
-    
+
     # Log success and clean up
     log_success "Application built successfully"
     rm -f "$build_log"
-    
+
     log_success "Dependencies installed and application built successfully"
 }
 
 # Start the application after updating
 start_application() {
     log "Starting application..."
-    
+
     # Use the global variable to determine how to start
     if [ "$SERVICE_WAS_RUNNING" = true ] && check_service; then
         log "Service was running before update, re-enabling and starting systemd service..."
@@ -761,11 +769,11 @@ start_application() {
 # Start application with npm
 start_with_npm() {
     log "Starting application with npm start..."
-    
+
     # Start in background
-    nohup npm start > server.log 2>&1 &
+    nohup npm start >server.log 2>&1 &
     local npm_pid=$!
-    
+
     # Wait a moment and check if it started
     sleep 3
     if kill -0 $npm_pid 2>/dev/null; then
@@ -776,13 +784,30 @@ start_with_npm() {
     fi
 }
 
+# Re-enable the systemd service on failure to prevent users from being locked out
+re_enable_service_on_failure() {
+    if check_service; then
+        log "Re-enabling systemd service after failure..."
+        if systemctl enable pvescriptslocal.service 2>/dev/null; then
+            log_success "Service re-enabled"
+            if systemctl start pvescriptslocal.service 2>/dev/null; then
+                log_success "Service started"
+            else
+                log_warning "Failed to start service - manual intervention may be required"
+            fi
+        else
+            log_warning "Failed to re-enable service - manual intervention may be required"
+        fi
+    fi
+}
+
 # Rollback function
 rollback() {
     log_warning "Rolling back to previous version..."
-    
+
     if [ -d "$BACKUP_DIR" ]; then
         log "Restoring from backup directory: $BACKUP_DIR"
-        
+
         # Restore data directory
         if [ -d "$BACKUP_DIR/data" ]; then
             log "Restoring data directory..."
@@ -797,7 +822,7 @@ rollback() {
         else
             log_warning "No data directory backup found"
         fi
-        
+
         # Restore .env file
         if [ -f "$BACKUP_DIR/.env" ]; then
             log "Restoring .env file..."
@@ -812,24 +837,24 @@ rollback() {
         else
             log_warning "No .env file backup found"
         fi
-        
+
         # Restore scripts directories
         local scripts_dirs=("ct" "install" "tools" "vm")
         for backup_name in "${scripts_dirs[@]}"; do
             if [ -d "$BACKUP_DIR/$backup_name" ]; then
                 local target_dir="scripts/$backup_name"
                 log "Restoring $target_dir directory from backup..."
-                
+
                 # Ensure scripts directory exists
                 if [ ! -d "scripts" ]; then
                     mkdir -p "scripts"
                 fi
-                
+
                 # Remove existing directory if it exists
                 if [ -d "$target_dir" ]; then
                     rm -rf "$target_dir"
                 fi
-                
+
                 if mv "$BACKUP_DIR/$backup_name" "$target_dir"; then
                     log_success "$target_dir directory restored from backup"
                 else
@@ -839,14 +864,17 @@ rollback() {
                 log_warning "No $backup_name directory backup found"
             fi
         done
-        
+
         # Clean up backup directory
         log "Cleaning up backup directory..."
         rm -rf "$BACKUP_DIR"
     else
         log_error "No backup directory found for rollback"
     fi
-    
+
+    # Re-enable the service so users aren't locked out
+    re_enable_service_on_failure
+
     log_error "Update failed. Please check the logs and try again."
     exit 1
 }
@@ -865,14 +893,14 @@ check_node_version() {
 
     log "Detected Node.js version: $current"
 
-    if (( major_version < 24 )); then
+    if ((major_version == 24)); then
+        log_success "Node.js 24 already installed"
+    elif ((major_version < 24)); then
         log_warning "Node.js < 24 detected → upgrading to Node.js 24 LTS..."
         upgrade_node_to_24
-    elif (( major_version > 24 )); then
+    else
         log_warning "Node.js > 24 detected → script tested only up to Node 24"
         log "Continuing anyway…"
-    else
-        log_success "Node.js 24 already installed"
     fi
 }
 
@@ -880,22 +908,39 @@ check_node_version() {
 upgrade_node_to_24() {
     log "Preparing Node.js 24 upgrade…"
 
-    # Remove old nodesource repo if it exists
+    # Remove old nodesource repo files if they exist
     if [ -f /etc/apt/sources.list.d/nodesource.list ]; then
+        log "Removing old nodesource.list file..."
         rm -f /etc/apt/sources.list.d/nodesource.list
     fi
+    if [ -f /etc/apt/sources.list.d/nodesource.sources ]; then
+        log "Removing old nodesource.sources file..."
+        rm -f /etc/apt/sources.list.d/nodesource.sources
+    fi
+
+    # Update apt cache first
+    log "Updating apt cache..."
+    apt-get update >>"$LOG_FILE" 2>&1 || true
 
     # Install NodeSource repo for Node.js 24
-    curl -fsSL https://deb.nodesource.com/setup_24.x -o /tmp/node24_setup.sh
+    log "Downloading Node.js 24 setup script..."
-    if ! bash /tmp/node24_setup.sh > /tmp/node24_setup.log 2>&1; then
+    if ! curl -fsSL https://deb.nodesource.com/setup_24.x -o /tmp/node24_setup.sh; then
+        log_error "Failed to download Node.js 24 setup script"
+        re_enable_service_on_failure
+        exit 1
+    fi
+
+    if ! bash /tmp/node24_setup.sh >/tmp/node24_setup.log 2>&1; then
         log_error "Failed to configure Node.js 24 repository"
         tail -20 /tmp/node24_setup.log | while read -r line; do log_error "$line"; done
+        re_enable_service_on_failure
         exit 1
     fi
 
     log "Installing Node.js 24…"
-    if ! apt-get install -y nodejs >> "$LOG_FILE" 2>&1; then
+    if ! apt-get install -y nodejs >>"$LOG_FILE" 2>&1; then
         log_error "Failed to install Node.js 24"
+        re_enable_service_on_failure
         exit 1
     fi
 
@@ -912,21 +957,21 @@ main() {
         init_log
         log "Running as detached process"
         sleep 3
-        
+
     else
         init_log
     fi
-    
+
     # Check if we're running from the application directory and not already relocated
     if [ -z "${PVE_UPDATE_RELOCATED:-}" ] && [ -f "package.json" ] && [ -f "server.js" ]; then
         log "Detected running from application directory"
         bash "$0" --relocated
         exit $?
     fi
-    
+
     # Ensure we're in the application directory
     local app_dir
-    
+
     # First check if we're already in the right directory
     if [ -f "package.json" ] && [ -f "server.js" ]; then
         app_dir="$(pwd)"
@@ -943,79 +988,76 @@ main() {
             exit 1
         fi
     fi
-    
+
     # Check dependencies
     check_dependencies
-    
+
     # Load GitHub token for higher rate limits
     load_github_token
-    
+
     # Check if service was running before update
     if check_service && systemctl is-active --quiet pvescriptslocal.service; then
         SERVICE_WAS_RUNNING=true
     else
         SERVICE_WAS_RUNNING=false
     fi
-    
+
     # Get latest release info
     local release_info
     release_info=$(get_latest_release)
-    
+
     # Backup data directory
     backup_data
-    
+
     # Stop the application before updating
     stop_application
 
     # Check Node.js version
     check_node_version
 
-    #Update Node.js to 24
-    upgrade_node_to_24
-    
     # Download and extract release
     local source_dir
     source_dir=$(download_release "$release_info")
-    
+
     # Clear the original directory before updating
     clear_original_directory
-    
+
     # Update files
     if ! update_files "$source_dir"; then
         log_error "File update failed, rolling back..."
         rollback
     fi
-    
+
     # Restore .env and data directory before building
     restore_backup_files
-    
+
     # Verify database was restored correctly
     if ! verify_database_restored; then
         log_error "Database verification failed, rolling back..."
         rollback
     fi
-    
+
     # Ensure DATABASE_URL is set for Prisma
     ensure_database_url
-    
+
     # Install dependencies and build
     if ! install_and_build; then
         log_error "Install and build failed, rolling back..."
         rollback
     fi
-    
+
     # Start the application
     if ! start_application; then
         log_error "Failed to start application after update"
         rollback
     fi
-    
+
     # Cleanup only after successful start
     rm -rf "$source_dir"
     rm -rf "/tmp/pve-update-$$"
     rm -rf "$BACKUP_DIR"
     log "Backup directory cleaned up"
-    
+
     log_success "Update completed successfully!"
 }
 
@@ -1023,4 +1065,4 @@ main() {
 if ! main "$@"; then
     log_error "Update script failed with exit code $?"
     exit 1
-fi
+fi