Merge claude/1

Pages and panels showed inconsistent loading states: the Backup center
and several admin pages (System, SSH, admin Overview), the Overview
Migrate/Peers panels, the per-app updater section and the backup engine
details modal rendered a bare 'Loading…' text line (updater-empty /
backup-empty-state) with no spinner, while Services/Config/Tasks used a
boxed card + spinner.

Add one shared loader — window.lpLoadingBox(message) + .lp-loading CSS in
the core/loading subsystem (the boxed card + accent spinner the good tabs
already use) — and route those bare-text loaders through it. The system
metric graph keeps its absolute overlay but gains the same spinner.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: librelad <librelad@digitalangels.vip>

.claude/scheduled_tasks.lock

@@ -0,0 +1 @@
+{"sessionId":"9cea077c-56da-4223-a765-be38c688106b","pid":1384,"procStart":"1332","acquiredAt":1780168110981}

.gitattributes

@@ -0,0 +1,10 @@
+# Paths excluded from release tarballs. `git archive` (used by
+# scripts/release/make_release.sh) honours `export-ignore`, so these dev-only
+# trees never ship in libreportal-<ver>.tar.gz.
+scripts/unused    export-ignore
+scripts/release   export-ignore
+site              export-ignore
+docs              export-ignore
+.claude           export-ignore
+.gitignore        export-ignore
+.gitattributes    export-ignore

.gitignore

@@ -10,3 +10,14 @@
 # Node dependencies — installed via `npm ci` at image build, never vendored.
 node_modules/
 npm-debug.log*
+
+# Release build output (scripts/release/make_release.sh).
+/dist/
+
+# Eleventy site build output + generator-produced data (scripts/gen-data.mjs).
+# site/ is the legacy website location (active site now lives in
+# containers/weblibreportal); these are build artifacts, not source.
+site/dist/
+site/src/_data/apps.json
+site/src/_data/categories.json
+

CLAUDE.md

@@ -0,0 +1,19 @@
+# LibrePortal — agent notes
+
+## Verify WebUI changes visually before marking them done
+After changing anything user-visible in the WebUI (`containers/libreportal/frontend/`),
+confirm it actually renders correctly — syntax checks and type-correctness don't
+catch layout or visual regressions.
+
+The maintainer's dev environment provides a headless screenshot helper, `lp-shot`,
+that captures a WebUI route (or a single element, via a trailing CSS selector) to a
+PNG for review:
+
+```
+lp-shot /admin/system                       # full route -> /tmp/webui-shot.png
+lp-shot /admin/system /tmp/x.png 12 ".sys-strip"   # just one element, crisp
+```
+
+Use it (and read the PNG) to self-check UI work instead of assuming it looks right or
+asking the user to look. Skip it for purely backend/non-visual edits. If `lp-shot`
+isn't present, fall back to asking the user for a screenshot.

README.md

@@ -21,7 +21,7 @@ toggle — it's the whole point.
 
 The entire platform is **free software under the [GNU AGPLv3](LICENSE)**.
 Self-host it and you get **everything** — every feature, no paywalls, no
-telemetry. See [our Promise](PROMISE.md) for exactly what that means.
+telemetry. See [our Promise](docs/guide/promise.md) for exactly what that means.
 
 ## What you get
 
@@ -34,11 +34,22 @@ telemetry. See [our Promise](PROMISE.md) for exactly what that means.
 ## Quick start
 
 ```bash
-git clone https://gitea.scottwebstar.co.uk/Webstar/LibrePortal.git
-cd LibrePortal
-./init.sh
+curl -fsSL https://get.libreportal.org/install.sh | sudo bash
 ```
 
+This installs a versioned, checksum-verified release (Debian/Ubuntu, root). Put
+data on separate disks with `--system-dir=` / `--containers-dir=` / `--backups-dir=`.
+
+> The `get.libreportal.org` host is still being set up — until it's live, build a
+> release and install from it locally (see the docs below).
+
+## Documentation
+
+- **[docs/guide/install-and-use.md](docs/guide/install-and-use.md)** — install, place data on separate disks/drives,
+  update, back up, uninstall.
+- **[docs/contributing/development.md](docs/contributing/development.md)** — run a dev copy, cut stable/edge
+  releases, and test them before publishing.
+
 ## LibrePortal Connect (optional)
 
 Self-hosting is free and complete. If you'd rather not fiddle with the tricky
@@ -48,11 +59,11 @@ different: we work like a **courier carrying a sealed box.** We move your data
 between your devices and store backup copies, but it stays locked and *you*
 hold the only key — we can't open it, and we never run your apps for you.
 **Everything we offer, you can also set up yourself for free.**
-[Our Promise](PROMISE.md) spells out exactly where that line sits.
+[Our Promise](docs/guide/promise.md) spells out exactly where that line sits.
 
 ## Contributing
 
-PRs welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). We use a lightweight
+PRs welcome — see [CONTRIBUTING.md](docs/contributing/contributing.md). We use a lightweight
 DCO sign-off (`git commit -s`), no CLA.
 
 ## Acknowledgments

configs/backup/.category

@@ -2,4 +2,4 @@ TITLE=Backup
 DESCRIPTION=Backup schedules, retention, and engine settings
 ICON=backup
 ORDER=3
-SUBCATEGORY_ORDER=backup_general,backup_retention,backup_advanced
+SUBCATEGORY_ORDER=backup_general,backup_retention,backup_engine

configs/backup/backup_engine

@@ -1,8 +1,9 @@
 # ================================================================================
-# Backup Advanced - **ADVANCED** Engine-level knobs most users won't need to touch
+# Backup Engine - **ADVANCED** Engine-level knobs most users won't need to touch
 # ================================================================================
-CFG_BACKUP_ENGINE=restic                                       # Default Backup Engine - Fallback engine for new locations (each location can override) [restic:restic|borg:BorgBackup|kopia:Kopia]
-CFG_BACKUP_STRATEGY=stop-snapshot-start                        # Backup Strategy - How containers are quiesced before snapshotting [stop-snapshot-start:Stop → snapshot → start (safe default)|pause-snapshot-unpause:Pause → snapshot → unpause (less downtime)|live:Live — snapshot while running (only with DB dump hooks)]
+CFG_BACKUP_ENGINE=restic                                       # Default Backup Engine - Fallback engine for new locations (each location can override) [restic:Restic|borg:BorgBackup|kopia:Kopia]
+CFG_BACKUP_DEFAULT_PATH=                                        # Default Backup Location - Base directory for locations set to Automatic path mode; each location lives in its own numbered subfolder (<path>/<id>). Empty = the LibrePortal backups root (own mount-able).
+CFG_BACKUP_STRATEGY=auto                                       # Backup Strategy - How containers are quiesced before snapshotting [auto:Automatic — live where safe, stop otherwise (recommended)|stop-snapshot-start:Stop → snapshot → start (always safe)|pause-snapshot-unpause:Pause → snapshot → unpause (less downtime)|live:Live — snapshot while running (force)]
 CFG_BACKUP_VERIFY_AFTER=true                                   # Verify After Backup - Run integrity check after each backup
 CFG_BACKUP_VERIFY_DATA_PERCENT=5                               # Verify Data Sample % - Percentage of repo data to checksum-verify weekly
 CFG_BACKUP_PARALLEL_REPOS=true                                 # Parallel Repos - Push to all enabled locations in parallel

configs/backup/backup_general

@@ -2,4 +2,3 @@
 # Backup General - Scheduling
 # ================================================================================
 CFG_BACKUP_CRONTAB_APP="0 5 * * *"                             # App Backup Schedule - Crontab schedule for application backups
-CFG_BACKUP_CRONTAB_APP_INTERVAL=3                              # App Backup Interval - Minutes between app backup checks

configs/backup/locations/1/location.config

@@ -2,23 +2,23 @@
 # Edit via the Locations page on /backup, or directly here.
 CFG_BACKUP_LOC_1_NAME="Local disk"                              # Location Name - Friendly label shown in the UI
 CFG_BACKUP_LOC_1_ENABLED=true                                   # Enabled - Snapshot to this location
-CFG_BACKUP_LOC_1_ENGINE=restic                                  # Engine - Backup engine used at this location [restic:restic|borg:BorgBackup|kopia:Kopia]
+CFG_BACKUP_LOC_1_ENGINE=restic                                  # Engine - Backup engine used at this location [restic:Restic|borg:BorgBackup|kopia:Kopia] **ADVANCED**
 CFG_BACKUP_LOC_1_PASSWORD=RANDOMIZEDPASSWORD1                   # Repository Password - Used to encrypt/decrypt snapshots — back up offline!
 CFG_BACKUP_LOC_1_TYPE=local                                     # Type - Backend [local:Local / mounted path|sftp:SFTP|rest:REST|s3:S3|b2:Backblaze B2|gs:Google Cloud Storage|azure:Azure|rclone:rclone]
-CFG_BACKUP_LOC_1_PATH_MODE=auto                                 # Path Mode - Where this location stores its data [auto:Automatic (/docker/backups/<id>)|custom:Custom path]
+CFG_BACKUP_LOC_1_PATH_MODE=auto                                 # Path Mode - Automatic uses the Default Backup Location from the Backup Engine config (one subfolder per location); Custom uses the path below [auto:Automatic|custom:Custom path]
 CFG_BACKUP_LOC_1_PATH=                                          # Custom Path - Filesystem path on this server (used when Path Mode = Custom)
-CFG_BACKUP_LOC_1_URI=                                           # URI Override - Custom restic URI (leave blank to build from the fields below)
+CFG_BACKUP_LOC_1_URI=                                           # URI Override - Custom restic URI (leave blank to build from the fields below) **ADVANCED**
 CFG_BACKUP_LOC_1_SSH_USER=                                      # SSH User - For sftp type
 CFG_BACKUP_LOC_1_SSH_HOST=                                      # SSH Host - For sftp type
-CFG_BACKUP_LOC_1_SSH_PORT=22                                    # SSH Port - For sftp type
+CFG_BACKUP_LOC_1_SSH_PORT=22                                    # SSH Port - For sftp type **ADVANCED**
 CFG_BACKUP_LOC_1_SSH_PATH=                                      # SSH Remote Path - Path on the remote host where the repo lives
-CFG_BACKUP_LOC_1_SSH_AUTH=key                                   # SSH Authentication - [key:SSH key (~/.ssh/id_rsa)|password:Password (via sshpass)]
+CFG_BACKUP_LOC_1_SSH_AUTH=key                                   # SSH Authentication - [key:SSH key (managed by LibrePortal)|password:Password (via sshpass)]
 CFG_BACKUP_LOC_1_SSH_PASS=                                      # SSH Password - Used only when SSH Authentication is set to Password
 CFG_BACKUP_LOC_1_S3_ACCESS_KEY=                                 # S3 Access Key - For s3 type
 CFG_BACKUP_LOC_1_S3_SECRET_KEY=                                 # S3 Secret Key - For s3 type
 CFG_BACKUP_LOC_1_B2_ACCOUNT_ID=                                 # B2 Account ID - For b2 type
 CFG_BACKUP_LOC_1_B2_ACCOUNT_KEY=                                # B2 Account Key - For b2 type
-CFG_BACKUP_LOC_1_APPEND_ONLY=false                              # Append-only - Refuse forget/prune for this location (ransomware-safe)
+CFG_BACKUP_LOC_1_APPEND_ONLY=false                              # Append-only - Refuse forget/prune for this location (ransomware-safe) **ADVANCED**
 CFG_BACKUP_LOC_1_CUSTOM_RETENTION=false                         # Custom Retention - Override the global retention for this location
 CFG_BACKUP_LOC_1_KEEP_LAST=                                     # Keep Last - Snapshots to always retain (blank = global)
 CFG_BACKUP_LOC_1_KEEP_DAILY=                                    # Keep Daily - Days (blank = global)

configs/features/.category

@@ -1,5 +0,0 @@
-TITLE=Features
-DESCRIPTION=Toggle system components and features
-ICON=features
-ORDER=5
-SUBCATEGORY_ORDER=features_core,features_security,features_terminal

configs/features/features_core

@@ -1,18 +0,0 @@
-# ================================================================================
-# Core Features - Essential LibrePortal functionality and core services
-# ================================================================================
-CFG_REQUIREMENT_CONFIG=true                               # Configuration Management - Enable configuration management system for LibrePortal settings
-CFG_REQUIREMENT_COMMAND=true                              # Command Line Tool - Install the libreportal command line tool for system management
-CFG_REQUIREMENT_WEBUI=true                                # Web Interface - Install and manage the LibrePortal web based management interface
-CFG_REQUIREMENT_WEBUI_SERVICE=true                        # Web Task Service - Install the task management systemd service for the web interface
-CFG_REQUIREMENT_DATABASE=true                             # Database Support - Install and configure database support for application data storage
-CFG_REQUIREMENT_PASSWORDS=true                            # Password Management - Enable password generation and management features
-CFG_REQUIREMENT_DOCKER_CE=true                            # Docker CE - Install Docker Community Edition instead of the default Docker version
-CFG_REQUIREMENT_DOCKER_COMPOSE=true                       # Docker Compose - Install Docker Compose for multi container application management
-CFG_REQUIREMENT_DOCKER_NETWORK=true                       # Docker Network - Create and manage Docker network for container communication
-CFG_REQUIREMENT_UFW=true                                  # Firewall Protection - Install and configure the Uncomplicated Firewall for system security
-CFG_REQUIREMENT_UFWD=true                                 # Docker Firewall - Install UFW Docker for container aware firewall management which is rooted Docker specific
-CFG_REQUIREMENT_SSLCERTS=true                             # SSL Certificates - Generate and manage SSL certificates for secure HTTPS connections
-CFG_REQUIREMENT_CRONTAB=true                              # Scheduled Tasks - Setup scheduled tasks and automated maintenance jobs
-CFG_REQUIREMENT_WHITELIST_PORT_UPDATER=true               # Auto Port Management - Automatically update port whitelist when applications are installed or removed
-CFG_REQUIREMENT_BCRYPT_SAVE=true                          # Password Encryption - Encrypt saved passwords using bcrypt for enhanced security

configs/features/features_security

@@ -1,7 +0,0 @@
-# ================================================================================
-# Security and Authentication - SSH access and security configuration
-# ================================================================================
-CFG_REQUIREMENT_SSHKEY_DOWNLOADER=false                   # SSH Key Downloader - Enable SSH key download functionality for remote access
-CFG_REQUIREMENT_SSH_DISABLE_PASSWORDS=false               # SSH Password Disable - Disable password authentication for SSH requiring key based access only
-CFG_REQUIREMENT_GLUETUN_FOR_ALL=false                     # Gluetun For All Apps - Allow routing through Gluetun VPN for every app (default: only curated categories)
-

configs/features/features_terminal

@@ -1,12 +0,0 @@
-# ================================================================================
-# Terminal Only - Advanced terminal based features and utilities **ADVANCED**
-# ================================================================================
-CFG_REQUIREMENT_SUGGEST_INSTALLS=false                    # Install Suggestions - Enable application suggestions and recommendations during installation
-CFG_REQUIREMENT_SUGGEST_METRICS=true                      # Metrics Suggestions - Offer Prometheus and Grafana during first install (requires Install Suggestions enabled)
-CFG_REQUIREMENT_CONTINUE_PROMPT=false                     # Continue Prompts - Show continue prompts during installation for user confirmation
-CFG_REQUIREMENT_CONFIGS_CHECK=true                        # Config Validation - Validate configuration files on startup for errors and consistency
-CFG_REQUIREMENT_CONFIGS_AUTO_UPDATE=true                  # Auto Config Updates - Add new config options from the template (non-interactive)
-CFG_REQUIREMENT_CONFIGS_AUTO_DELETE=true                  # Auto Config Deletes - Remove config options no longer present in the template
-CFG_REQUIREMENT_MISSING_IPS=false                         # IP Configuration Check - Check for and alert about missing IP configurations
-CFG_REQUIREMENT_DOCKER_NETWORK_PRUNE=true                 # Docker Network Cleanup - Enable automatic cleanup of unused Docker networks
-CFG_REQUIREMENT_DOCKER_SWITCHER=true                      # Docker Switcher - Install Docker version switching utility for managing multiple Docker versions

configs/general/general_basic

@@ -3,3 +3,4 @@
 # ================================================================================
 CFG_INSTALL_NAME=Change-Me                               # Installation Name - The name for your LibrePortal instance
 CFG_TIMEZONE=Etc/UTC                                     # System Timezone - Timezone for scheduled tasks and logging timestamps
+CFG_INSTALL_LEVEL=beginner                               # Experience Level - Beginner hides technical detail and skips advanced setup steps. Advanced reveals everything by default. Set during the first-run wizard; can be flipped any time via the Advanced toggle in the WebUI. [beginner:Beginner — simple|advanced:Advanced — show everything]

configs/general/general_docker_install

@@ -1,7 +1,7 @@
 # ================================================================================
 # Docker - Container runtime installation and configuration **ADVANCED**
 # ================================================================================
-CFG_DOCKER_INSTALL_TYPE=rooted                           # Docker Installation Type - Security based setup rooted or rootless Docker installation [rooted|rootless]
+CFG_DOCKER_INSTALL_TYPE=rootless                          # Docker Installation Type - rootless (default, recommended): containers run unprivileged so a breakout isn't host root; rooted: legacy, containers run as root [rootless|rooted]
 CFG_DOCKER_INSTALL_USER=dockerinstall                    # Docker Install User - Username for Docker installation operations
 CFG_DOCKER_INSTALL_PASS=RANDOMIZEDPASSWORD2              # Docker Install Password - Password for Docker install user
 

configs/general/general_install

@@ -1,9 +1,20 @@
 # ================================================================================
 # Installation Setup - Local or Git Repository configuration and version control
 # ================================================================================
-CFG_INSTALL_MODE=local                     # Installation Mode - Method used for installation of LibrePortal
+CFG_INSTALL_MODE=release                   # Installation Mode - How LibrePortal is fetched + updated. Hidden by default — only shown when Developer Mode is on (click the LibrePortal logo 10 times) or when the install is already on git/local (auto-enables Developer Mode). **DEV** [release:Release - Stable|git:Git clone|local:Local folder]
+CFG_RELEASE_BASE_URL=https://get.libreportal.org        # Release Host - Base URL serving the release channels (override for self-hosting) **ADVANCED**
+CFG_RELEASE_CHANNEL=stable                              # Release Channel - Pick the release channel for the tarball installer. Stable is the recommended default; Edge ships from main and may contain in-flight changes. **DEV** [stable:Release - Stable|edge:Release - Bleeding Edge]
+CFG_DEV_MODE=false                                       # Developer Mode - Reveal advanced developer / dev-install options across the WebUI. Auto-enables when the install is already on git/local. Easter egg: click the LibrePortal logo 10 times to toggle. **ADVANCED** [true:On|false:Off]
 CFG_GIT_URL=changeme                                     # Git Repository URL - Git repository URL for LibrePortal configuration
 CFG_GIT_USER=changeme                                    # Git Username - Git username for repository authentication
 CFG_GIT_KEY=changeme                                     # Git Access Key - SSH key or API key for Git repository access
-CFG_GIT_UPDATES=true                                     # Auto Check Updates - Check for Git repository updates automatically
-CFG_GIT_AUTO_UPDATES=true                                # Auto Apply Updates - Automatically apply Git updates when available
+CFG_GIT_UPDATES=true                                     # Auto Check Updates - Check for updates automatically
+CFG_GIT_AUTO_UPDATES=true                                # Auto Apply Updates - Automatically apply updates when available
+CFG_REQUIREMENT_CONFIG=true                              # Configuration Management - Install the configuration management system. Disabling this on an existing install will brick the system. **ADVANCED** **DEV**
+CFG_REQUIREMENT_COMMAND=true                             # Command Line Tool - Install the libreportal command line tool. Disabling this on an existing install will brick the system. **ADVANCED** **DEV**
+CFG_REQUIREMENT_WEBUI=true                               # Web Interface - Install the LibrePortal WebUI. Disabling this on an existing install will brick the system. **ADVANCED** **DEV**
+CFG_REQUIREMENT_WEBUI_SERVICE=true                       # Web Task Service - Install the task-processor systemd service that backs the WebUI. Disabling this on an existing install will brick the system. **ADVANCED** **DEV**
+CFG_REQUIREMENT_DATABASE=true                            # Database Support - Install and configure database support for application data storage. Install-time choice only — flipping post-install will not retrofit. **ADVANCED** **DEV**
+CFG_REQUIREMENT_PASSWORDS=true                           # Password Management - Enable password generation and management features. Install-time choice only. **ADVANCED** **DEV**
+CFG_REQUIREMENT_DOCKER_CE=true                           # Docker CE - Install Docker Community Edition instead of the distro default. Install-time choice only — flipping post-install does not swap Docker. **ADVANCED** **DEV**
+CFG_REQUIREMENT_DOCKER_COMPOSE=true                      # Docker Compose - Install Docker Compose for multi-container application management. Install-time choice only. **ADVANCED** **DEV**

configs/general/general_terminal

@@ -7,3 +7,12 @@ CFG_GENERATED_PASS_LENGTH=14                             # Password Length - Len
 CFG_GENERATED_USER_LENGTH=8                              # Username Length - Length for auto generated usernames
 CFG_UFW_LOGGING=off                                      # Firewall Logging - UFW firewall logging level [off|low|medium|high|full]
 CFG_TEXT_EDITOR=nano                                     # Text Editor - Default text editor for system operations [nano|vim]
+CFG_REQUIREMENT_CRONTAB=true                             # Scheduled Tasks - Install scheduled tasks and automated maintenance jobs
+CFG_REQUIREMENT_CONFIGS_CHECK=true                       # Config Validation - Validate configuration files on startup for errors and consistency
+CFG_REQUIREMENT_CONFIGS_AUTO_UPDATE=true                 # Auto Config Updates - Add new config options from the template (non-interactive)
+CFG_REQUIREMENT_CONFIGS_AUTO_DELETE=true                 # Auto Config Deletes - Remove config options no longer present in the template
+CFG_REQUIREMENT_MISSING_IPS=false                        # IP Configuration Check - Check for and alert about missing IP configurations
+CFG_REQUIREMENT_CONTINUE_PROMPT=false                    # Continue Prompts - Show continue prompts during installation for user confirmation
+CFG_REQUIREMENT_CONTINUE_ON_ERROR=true                   # Continue On Error - Log failures to error_report.log and continue instead of aborting (on by default to surface issues; turn off for strict abort once clean)
+CFG_REQUIREMENT_SUGGEST_INSTALLS=false                   # Install Suggestions - Enable application suggestions and recommendations during installation
+CFG_REQUIREMENT_SUGGEST_METRICS=true                     # Metrics Suggestions - Offer Prometheus and Grafana during first install (requires Install Suggestions enabled)

configs/network/.category

@@ -2,4 +2,4 @@ TITLE=Network
 DESCRIPTION=Network configuration and domain management
 ICON=network
 ORDER=4
-SUBCATEGORY_ORDER=network_domains,network_whitelist,network_dns,network_docker,network_ports,network_headscale
+SUBCATEGORY_ORDER=network_domains,network_whitelist,network_firewall,network_dns,network_docker,network_rootless,network_ports,network_headscale

configs/network/network_docker

@@ -5,3 +5,6 @@
 CFG_NETWORK_NAME=vpn                                     # Network Name - Docker network name for container communication
 CFG_NETWORK_SUBNET=10.100.0.0/16                         # Network Subnet - Subnet range for Docker network
 CFG_NETWORK_MTU=1500                                     # Network MTU - Maximum transmission unit for network packets
+CFG_REQUIREMENT_DOCKER_NETWORK=true                      # Docker Network - Create and manage the Docker network for container communication
+CFG_REQUIREMENT_DOCKER_NETWORK_PRUNE=true                # Network Cleanup - Automatically prune unused Docker networks
+CFG_REQUIREMENT_DOCKER_SWITCHER=true                     # Docker Switcher - Install the Docker version switching utility

configs/network/network_domains

@@ -10,3 +10,4 @@ CFG_DOMAIN_6=                                            # Domain 6 - Domain slo
 CFG_DOMAIN_7=                                            # Domain 7 - Domain slot 7 for a Traefik
 CFG_DOMAIN_8=                                            # Domain 8 - Domain slot 8 for a Traefik
 CFG_DOMAIN_9=                                            # Domain 9 - Domain slot 9 for a Traefik
+CFG_REQUIREMENT_SSLCERTS=true                            # SSL Certificates - Generate and manage SSL certificates for secure HTTPS connections **ADVANCED**

configs/network/network_firewall

@@ -0,0 +1,6 @@
+# ================================================================================
+# Firewall - Host firewall and port-whitelist automation **ADVANCED**
+# ================================================================================
+CFG_REQUIREMENT_UFW=true                                 # Firewall Protection - Install and configure the Uncomplicated Firewall (UFW) for system security
+CFG_REQUIREMENT_UFWD=true                                # Docker Firewall - Install UFW-Docker for container-aware firewall management (rooted Docker only)
+CFG_REQUIREMENT_WHITELIST_PORT_UPDATER=true              # Auto Port Whitelisting - Update the port whitelist automatically when applications are installed or removed

configs/network/network_rootless

@@ -0,0 +1,5 @@
+# ================================================================================
+# Rootless Networking - Network stack and behaviour for rootless Docker **ADVANCED**
+# ================================================================================
+
+CFG_ROOTLESS_NET=pasta                                   # Rootless Network Driver - Network stack for rootless Docker. pasta (default): actively maintained, preserves the real client source IP on inbound connections, lower idle CPU; slirp4netns: legacy fallback, maintenance-only upstream. The matching rootlesskit port driver is selected automatically. On Debian, the installer also applies the local AppArmor override pasta needs (see scripts/docker/install/rootless/rootless_apparmor.sh) so this is a single-toggle switch. **ADVANCED** [pasta:Pasta (default, actively maintained)|slirp4netns:slirp4netns (legacy fallback)]

configs/security/.category

@@ -2,4 +2,4 @@ TITLE=Security
 DESCRIPTION=Intrusion prevention, bouncers, and host firewall configuration
 ICON=security
 ORDER=5
-SUBCATEGORY_ORDER=security_logins
+SUBCATEGORY_ORDER=security_logins,security_ssh

configs/security/security_ssh

@@ -0,0 +1,7 @@
+# ================================================================================
+# SSH & Access Hardening - Secure remote access and auth-storage toggles **ADVANCED**
+# ================================================================================
+CFG_REQUIREMENT_SSHKEY_DOWNLOADER=false                  # SSH Key Downloader - Enable SSH key download functionality for remote access
+CFG_REQUIREMENT_SSH_DISABLE_PASSWORDS=false              # Disable SSH Passwords - Disable password authentication for SSH (requires key-based access only)
+CFG_REQUIREMENT_BCRYPT_SAVE=true                         # Password Encryption - Encrypt saved passwords using bcrypt for enhanced security
+CFG_REQUIREMENT_GLUETUN_FOR_ALL=false                    # Gluetun For All Apps - Allow routing through Gluetun VPN for every app (default: only curated categories)

configs/webui/.category

@@ -2,4 +2,4 @@ TITLE=WebUI
 DESCRIPTION=Web interface settings and preferences
 ICON=webui
 ORDER=2
-SUBCATEGORY_ORDER=webui_logins,webui_logs
+SUBCATEGORY_ORDER=webui_logins,webui_logs,webui_updater

configs/webui/webui_updater

@@ -0,0 +1,5 @@
+# ================================================================================
+# WebUI Updater - Automatic app update, CVE & improvement scanning **ADVANCED**
+# ================================================================================
+CFG_UPDATER_SCAN_INTERVAL=30                               # App Scan Interval - Minutes between automatic app update/CVE/improvement scans. 0 disables.
+CFG_HOTFIX_AUTO=security-breakage                          # Hotfix Auto-Apply - Which signed hotfix severities apply automatically on the update check [security-breakage|all|off]

containers/adguard/adguard.config

@@ -14,6 +14,7 @@
 #
 CFG_ADGUARD_APP_NAME=adguard
 CFG_ADGUARD_BACKUP=true
+CFG_ADGUARD_BACKUP_STRATEGY=auto
 CFG_ADGUARD_COMPOSE_FILE=default
 CFG_ADGUARD_HEALTHCHECK=true
 CFG_ADGUARD_AUTHELIA=false

containers/adguard/adguard.sh

@@ -1,276 +0,0 @@
-#!/bin/bash
-
-# Category : Networking
-# Description : AdGuard - DNS based Ad Blocking (c/u/s/r/i):
-
-installAdguard()
-{
-    local config_variables="$1"
-
-    if [[ "$adguard" == *[cCtTuUsSrRiI]* ]]; then
-        dockerConfigSetupToContainer silent adguard;
-        local app_name=$CFG_ADGUARD_APP_NAME
-    	initializeAppVariables $app_name;
-    fi
-
-    if [[ "$adguard" == *[cC]* ]]; then
-        editAppConfig $app_name;
-    fi
-
-    if [[ "$adguard" == *[uU]* ]]; then
-        dockerUninstallApp $app_name;
-    fi
-
-    if [[ "$adguard" == *[sS]* ]]; then
-        dockerComposeDown $app_name;
-    fi
-
-    if [[ "$adguard" == *[rR]* ]]; then
-        dockerComposeRestart $app_name;
-    fi
-
-    if [[ "$adguard" == *[iI]* ]]; then
-        isHeader "Install $app_name"
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Setting up install folder and config file for $app_name."
-        echo ""
-
-        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
-        isSuccessful "Install folders and Config files have been setup for $app_name."
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
-        echo ""
-
-        dockerComposeSetupFile $app_name;
-
-        monitoringToggleAppConfig "$app_name" "docker-compose.yml";
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Updating file permissions before starting."
-        echo ""
-
-		fixPermissionsBeforeStart $app_name;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
-        echo ""
-
-		dockerComposeUpdateAndStartApp $app_name install;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Completing AdGuardHome initial setup automatically"
-        echo ""
-
-        # The legacy `$usedport1` variable is no longer populated by the
-        # current install pipeline; the resolved host port is stored in the
-        # PORTS_TAG_1 docker-compose tag (format `external:internal`). Pull
-        # it from there so the curl + URL printout actually point somewhere.
-        local adguard_compose_file="$containers_dir$app_name/docker-compose.yml"
-        local adguard_port_pair
-        adguard_port_pair=$(tagsManagerGetTagContent "$adguard_compose_file" "PORTS_TAG_1")
-        local adguard_admin_port="${adguard_port_pair%%:*}"
-
-        if [[ -n "$public_ip_v4" && -n "$adguard_admin_port" ]]; then
-            echo "    External : http://$public_ip_v4:$adguard_admin_port/"
-        fi
-        if [[ -n "$host_setup" ]]; then
-            echo "    Hostname : http://$host_setup/"
-        fi
-        echo ""
-
-        # AdGuardHome ships a setup wizard that normally needs five clicks in a
-        # browser before the daemon writes its config file. Same wizard is
-        # exposed as an HTTP API (POST /control/install/configure), so we
-        # drive it from here and skip the manual interaction. We pre-poll the
-        # admin endpoint until the container is up, then send the form, then
-        # let the existing post-install sed edits run against the freshly
-        # written AdGuardHome.yaml.
-        local adguard_setup_url="http://127.0.0.1:${adguard_admin_port}"
-        local adguard_attempts=0
-        local adguard_max_attempts=60
-        while ((adguard_attempts < adguard_max_attempts)); do
-            if curl -fsS -o /dev/null --max-time 2 "${adguard_setup_url}/control/status" 2>/dev/null \
-               || curl -fsS -o /dev/null --max-time 2 "${adguard_setup_url}/control/install/get_addresses" 2>/dev/null; then
-                break
-            fi
-            sleep 2
-            ((adguard_attempts++))
-        done
-
-        if ((adguard_attempts >= adguard_max_attempts)); then
-            isError "AdGuardHome admin endpoint did not respond on $adguard_setup_url within $((adguard_max_attempts * 2))s — open the URL and complete setup manually, then re-run the installer to apply the post-setup tweaks."
-        else
-            local adguard_user="${CFG_ADGUARD_USER:-admin}"
-            local adguard_pass="${CFG_ADGUARD_PASSWORD:-}"
-            if [[ -z "$adguard_pass" ]]; then
-                adguard_pass=$(generateRandomPassword)
-                updateConfigOption "CFG_ADGUARD_PASSWORD" "$adguard_pass" >/dev/null 2>&1 || true
-                isNotice "Generated a random AdGuardHome admin password and saved it to CFG_ADGUARD_PASSWORD."
-            fi
-
-            # Internal container ports are fixed (3000 admin, 53 DNS); host
-            # mapping is what `usedport1` etc. handle.
-            local adguard_payload
-            adguard_payload=$(cat <<JSON
-{
-  "web": { "ip": "0.0.0.0", "port": 3000, "autofix": false },
-  "dns": { "ip": "0.0.0.0", "port": 53, "autofix": false },
-  "username": "${adguard_user}",
-  "password": "${adguard_pass}"
-}
-JSON
-)
-            if curl -fsS -X POST \
-                 -H 'Content-Type: application/json' \
-                 --data "$adguard_payload" \
-                 --max-time 15 \
-                 "${adguard_setup_url}/control/install/configure" >/dev/null 2>&1; then
-                isSuccessful "AdGuardHome admin setup completed automatically (user: $adguard_user)."
-            else
-                # 422/403 here typically means setup was already done on a
-                # previous install; the post-setup tweaks below are still
-                # safe to run against the existing yaml.
-                isNotice "AdGuardHome /control/install/configure rejected the request — assuming it's already configured. If this is a fresh install, complete setup manually at $adguard_setup_url."
-            fi
-            # Small breather so AdGuardHome finishes flushing AdGuardHome.yaml
-            # to disk before the sed edits below touch it.
-            #sleep 3
-        fi
-
-        #result=$(sudo sed -i "s/address: 0.0.0.0:80/address: 0.0.0.0:${usedport2}/g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
-        #checkSuccess "Changing port 80 to $usedport2 for Admin Panel"
-
-        #result=$(sudo sed -i "s/port: 53/port: ${usedport3}/g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
-        #checkSuccess "Changing port 53 to $usedport3 for DNS Port"
-
-        #result=$(sudo sed -i "s/port_https: 443/port_https: ${usedport4}/g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
-        #checkSuccess "Changing port 443 to $usedport4 for DNS Port"
-
-        #result=$(sudo sed -i "s/port_dns_over_tls: 853/port_dns_over_tls: ${usedport5}/g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
-        #checkSuccess "Changing port 853 to $usedport5 for port_dns_over_tls"
-
-        #result=$(sudo sed -i "s/port_dns_over_quic: 853/port_dns_over_quic: ${usedport5}/g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
-        #checkSuccess "Changing port 853 to $usedport5 for port_dns_over_quic"
-
-        # NOTE: We deliberately do *not* force `tls.enabled: true` here.
-        # That section configures encrypted DNS (DoT/DoH/DoQ) and AdGuardHome
-        # crash-loops on startup with `[fatal] creating dns server: parsing
-        # tls key pair: tls: failed to find any PEM data in certificate input`
-        # if `enabled: true` is set without a real certificate pair pointed
-        # at by `certificate_path` / `private_key_path`. The admin user can
-        # opt into encrypted DNS from Settings → Encryption once they've
-        # provided a cert.
-
-        if [[ $public == "true" ]]; then
-            result=$(sudo sed -i "s|allow_unencrypted_doh: false|allow_unencrypted_doh: true|g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
-            checkSuccess "Setting allow_unencrypted_doh to false for Traefik"
-        fi
-
-        result=$(sudo sed -i "s|anonymize_client_ip: false: false|anonymize_client_ip: true|g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
-        checkSuccess "Setting anonymize_client_ip to true for privacy reasons"
-
-        # Force the admin web bind back to 0.0.0.0:3000 inside the container.
-        # The docker-compose mapping is `<host_port>:3000`, so the container
-        # MUST listen on 3000 internally for the host port to reach it. After
-        # the install API call AdGuardHome sometimes ends up bound to 0.0.0.0:80
-        # (its build-time default) instead of the port we sent — which is
-        # exactly what causes "unable to connect" on the host port.
-        local adguard_yaml="$containers_dir$app_name/conf/AdGuardHome.yaml"
-        if [[ -f "$adguard_yaml" ]]; then
-            # New schema (v0.107+): single `address: 0.0.0.0:NN` line under `http:`.
-            sudo sed -i 's|^\(\s*address:\s*\)0\.0\.0\.0:[0-9]\+|\10.0.0.0:3000|' "$adguard_yaml"
-            # Old schema fallback: separate `bind_host:` / `bind_port:` keys.
-            sudo sed -i 's|^\(\s*bind_host:\s*\).*|\10.0.0.0|' "$adguard_yaml"
-            sudo sed -i 's|^\(\s*bind_port:\s*\)[0-9]\+|\13000|' "$adguard_yaml"
-            checkSuccess "Pinned AdGuardHome admin bind to 0.0.0.0:3000 (matches the compose port mapping)."
-        fi
-
-        dockerComposeRestart "$app_name";
-
-        # Health-check after the restart so the user finds out *here* if
-        # AdGuardHome didn't come back up cleanly, rather than later when
-        # they try to open the URL and just see "unable to connect".
-        #
-        # Drop `-f` and accept any HTTP status code: now that the admin
-        # account is configured, `/control/status` returns 401 to an
-        # unauthenticated request — which is fine, it means the server is
-        # up and answering. We only care whether the connection succeeded
-        # at all, not what the response body says. `-w '%{http_code}'`
-        # gives us a 3-digit code on success and an empty string on a
-        # connection failure / timeout.
-        local adguard_health_attempts=0
-        while ((adguard_health_attempts < 20)); do
-            local adguard_health_code
-            adguard_health_code=$(curl -sS -o /dev/null --max-time 2 \
-                -w '%{http_code}' "${adguard_setup_url}/control/status" 2>/dev/null)
-            if [[ "$adguard_health_code" =~ ^[1-5][0-9][0-9]$ ]]; then
-                isSuccessful "AdGuardHome admin UI is reachable on $adguard_setup_url (HTTP $adguard_health_code)"
-                break
-            fi
-            sleep 1
-            ((adguard_health_attempts++))
-        done
-        if ((adguard_health_attempts >= 20)); then
-            isError "AdGuardHome admin UI did not respond after restart on $adguard_setup_url. Check the container logs (\`docker logs adguard-service\`) and the conf/AdGuardHome.yaml bind address."
-        fi
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running Application specific updates (if required)"
-        echo ""
-
-        appUpdateSpecifics $app_name;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running Headscale setup (if required)"
-        echo ""
-
-		setupHeadscale $app_name;
-
-		((menu_number++))
-		echo ""
-        echo "---- $menu_number. Adding $app_name to the Apps Database table."
-        echo ""
-
-		databaseInstallApp $app_name;
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Updating the WebUI config file."
-        echo ""
-
-        webuiContainerSetup $app_name install;
-
-		((menu_number++))
-		echo ""
-		echo "---- $menu_number. Refreshing monitoring integration."
-		echo ""
-
-		monitoringRefreshAll;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
-        echo ""
-        echo "    You can now navigate to your $app_name service using any of the options below : "
-        echo ""
-
-        # Same final-summary call shape as wireguard / vaultwarden. Pass the
-        # admin user/password we just configured so the user sees the
-        # credentials exactly once, at the end of the install.
-        menuShowFinalMessages "$app_name" "${CFG_ADGUARD_USER:-admin}" "$CFG_ADGUARD_PASSWORD";
-
-		menu_number=0
-        #sleep 3s
-        cd
-    fi
-    adguard=n
-}

containers/adguard/scripts/adguard_auth.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+
+authAdapter_adguard_setPassword() {
+    local user="$1" password="$2"
+    user="${user:-${CFG_ADGUARD_ADMIN_USER:-admin}}"
+    [[ -z "$password" ]] && password=$(generateRandomPassword)
+
+    local yaml="${containers_dir}adguard/conf/AdGuardHome.yaml"
+    [[ ! -f "$yaml" ]] && { isError "AdGuardHome.yaml not found at $yaml."; return 1; }
+    if ! command -v htpasswd >/dev/null 2>&1; then
+        isError "htpasswd is required to bcrypt the new password."
+        return 1
+    fi
+
+    local bcrypt
+    bcrypt=$(htpasswd -bnBC 10 "" "$password" | tr -d ':\n')
+    [[ -z "$bcrypt" ]] && { isError "bcrypt failed."; return 1; }
+
+    # The yaml is owned by the in-container uid, so the rewrite runs in the
+    # root-owned appcfg helper (fixed path, validated user + bcrypt).
+    if ! runAppCfg adguard-auth "$user" "$bcrypt"; then
+        isError "Could not update AdGuardHome.yaml (no users password line, or invalid input)."
+        return 1
+    fi
+
+    authPersistCfg adguard ADMIN_USER "$user"
+    authPersistCfg adguard ADMIN_PASSWORD "$password"
+    dockerComposeRestart adguard
+    isSuccessful "AdGuard admin set. User: $user — Password: $password"
+}

containers/adguard/scripts/adguard_install_hooks.sh

@@ -0,0 +1,142 @@
+#!/bin/bash
+
+# AdGuard Home install hooks — drive the first-boot setup wizard via its
+# HTTP API so the admin doesn't have to click through five pages, then
+# pin the admin bind back to 0.0.0.0:3000 (matches the compose mapping)
+# and health-check the result.
+
+adguard_install_post_start()
+{
+    local app_name="$1"
+
+    ((menu_number++))
+    echo ""
+    echo "---- $menu_number. Completing AdGuardHome initial setup automatically"
+    echo ""
+
+    # The legacy `$usedport1` variable isn't populated by the current
+    # install pipeline; the resolved host port is stored in the PORTS_TAG_1
+    # docker-compose tag (format `external:internal`). Pull it from there
+    # so the curl + URL printout actually point somewhere real.
+    local adguard_compose_file="$containers_dir$app_name/docker-compose.yml"
+    local adguard_port_pair
+    adguard_port_pair=$(tagsManagerGetTagContent "$adguard_compose_file" "PORTS_TAG_1")
+    local adguard_admin_port="${adguard_port_pair%%:*}"
+
+    if [[ -n "$public_ip_v4" && -n "$adguard_admin_port" ]]; then
+        echo "    External : http://$public_ip_v4:$adguard_admin_port/"
+    fi
+    if [[ -n "$host_setup" ]]; then
+        echo "    Hostname : http://$host_setup/"
+    fi
+    echo ""
+
+    # AdGuardHome ships a setup wizard that normally needs five clicks in
+    # a browser before the daemon writes its config file. Same wizard is
+    # exposed as an HTTP API (POST /control/install/configure), so drive
+    # it from here and skip the manual interaction. Pre-poll the admin
+    # endpoint until the container is up, then send the form, then let
+    # the post-install sed edits run against the freshly written
+    # AdGuardHome.yaml.
+    local adguard_setup_url="http://127.0.0.1:${adguard_admin_port}"
+    local adguard_attempts=0
+    local adguard_max_attempts=60
+    while ((adguard_attempts < adguard_max_attempts)); do
+        if curl -fsS -o /dev/null --max-time 2 "${adguard_setup_url}/control/status" 2>/dev/null \
+           || curl -fsS -o /dev/null --max-time 2 "${adguard_setup_url}/control/install/get_addresses" 2>/dev/null; then
+            break
+        fi
+        sleep 2
+        ((adguard_attempts++))
+    done
+
+    if ((adguard_attempts >= adguard_max_attempts)); then
+        isError "AdGuardHome admin endpoint did not respond on $adguard_setup_url within $((adguard_max_attempts * 2))s — open the URL and complete setup manually, then re-run the installer to apply the post-setup tweaks."
+    else
+        local adguard_user="${CFG_ADGUARD_USER:-admin}"
+        local adguard_pass="${CFG_ADGUARD_PASSWORD:-}"
+        if [[ -z "$adguard_pass" ]]; then
+            adguard_pass=$(generateRandomPassword)
+            updateConfigOption "CFG_ADGUARD_PASSWORD" "$adguard_pass" >/dev/null 2>&1 || true
+            isNotice "Generated a random AdGuardHome admin password and saved it to CFG_ADGUARD_PASSWORD."
+        fi
+
+        # Internal container ports are fixed (3000 admin, 53 DNS); host
+        # mapping is what `usedport1` etc. handle.
+        local adguard_payload
+        adguard_payload=$(cat <<JSON
+{
+  "web": { "ip": "0.0.0.0", "port": 3000, "autofix": false },
+  "dns": { "ip": "0.0.0.0", "port": 53, "autofix": false },
+  "username": "${adguard_user}",
+  "password": "${adguard_pass}"
+}
+JSON
+)
+        if curl -fsS -X POST \
+             -H 'Content-Type: application/json' \
+             --data "$adguard_payload" \
+             --max-time 15 \
+             "${adguard_setup_url}/control/install/configure" >/dev/null 2>&1; then
+            isSuccessful "AdGuardHome admin setup completed automatically (user: $adguard_user)."
+        else
+            # 422/403 here typically means setup was already done on a
+            # previous install; the post-setup tweaks below are still
+            # safe to run against the existing yaml.
+            isNotice "AdGuardHome /control/install/configure rejected the request — assuming it's already configured. If this is a fresh install, complete setup manually at $adguard_setup_url."
+        fi
+    fi
+
+    local result
+    if [[ "$public" == "true" ]]; then
+        result=$(runFileOp sed -i "s|allow_unencrypted_doh: false|allow_unencrypted_doh: true|g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
+        checkSuccess "Setting allow_unencrypted_doh to false for Traefik"
+    fi
+
+    result=$(runFileOp sed -i "s|anonymize_client_ip: false: false|anonymize_client_ip: true|g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
+    checkSuccess "Setting anonymize_client_ip to true for privacy reasons"
+
+    # Force the admin web bind back to 0.0.0.0:3000 inside the container.
+    # The docker-compose mapping is `<host_port>:3000`, so the container
+    # MUST listen on 3000 internally for the host port to reach it. After
+    # the install API call AdGuardHome sometimes ends up bound to
+    # 0.0.0.0:80 (its build-time default) — exactly what causes "unable
+    # to connect" on the host port.
+    local adguard_yaml="$containers_dir$app_name/conf/AdGuardHome.yaml"
+    if [[ -f "$adguard_yaml" ]]; then
+        runFileOp sed -i 's|^\(\s*address:\s*\)0\.0\.0\.0:[0-9]\+|\10.0.0.0:3000|' "$adguard_yaml"
+        runFileOp sed -i 's|^\(\s*bind_host:\s*\).*|\10.0.0.0|' "$adguard_yaml"
+        runFileOp sed -i 's|^\(\s*bind_port:\s*\)[0-9]\+|\13000|' "$adguard_yaml"
+        checkSuccess "Pinned AdGuardHome admin bind to 0.0.0.0:3000 (matches the compose port mapping)."
+    fi
+
+    dockerComposeRestart "$app_name"
+
+    # Drop `-f` and accept any HTTP status code: now that the admin
+    # account is configured, /control/status returns 401 to an
+    # unauthenticated request — which is fine, it means the server is up
+    # and answering. We only care whether the connection succeeded at
+    # all, not what the response body says.
+    local adguard_health_attempts=0
+    local adguard_health_code
+    while ((adguard_health_attempts < 20)); do
+        adguard_health_code=$(curl -sS -o /dev/null --max-time 2 \
+            -w '%{http_code}' "${adguard_setup_url}/control/status" 2>/dev/null)
+        if [[ "$adguard_health_code" =~ ^[1-5][0-9][0-9]$ ]]; then
+            isSuccessful "AdGuardHome admin UI is reachable on $adguard_setup_url (HTTP $adguard_health_code)"
+            break
+        fi
+        sleep 1
+        ((adguard_health_attempts++))
+    done
+    if ((adguard_health_attempts >= 20)); then
+        isError "AdGuardHome admin UI did not respond after restart on $adguard_setup_url. Check the container logs (\`docker logs adguard-service\`) and the conf/AdGuardHome.yaml bind address."
+    fi
+}
+
+adguard_install_message_data()
+{
+    # Echo the admin user + password as space-separated tokens so they
+    # become $username $password positional args to menuShowFinalMessages.
+    echo "${CFG_ADGUARD_USER:-admin} $CFG_ADGUARD_PASSWORD"
+}

containers/adguard/scripts/adguard_update_specifics.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# Post-install/update specifics for AdGuard Home — dispatched by appUpdateSpecifics
+# (containers/<app>/scripts/<app>_update_specifics.sh defining appUpdateSpecifics_<app>).
+appUpdateSpecifics_adguard() {
+    local app_name="$1"
+    if [[ $CFG_REQUIREMENT_DNS_UPDATER == "true" ]]; then
+        updateDNS "$app_name" install
+    fi
+    # Split-horizon local DNS: app subdomains resolve to the box on the LAN.
+    declare -F setupLocalDnsRewrites >/dev/null 2>&1 && setupLocalDnsRewrites
+}

containers/adguard/tools/adguard.tools.json

@@ -0,0 +1,20 @@
+{
+  "tools": [
+    {
+      "id":          "reset_password",
+      "label":       "Reset Admin Password",
+      "description": "Set a new admin password. Leave blank to generate one.",
+      "icon":        "🔑",
+      "fields": [
+        { "name": "password", "label": "New password", "type": "password", "placeholder": "Leave blank to generate" }
+      ]
+    },
+    {
+      "id":          "apply_dns_updater",
+      "label":       "Apply DNS Updater",
+      "description": "Point this server's DNS at AdGuard now.",
+      "icon":        "🌐",
+      "fields":      []
+    }
+  ]
+}

containers/authelia/authelia.config

@@ -17,6 +17,7 @@
 CFG_AUTHELIA_APP_NAME=authelia
 CFG_AUTHELIA_REQUIRES="domain,traefik"
 CFG_AUTHELIA_BACKUP=true
+CFG_AUTHELIA_BACKUP_STRATEGY=auto
 CFG_AUTHELIA_COMPOSE_FILE=default
 CFG_AUTHELIA_HEALTHCHECK=true
 CFG_AUTHELIA_AUTHELIA=false

containers/authelia/authelia.sh

@@ -1,208 +0,0 @@
-#!/bin/bash
-
-# Category : Security
-# Description : Authelia - Authentication & SSO (c/u/s/r/i):
-
-installAuthelia()
-{
-    local config_variables="$1"
-
-    if [[ "$authelia" == *[cCtTuUsSrRiI]* ]]; then
-        dockerConfigSetupToContainer silent authelia;
-        local app_name=$CFG_AUTHELIA_APP_NAME
-		initializeAppVariables $app_name;
-    fi
-
-    if [[ "$authelia" == *[cC]* ]]; then
-        editAppConfig $app_name;
-    fi
-
-	if [[ "$authelia" == *[uU]* ]]; then
-		dockerUninstallApp $app_name;
-	fi
-
-	if [[ "$authelia" == *[sS]* ]]; then
-		dockerComposeDown $app_name;
-	fi
-
-    if [[ "$authelia" == *[rR]* ]]; then
-        dockerComposeRestart $app_name;
-    fi
-
-    if [[ "$authelia" == *[iI]* ]]; then
-        isHeader "Install $app_name"
-
-        # Pre-flight: bail out before touching any compose/config if the
-        # global prerequisites aren't met. CFG_AUTHELIA_REQUIRES lists
-        # what's needed (currently "domain,traefik"); the helper prints a
-        # clear list of what's missing so the user knows what to fix.
-        if ! appInstallCheckRequirements "$app_name" "$CFG_AUTHELIA_REQUIRES"; then
-            authelia=n
-            return 1
-        fi
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Setting up install folder and config file for $app_name."
-        echo ""
-
-        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
-        isSuccessful "Install folders and Config files have been setup for $app_name."
-
-        ((menu_number++))
-        echo ""
-
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
-        echo ""
-
-        dockerComposeSetupFile $app_name;
-
-        local result=$(copyResource "$app_name" "configuration.yml" "config" | sudo tee -a "$logs_dir/$docker_log_file" 2>&1)
-        checkSuccess "Copying configuration.yml to $containers_dir$app_name/config"
-
-        local result=$(copyResource "$app_name" "users_database.yml" "config" | sudo tee -a "$logs_dir/$docker_log_file" 2>&1)
-        checkSuccess "Copying users_database.yml to $containers_dir$app_name/config"
-
-        local authelia_config_file="$containers_dir$app_name/config/configuration.yml"
-        sudo sed -i "s|AUTHELIA_THEME_PLACEHOLDER|$CFG_AUTHELIA_THEME|g" "$authelia_config_file"
-        sudo sed -i "s|AUTHELIA_DOMAIN_PLACEHOLDER|$domain_full|g" "$authelia_config_file"
-        sudo sed -i "s|AUTHELIA_HOST_PLACEHOLDER|$host_setup|g" "$authelia_config_file"
-        checkSuccess "Substituting Authelia configuration values (theme=$CFG_AUTHELIA_THEME domain=$domain_full host=$host_setup)"
-
-        local authelia_secrets_dir="$containers_dir$app_name/secrets"
-        sudo mkdir -p "$authelia_secrets_dir"
-        for secret_name in JWT_SECRET SESSION_SECRET STORAGE_ENCRYPTION_KEY; do
-            local secret_file="$authelia_secrets_dir/$secret_name"
-            if [[ ! -s "$secret_file" ]]; then
-                openssl rand -hex 64 | sudo tee "$secret_file" >/dev/null
-                sudo chmod 600 "$secret_file"
-            fi
-        done
-        sudo chown -R "$docker_install_user":"$docker_install_user" "$authelia_secrets_dir"
-        checkSuccess "Generated Authelia secrets at $authelia_secrets_dir"
-
-        # Enable Authelia's telemetry/metrics endpoint only when
-        # CFG_AUTHELIA_MONITORING=true (toggles the libreportal-monitoring
-        # marker block in configuration.yml).
-        monitoringToggleAppConfig "$app_name" "config/configuration.yml";
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Updating file permissions before starting."
-        echo ""
-
-		fixPermissionsBeforeStart $app_name;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
-        echo ""
-
-		dockerComposeUpdateAndStartApp $app_name install;
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Configuring Authelia admin account"
-        echo ""
-
-        local authelia_admin_user="${CFG_AUTHELIA_ADMIN_USERNAME:-admin}"
-        local authelia_admin_pass="${CFG_AUTHELIA_ADMIN_PASSWORD:-authelia}"
-        local authelia_users_file="$containers_dir$app_name/config/users_database.yml"
-        local authelia_attempts=0
-        while ((authelia_attempts < 30)); do
-            if sudo docker exec authelia-service authelia --version >/dev/null 2>&1; then
-                break
-            fi
-            sleep 2
-            ((authelia_attempts++))
-        done
-
-        if ((authelia_attempts >= 30)); then
-            isNotice "Authelia container did not become responsive in time — admin left at default (admin / authelia)."
-        else
-            local authelia_hash
-            authelia_hash=$(sudo docker exec authelia-service authelia crypto hash generate argon2 --password "$authelia_admin_pass" 2>/dev/null \
-                | grep -oE '\$argon2[^[:space:]]+')
-            if [[ -z "$authelia_hash" ]]; then
-                isNotice "Could not generate Authelia password hash — admin left at default (admin / authelia)."
-            else
-                sudo tee "$authelia_users_file" >/dev/null <<EOF
----
-users:
-  ${authelia_admin_user}:
-    disabled: false
-    displayname: "Admin"
-    password: "${authelia_hash}"
-    email: ${authelia_admin_user}@${domain_full:-example.com}
-    groups:
-      - admins
-EOF
-                sudo chown "$docker_install_user":"$docker_install_user" "$authelia_users_file"
-                isSuccessful "Configured Authelia admin (user: $authelia_admin_user)."
-                dockerComposeRestart "$app_name";
-            fi
-        fi
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running Application specific updates (if required)"
-        echo ""
-
-        appUpdateSpecifics $app_name;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running Headscale setup (if required)"
-        echo ""
-
-		setupHeadscale $app_name;
-
-		((menu_number++))
-		echo ""
-        echo "---- $menu_number. Adding $app_name to the Apps Database table."
-        echo ""
-
-		databaseInstallApp $app_name;
-
-		((menu_number++))
-		echo ""
-		echo "---- $menu_number. Updating WebUI config file."
-		echo ""
-
-		webuiContainerSetup $app_name install;
-
-		((menu_number++))
-		echo ""
-		echo "---- $menu_number. Refreshing monitoring integration."
-		echo ""
-
-		# Self-correcting: adds Authelia's scrape target + dashboard to
-		# Prometheus/Grafana when CFG_AUTHELIA_MONITORING=true, removes them
-		# when it's off. No-ops with a notice if either app isn't installed.
-		monitoringRefreshAll;
-
-		((menu_number++))
-		echo ""
-		echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
-        echo ""
-        echo "    You can now navigate to your new service using one of the options below : "
-        echo ""
-
-        menuShowFinalMessages $app_name;
-
-        echo ""
-        isNotice "Authelia admin login:"
-        echo ""
-        echo "      Username : ${authelia_admin_user}"
-        echo "      Password : ${authelia_admin_pass}"
-        echo ""
-
-		menu_number=0
-        #sleep 3s
-        cd
-	fi
-	authelia=n
-}

containers/authelia/docker-compose.yml

@@ -23,6 +23,7 @@ services:
     labels:
       libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
       libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
+      libreportal.backup.db: "sqlite:::config/db.sqlite3"
       traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
       # TRAEFIK_PORT_1_BEGIN
       traefik.http.routers.authelia-service.entrypoints: web,websecure

containers/authelia/scripts/authelia_install_hooks.sh

@@ -0,0 +1,111 @@
+#!/bin/bash
+
+# Authelia install hooks — requirements check, config + secrets bootstrap,
+# admin account provisioning, and an end-of-install credentials notice.
+
+authelia_install_pre()
+{
+    local app_name="$1"
+    if ! appInstallCheckRequirements "$app_name" "$CFG_AUTHELIA_REQUIRES"; then
+        authelia=n
+        return 1
+    fi
+}
+
+authelia_install_post_compose()
+{
+    local app_name="$1"
+
+    local result
+    result=$(copyResource "$app_name" "configuration.yml" "config" | runInstallWrite -a "$logs_dir/$docker_log_file" 2>&1)
+    checkSuccess "Copying configuration.yml to $containers_dir$app_name/config"
+
+    result=$(copyResource "$app_name" "users_database.yml" "config" | runInstallWrite -a "$logs_dir/$docker_log_file" 2>&1)
+    checkSuccess "Copying users_database.yml to $containers_dir$app_name/config"
+
+    local authelia_config_file="$containers_dir$app_name/config/configuration.yml"
+    runFileOp sed -i "s|AUTHELIA_THEME_PLACEHOLDER|$CFG_AUTHELIA_THEME|g" "$authelia_config_file"
+    runFileOp sed -i "s|AUTHELIA_DOMAIN_PLACEHOLDER|$domain_full|g" "$authelia_config_file"
+    runFileOp sed -i "s|AUTHELIA_HOST_PLACEHOLDER|$host_setup|g" "$authelia_config_file"
+    checkSuccess "Substituting Authelia configuration values (theme=$CFG_AUTHELIA_THEME domain=$domain_full host=$host_setup)"
+
+    local authelia_secrets_dir="$containers_dir$app_name/secrets"
+    runFileOp mkdir -p "$authelia_secrets_dir"
+    local secret_name secret_file
+    for secret_name in JWT_SECRET SESSION_SECRET STORAGE_ENCRYPTION_KEY; do
+        secret_file="$authelia_secrets_dir/$secret_name"
+        if [[ ! -s "$secret_file" ]]; then
+            openssl rand -hex 64 | runFileWrite "$secret_file"
+            runFileOp chmod 600 "$secret_file"
+        fi
+    done
+    runFileOp chown -R "$docker_install_user":"$docker_install_user" "$authelia_secrets_dir"
+    checkSuccess "Generated Authelia secrets at $authelia_secrets_dir"
+
+    # Authelia's metrics block lives in configuration.yml (not the compose),
+    # so toggle it here. The driver already toggled docker-compose.yml.
+    monitoringToggleAppConfig "$app_name" "config/configuration.yml"
+}
+
+authelia_install_post_start()
+{
+    local app_name="$1"
+
+    ((menu_number++))
+    echo ""
+    echo "---- $menu_number. Configuring Authelia admin account"
+    echo ""
+
+    local authelia_admin_user="${CFG_AUTHELIA_ADMIN_USERNAME:-admin}"
+    local authelia_admin_pass="${CFG_AUTHELIA_ADMIN_PASSWORD:-authelia}"
+    local authelia_users_file="$containers_dir$app_name/config/users_database.yml"
+    local authelia_attempts=0
+    while ((authelia_attempts < 30)); do
+        if runFileOp docker exec authelia-service authelia --version >/dev/null 2>&1; then
+            break
+        fi
+        sleep 2
+        ((authelia_attempts++))
+    done
+
+    if ((authelia_attempts >= 30)); then
+        isNotice "Authelia container did not become responsive in time — admin left at default (admin / authelia)."
+        return 0
+    fi
+
+    local authelia_hash
+    authelia_hash=$(runFileOp docker exec authelia-service authelia crypto hash generate argon2 --password "$authelia_admin_pass" 2>/dev/null \
+        | grep -oE '\$argon2[^[:space:]]+')
+    if [[ -z "$authelia_hash" ]]; then
+        isNotice "Could not generate Authelia password hash — admin left at default (admin / authelia)."
+        return 0
+    fi
+
+    runFileWrite "$authelia_users_file" <<EOF
+---
+users:
+  ${authelia_admin_user}:
+    disabled: false
+    displayname: "Admin"
+    password: "${authelia_hash}"
+    email: ${authelia_admin_user}@${domain_full:-example.com}
+    groups:
+      - admins
+EOF
+    runFileOp chown "$docker_install_user":"$docker_install_user" "$authelia_users_file"
+    isSuccessful "Configured Authelia admin (user: $authelia_admin_user)."
+    dockerComposeRestart "$app_name"
+}
+
+authelia_install_post()
+{
+    local app_name="$1"
+    local authelia_admin_user="${CFG_AUTHELIA_ADMIN_USERNAME:-admin}"
+    local authelia_admin_pass="${CFG_AUTHELIA_ADMIN_PASSWORD:-authelia}"
+    echo ""
+    isNotice "Authelia admin login:"
+    echo ""
+    echo "      Username : ${authelia_admin_user}"
+    echo "      Password : ${authelia_admin_pass}"
+    echo ""
+}

containers/bookstack/bookstack.config

@@ -12,7 +12,13 @@
 # ADMIN_PASSWORD = password used for the Bookstack admin account
 #
 CFG_BOOKSTACK_APP_NAME=bookstack
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_BOOKSTACK_MULTI_INSTANCE=true
 CFG_BOOKSTACK_BACKUP=true
+CFG_BOOKSTACK_BACKUP_STRATEGY=auto
 CFG_BOOKSTACK_COMPOSE_FILE=default
 CFG_BOOKSTACK_HEALTHCHECK=true
 CFG_BOOKSTACK_AUTHELIA=false

containers/bookstack/bookstack.sh

@@ -1,180 +0,0 @@
-#!/bin/bash
-
-# Category : Knowledge Management
-# Description : Bookstack - Wiki/Knowledge Base (c/u/s/r/i):
-
-installBookstack()
-{
-    local config_variables="$1"
-
-    if [[ "$bookstack" == *[cCtTuUsSrRiI]* ]]; then
-        dockerConfigSetupToContainer silent bookstack;
-        local app_name=$CFG_BOOKSTACK_APP_NAME
-		initializeAppVariables $app_name;
-    fi
-
-    if [[ "$bookstack" == *[cC]* ]]; then
-        editAppConfig $app_name;
-    fi
-
-    if [[ "$bookstack" == *[uU]* ]]; then
-        dockerUninstallApp $app_name;
-    fi
-
-    if [[ "$bookstack" == *[sS]* ]]; then
-        dockerComposeDown $app_name;
-    fi
-
-    if [[ "$bookstack" == *[rR]* ]]; then
-        dockerComposeRestart $app_name;
-    fi
-
-    if [[ "$bookstack" == *[iI]* ]]; then
-        isHeader "Install $app_name"
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Setting up install folder and config file for $app_name."
-        echo ""
-
-        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
-        isSuccessful "Install folders and Config files have been setup for $app_name."
-
-        ((menu_number++))
-        echo ""
-
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
-        echo ""
-
-        dockerComposeSetupFile $app_name;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Updating file permissions before starting."
-        echo ""
-
-		fixPermissionsBeforeStart $app_name;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
-        echo ""
-
-		dockerComposeUpdateAndStartApp $app_name install;
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running Application specific updates (if required)"
-        echo ""
-
-        appUpdateSpecifics $app_name;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running Headscale setup (if required)"
-        echo ""
-
-		setupHeadscale $app_name;
-
-		((menu_number++))
-		echo ""
-        echo "---- $menu_number. Adding $app_name to the Apps Database table."
-        echo ""
-
-		databaseInstallApp $app_name;
-
-		((menu_number++))
-		echo ""
-		echo "---- $menu_number. Updating WebUI config file."
-		echo ""
-
-		webuiContainerSetup $app_name install;
-
-		((menu_number++))
-		echo ""
-		echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
-        echo ""
-        echo "    You can now navigate to your $app_name service using any of the options below : "
-        echo ""
-
-        menuShowFinalMessages $app_name;
-
-        bookstack_target_email="${CFG_BOOKSTACK_ADMIN_EMAIL:-admin@admin.com}"
-        bookstack_target_pass="${CFG_BOOKSTACK_ADMIN_PASSWORD:-password}"
-
-        bookstack_compose_file="$containers_dir$app_name/docker-compose.yml"
-        bookstack_port_pair=$(tagsManagerGetTagContent "$bookstack_compose_file" "PORTS_TAG_1")
-        bookstack_host_port="${bookstack_port_pair%%:*}"
-        bookstack_probe_url="http://127.0.0.1:${bookstack_host_port}/login"
-
-        isNotice "Waiting for Bookstack to come online at ${bookstack_probe_url} ..."
-        isNotice "This may take up to 20 seconds, please wait..."
-
-        bookstack_attempts=0
-        bookstack_ready=0
-        while ((bookstack_attempts < 60)); do
-            bookstack_http_code=$(curl -sS -o /dev/null --max-time 3 -w '%{http_code}' "$bookstack_probe_url" 2>/dev/null)
-            if [[ "$bookstack_http_code" =~ ^(200|302)$ ]]; then
-                bookstack_ready=1
-                break
-            fi
-            sleep 2
-            ((bookstack_attempts++))
-        done
-
-        if ((bookstack_ready == 0)); then
-            isNotice "Bookstack did not respond on ${bookstack_probe_url} within $((60 * 2))s — admin account left at upstream defaults."
-            echo ""
-            isNotice "Bookstack admin login (default):"
-            echo ""
-            echo "      Email    : admin@admin.com"
-            echo "      Password : password"
-            echo ""
-        else
-            isSuccessful "Bookstack is online (HTTP ${bookstack_http_code})."
-
-            bookstack_create_output=$(sudo docker exec \
-                -e EZ_BS_NEW_EMAIL="$bookstack_target_email" \
-                -e EZ_BS_NEW_PASS="$bookstack_target_pass" \
-                bookstack sh -c 'cd /app/www && s6-setuidgid abc php artisan bookstack:create-admin --no-ansi --email="$EZ_BS_NEW_EMAIL" --name=Admin --password="$EZ_BS_NEW_PASS" 2>&1')
-            bookstack_create_rc=$?
-            if [[ $bookstack_create_rc -eq 0 ]]; then
-                isSuccessful "Bookstack admin account created (email: $bookstack_target_email)."
-
-                if [[ "$bookstack_target_email" != "admin@admin.com" ]]; then
-                    sudo docker exec -i bookstack php /app/www/artisan tinker --no-ansi >/dev/null 2>&1 <<'PHP'
-$c = class_exists('\BookStack\Users\Models\User') ? '\BookStack\Users\Models\User' : '\BookStack\Auth\User';
-optional($c::where('email', 'admin@admin.com')->first())->delete();
-PHP
-                    isSuccessful "Removed seeded admin@admin.com account."
-                fi
-
-                echo ""
-                isNotice "Bookstack admin login:"
-                echo ""
-                echo "      Email    : ${bookstack_target_email}"
-                echo "      Password : ${bookstack_target_pass}"
-                echo ""
-            else
-                isNotice "Bookstack admin auto-create failed (exit $bookstack_create_rc). Output:"
-                echo "$bookstack_create_output" | sed 's/^/        /'
-                echo ""
-                isNotice "Falling back to upstream defaults — update from inside Bookstack."
-                echo ""
-                isNotice "Bookstack admin login (default):"
-                echo ""
-                echo "      Email    : admin@admin.com"
-                echo "      Password : password"
-                echo ""
-            fi
-        fi
-
-		menu_number=0
-        #sleep 3s
-        cd
-    fi
-    bookstack=n
-}

containers/bookstack/docker-compose.yml

@@ -32,6 +32,8 @@ services:
     labels:
       libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
       libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
+      libreportal.backup.db: "mariadb:bookstack_db:db:"
+      libreportal.backup.files: "bookstack:/config:data"
       traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
       # TRAEFIK_PORT_1_BEGIN
       traefik.http.routers.bookstack-service.entrypoints: web,websecure

containers/bookstack/scripts/bookstack_auth.sh

@@ -8,7 +8,7 @@ _bookstackArtisan() {
     local container="bookstack"
     local php_body="$1"
     shift
-    sudo docker exec -i -w /app/www "$@" "$container" php artisan tinker --execute="$php_body" 2>&1
+    runFileOp docker exec -i -w /app/www "$@" "$container" php artisan tinker --execute="$php_body" 2>&1
 }
 
 authAdapter_bookstack_setPassword() {

containers/bookstack/scripts/bookstack_install_hooks.sh

@@ -0,0 +1,84 @@
+#!/bin/bash
+
+# Bookstack install hooks — drive the post-start admin account bootstrap.
+# Generic installApp driver handles compose / start / db / monitoring; this
+# adds the readiness probe + first-admin provisioning the original
+# installBookstack() did inline.
+
+bookstack_install_post_start()
+{
+    local app_name="$1"
+
+    local bookstack_target_email="${CFG_BOOKSTACK_ADMIN_EMAIL:-admin@admin.com}"
+    local bookstack_target_pass="${CFG_BOOKSTACK_ADMIN_PASSWORD:-password}"
+
+    local bookstack_compose_file="$containers_dir$app_name/docker-compose.yml"
+    local bookstack_port_pair
+    bookstack_port_pair=$(tagsManagerGetTagContent "$bookstack_compose_file" "PORTS_TAG_1")
+    local bookstack_host_port="${bookstack_port_pair%%:*}"
+    local bookstack_probe_url="http://127.0.0.1:${bookstack_host_port}/login"
+
+    isNotice "Waiting for Bookstack to come online at ${bookstack_probe_url} ..."
+    isNotice "This may take up to 20 seconds, please wait..."
+
+    local bookstack_attempts=0
+    local bookstack_ready=0
+    local bookstack_http_code
+    while ((bookstack_attempts < 60)); do
+        bookstack_http_code=$(curl -sS -o /dev/null --max-time 3 -w '%{http_code}' "$bookstack_probe_url" 2>/dev/null)
+        if [[ "$bookstack_http_code" =~ ^(200|302)$ ]]; then
+            bookstack_ready=1
+            break
+        fi
+        sleep 2
+        ((bookstack_attempts++))
+    done
+
+    if ((bookstack_ready == 0)); then
+        isNotice "Bookstack did not respond on ${bookstack_probe_url} within $((60 * 2))s — admin account left at upstream defaults."
+        echo ""
+        isNotice "Bookstack admin login (default):"
+        echo ""
+        echo "      Email    : admin@admin.com"
+        echo "      Password : password"
+        echo ""
+        return 0
+    fi
+    isSuccessful "Bookstack is online (HTTP ${bookstack_http_code})."
+
+    local bookstack_create_output
+    bookstack_create_output=$(runFileOp docker exec \
+        -e EZ_BS_NEW_EMAIL="$bookstack_target_email" \
+        -e EZ_BS_NEW_PASS="$bookstack_target_pass" \
+        bookstack sh -c 'cd /app/www && s6-setuidgid abc php artisan bookstack:create-admin --no-ansi --email="$EZ_BS_NEW_EMAIL" --name=Admin --password="$EZ_BS_NEW_PASS" 2>&1')
+    local bookstack_create_rc=$?
+    if [[ $bookstack_create_rc -eq 0 ]]; then
+        isSuccessful "Bookstack admin account created (email: $bookstack_target_email)."
+
+        if [[ "$bookstack_target_email" != "admin@admin.com" ]]; then
+            runFileOp docker exec -i bookstack php /app/www/artisan tinker --no-ansi >/dev/null 2>&1 <<'PHP'
+$c = class_exists('\BookStack\Users\Models\User') ? '\BookStack\Users\Models\User' : '\BookStack\Auth\User';
+optional($c::where('email', 'admin@admin.com')->first())->delete();
+PHP
+            isSuccessful "Removed seeded admin@admin.com account."
+        fi
+
+        echo ""
+        isNotice "Bookstack admin login:"
+        echo ""
+        echo "      Email    : ${bookstack_target_email}"
+        echo "      Password : ${bookstack_target_pass}"
+        echo ""
+    else
+        isNotice "Bookstack admin auto-create failed (exit $bookstack_create_rc). Output:"
+        echo "$bookstack_create_output" | sed 's/^/        /'
+        echo ""
+        isNotice "Falling back to upstream defaults — update from inside Bookstack."
+        echo ""
+        isNotice "Bookstack admin login (default):"
+        echo ""
+        echo "      Email    : admin@admin.com"
+        echo "      Password : password"
+        echo ""
+    fi
+}

containers/bookstack/tools/bookstack.tools.json

@@ -0,0 +1,106 @@
+{
+  "tools": [
+    {
+      "id": "reset_password",
+      "category": "users",
+      "label": "Reset User Password",
+      "description": "Set a new password for an existing user. Leave blank to generate one.",
+      "icon": "🔑",
+      "fields": [
+        {
+          "name": "email",
+          "label": "User email",
+          "type": "text",
+          "placeholder": "user@example.com",
+          "required": true
+        },
+        {
+          "name": "password",
+          "label": "New password",
+          "type": "password",
+          "placeholder": "Leave blank to generate"
+        }
+      ]
+    },
+    {
+      "id": "create_account",
+      "category": "users",
+      "label": "Create User Account",
+      "description": "Add a new user. Tick \"Make admin\" for full rights.",
+      "icon": "👤",
+      "fields": [
+        {
+          "name": "email",
+          "label": "Email",
+          "type": "text",
+          "placeholder": "user@example.com",
+          "required": true
+        },
+        {
+          "name": "name",
+          "label": "Display name",
+          "type": "text",
+          "required": true
+        },
+        {
+          "name": "password",
+          "label": "Password",
+          "type": "password",
+          "placeholder": "Leave blank to generate"
+        },
+        {
+          "name": "admin",
+          "label": "Make admin",
+          "type": "checkbox",
+          "default": false
+        }
+      ]
+    },
+    {
+      "id": "list_users",
+      "category": "users",
+      "label": "List Users",
+      "description": "List every user and their role.",
+      "icon": "📋",
+      "fields": []
+    },
+    {
+      "id": "delete_user",
+      "category": "users",
+      "label": "Delete User Account",
+      "description": "Permanently remove a user.",
+      "icon": "🗑",
+      "destructive": true,
+      "confirm": "This cannot be undone.",
+      "fields": [
+        {
+          "name": "email",
+          "label": "User email",
+          "type": "text",
+          "required": true
+        }
+      ]
+    },
+    {
+      "id": "set_admin",
+      "category": "users",
+      "label": "Set Admin Status",
+      "description": "Promote or demote a user.",
+      "icon": "👑",
+      "fields": [
+        {
+          "name": "email",
+          "label": "User email",
+          "type": "text",
+          "required": true
+        },
+        {
+          "name": "admin",
+          "label": "Make admin",
+          "type": "checkbox",
+          "default": false
+        }
+      ]
+    }
+  ]
+}

containers/crowdsec/crowdsec.config

@@ -19,6 +19,7 @@ CFG_CROWDSEC_HOST_SERVICE=crowdsec
 CFG_CROWDSEC_HOST_SERVICES=crowdsec.service,crowdsec-firewall-bouncer.service
 CFG_CROWDSEC_HOST_LOG_FILES="crowdsec.service|/var/log/crowdsec.log,crowdsec-firewall-bouncer.service|/var/log/crowdsec-firewall-bouncer.log"
 CFG_CROWDSEC_BACKUP=true
+CFG_CROWDSEC_BACKUP_STRATEGY=auto
 CFG_CROWDSEC_MONITORING=false
 CFG_CROWDSEC_PROMETHEUS_LISTEN=0.0.0.0:6060
 #

containers/crowdsec/crowdsec.sh

@@ -4,8 +4,8 @@
 # Description : CrowdSec - Intrusion Prevention (c/u/s/r/i):
 #
 # Host-installed agent (apt + systemd) — no Docker container. Host install
-# logic lives in scripts/install/install_crowdsec.sh (installCrowdsecHost);
-# install registration uses the shared hostAppInstall helper
+# logic lives in scripts/crowdsec_install_host.sh (installCrowdsecHost) beside
+# this file; install registration uses the shared hostAppInstall helper
 # (scripts/install/host_app.sh). uninstall/stop/restartCrowdsec (below) are the
 # host-side hooks dockerUninstallApp / dockerStopApp / dockerRestartApp invoke.
 
@@ -58,18 +58,18 @@ uninstallCrowdsec()
     echo ""
     echo "---- $menu_number. Stopping CrowdSec host services."
     echo ""
-    local result=$(sudo systemctl disable --now crowdsec-firewall-bouncer 2>&1)
+    local result; result=$(runSystem systemctl disable --now crowdsec-firewall-bouncer 2>&1)
     checkSuccess "Disabling firewall bouncer"
-    local result=$(sudo systemctl disable --now crowdsec 2>&1)
+    local result; result=$(runSystem systemctl disable --now crowdsec 2>&1)
     checkSuccess "Disabling agent"
 
     ((menu_number++))
     echo ""
     echo "---- $menu_number. Removing CrowdSec packages."
     echo ""
-    local result=$(sudo DEBIAN_FRONTEND=noninteractive apt-get purge -y -q crowdsec crowdsec-firewall-bouncer-nftables </dev/null 2>&1)
+    local result; result=$(runSystem DEBIAN_FRONTEND=noninteractive apt-get purge -y -q crowdsec crowdsec-firewall-bouncer-nftables </dev/null 2>&1)
     checkSuccess "Purged packages"
-    local result=$(sudo DEBIAN_FRONTEND=noninteractive apt-get autoremove -y -q </dev/null 2>&1)
+    local result; result=$(runSystem DEBIAN_FRONTEND=noninteractive apt-get autoremove -y -q </dev/null 2>&1)
     checkSuccess "Removed orphaned dependencies"
 
     crowdsecToggleLibrePortalLogMounts off
@@ -81,9 +81,9 @@ uninstallCrowdsec()
 stopCrowdsec()
 {
     isNotice "Stopping CrowdSec host services..."
-    local result=$(sudo systemctl stop crowdsec-firewall-bouncer 2>&1)
+    local result; result=$(runSystem systemctl stop crowdsec-firewall-bouncer 2>&1)
     checkSuccess "Stopped firewall bouncer"
-    local result=$(sudo systemctl stop crowdsec 2>&1)
+    local result; result=$(runSystem systemctl stop crowdsec 2>&1)
     checkSuccess "Stopped agent"
 }
 
@@ -93,8 +93,8 @@ stopCrowdsec()
 restartCrowdsec()
 {
     isNotice "Restarting CrowdSec host services..."
-    local result=$(sudo systemctl restart crowdsec 2>&1)
+    local result; result=$(runSystem systemctl restart crowdsec 2>&1)
     checkSuccess "Restarted agent"
-    local result=$(sudo systemctl restart crowdsec-firewall-bouncer 2>&1)
+    local result; result=$(runSystem systemctl restart crowdsec-firewall-bouncer 2>&1)
     checkSuccess "Restarted firewall bouncer"
 }

containers/crowdsec/scripts/crowdsec_alerts_list.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
 
 appCrowdSecAlertsList() {
-    sudo cscli alerts list
+    runSystem cscli alerts list
 }

containers/crowdsec/scripts/crowdsec_console_disable.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 appCrowdSecConsoleDisable() {
-    sudo cscli console disable -e all
+    runSystem cscli console disable -e all
     checkSuccess "Console enrollment removed — no signals will leave this host"
-    sudo systemctl reload crowdsec
+    runSystem systemctl reload crowdsec
 }

containers/crowdsec/scripts/crowdsec_console_enroll.sh

@@ -8,7 +8,7 @@ appCrowdSecConsoleEnroll() {
         isNotice "Get a token at https://app.crowdsec.net (free account). Enrolling shares attacker IPs + scenario names with CrowdSec SAS."
         return 1
     fi
-    sudo cscli console enroll "$token"
+    runSystem cscli console enroll "$token"
     checkSuccess "Enrolled with CrowdSec Console — community blocklists will start syncing"
-    sudo systemctl reload crowdsec
+    runSystem systemctl reload crowdsec
 }

containers/crowdsec/scripts/crowdsec_decisions_list.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
 
 appCrowdSecDecisionsList() {
-    sudo cscli decisions list
+    runSystem cscli decisions list
 }

containers/crowdsec/scripts/crowdsec_fix_priority.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+appCrowdSecFixPriority() {
+    local cfg="/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml"
+    if [[ ! -f "$cfg" ]]; then
+        isNotice "Bouncer config not found at $cfg — is CrowdSec installed?"
+        return 1
+    fi
+
+    # The bouncer yaml is root-owned under /etc/crowdsec; the backup + nftables
+    # ipv4/ipv6 priority rewrite (to -100) runs in the root-owned crowdsec helper.
+    runCrowdsec bouncer-priority
+    checkSuccess "Patched nftables priority to -100 in $cfg"
+
+    runSystem systemctl restart crowdsec-firewall-bouncer
+    checkSuccess "Restarted crowdsec-firewall-bouncer"
+
+    isSuccessful "Priority updated. Run 'crowdsec_verify_firewall' to confirm CrowdSec now runs before UFW."
+}

containers/crowdsec/scripts/crowdsec_hub_update.sh

@@ -1,10 +1,10 @@
 #!/bin/bash
 
 appCrowdSecHubUpdate() {
-    sudo cscli hub update
+    runSystem cscli hub update
     checkSuccess "Hub index refreshed"
-    sudo cscli hub upgrade
+    runSystem cscli hub upgrade
     checkSuccess "Installed collections upgraded"
-    sudo systemctl reload crowdsec
+    runSystem systemctl reload crowdsec
     checkSuccess "Reloaded CrowdSec to apply changes"
 }

containers/crowdsec/scripts/crowdsec_install_host.sh

@@ -5,37 +5,36 @@
 # mount set takes effect.
 crowdsecToggleLibrePortalLogMounts() {
     local mode="$1"
-    local compose="/docker/containers/libreportal/docker-compose.yml"
+    local compose="${containers_dir}libreportal/docker-compose.yml"
     [[ -f "$compose" ]] || return 0
 
     case "$mode" in
         on)
-            sudo sed -i '/# >>> crowdsec-host-logs >>>/,/# <<< crowdsec-host-logs <<</ {
+            # Lines inside the marker block that look like `#-/var/log/crowdsec...:`
+            # become `-/var/log/...:` so docker compose picks up the bind-mounts.
+            runFileOp sed -i '/# >>> crowdsec-host-logs >>>/,/# <<< crowdsec-host-logs <<</ {
                 /crowdsec.*\.log:/ s/^\([[:space:]]*\)#-/\1-/
             }' "$compose"
             ;;
         off)
-            sudo sed -i '/# >>> crowdsec-host-logs >>>/,/# <<< crowdsec-host-logs <<</ {
+            runFileOp sed -i '/# >>> crowdsec-host-logs >>>/,/# <<< crowdsec-host-logs <<</ {
                 /crowdsec.*\.log:/ s/^\([[:space:]]*\)-/\1#-/
             }' "$compose"
             ;;
         *) isError "crowdsecToggleLibrePortalLogMounts: bad mode '$mode'"; return 1 ;;
     esac
 
-    if sudo docker ps --format '{{.Names}}' 2>/dev/null | grep -q '^libreportal-service$'; then
+    if runFileOp docker ps --format '{{.Names}}' 2>/dev/null | grep -q '^libreportal-service$'; then
         isNotice "Recreating libreportal so log mount toggle takes effect..."
-        ( cd /docker/containers/libreportal && sudo -u libreportal docker compose up -d >/dev/null 2>&1 ) || true
+        ( cd "${containers_dir}libreportal" && runAsManager docker compose up -d >/dev/null 2>&1 ) || true
     fi
 }
 
 installCrowdsecHost()
 {
-    # Touch + chmod 0644 the host log files so the libreportal container
-    # (UID 1001) can read them. Then enable the bind-mounts.
-    for _l in /var/log/crowdsec.log /var/log/crowdsec-firewall-bouncer.log; do
-        sudo touch "$_l" 2>/dev/null || true
-        sudo chmod 0644 "$_l" 2>/dev/null || true
-    done
+    # Make /var/log/crowdsec*.log world-readable so the libreportal container
+    # (UID 1001) can tail them via the bind-mount we're about to enable.
+    runCrowdsec touch-host-logs
     crowdsecToggleLibrePortalLogMounts on
 
     local desired_state="${CFG_CROWDSEC_ENABLED:-true}"
@@ -47,53 +46,16 @@ installCrowdsecHost()
 
         ((menu_number++))
         echo ""
-        echo "---- $menu_number. Adding the CrowdSec apt repository."
-        echo ""
-
-        local result=$(curl -fsSL https://install.crowdsec.net | sudo bash)
-        checkSuccess "Adding CrowdSec repository"
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Installing the CrowdSec agent."
+        echo "---- $menu_number. Installing the CrowdSec agent + firewall bouncer."
         echo ""
         isNotice "First-time install ~30-70 MB GeoLite2 DB + parser hub, 1-3 mins."
 
-        local result=$(sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -q crowdsec </dev/null 2>&1)
-        checkSuccess "Installing CrowdSec package"
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Installing the CrowdSec firewall bouncer."
-        echo ""
-
-        local result=$(sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -q crowdsec-firewall-bouncer-nftables </dev/null 2>&1)
-        checkSuccess "Installing CrowdSec firewall bouncer (nftables)"
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Enabling CrowdSec services."
-        echo ""
-
-        local result=$(sudo systemctl enable --now crowdsec)
-        checkSuccess "Enabling CrowdSec agent"
-
-        local result=$(sudo systemctl enable --now crowdsec-firewall-bouncer)
-        checkSuccess "Enabling CrowdSec firewall bouncer"
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Installing baseline collections."
-        echo ""
-
-        local result=$(sudo cscli collections install crowdsecurity/linux)
-        checkSuccess "Installing crowdsecurity/linux collection"
-
-        local result=$(sudo cscli collections install crowdsecurity/sshd)
-        checkSuccess "Installing crowdsecurity/sshd collection"
-
-        local result=$(sudo systemctl reload crowdsec)
-        checkSuccess "Reloading CrowdSec to pick up collections"
+        # One-shot: adds the apt repo, installs both packages, enables both
+        # services, installs the crowdsecurity/linux + /sshd collections, then
+        # reloads the agent. All of it lives in libreportal-crowdsec so the
+        # manager never needs `sudo apt-get` / `sudo bash`.
+        local result; result=$(runCrowdsec install)
+        checkSuccess "Installing CrowdSec agent + firewall bouncer + baseline collections"
 
         ((menu_number++))
         echo ""
@@ -106,14 +68,14 @@ installCrowdsecHost()
         # unregistering. Idempotent on either branch.
         local community_blocklist="${CFG_CROWDSEC_COMMUNITY_BLOCKLIST:-true}"
         if [[ "$community_blocklist" == "true" ]]; then
-            if sudo cscli capi status 2>&1 | grep -qi 'You can successfully'; then
+            if runCrowdsec capi status 2>&1 | grep -qi 'You can successfully'; then
                 isNotice "Community blocklist already registered."
             else
-                local result=$(sudo cscli capi register 2>&1)
+                local result; result=$(runCrowdsec capi register 2>&1)
                 checkSuccess "Registered with CrowdSec Central API (community blocklist)"
             fi
         else
-            local result=$(sudo cscli capi unregister 2>&1)
+            local result; result=$(runCrowdsec capi unregister 2>&1)
             checkSuccess "Unregistered from CrowdSec Central API (community blocklist disabled)"
         fi
 
@@ -122,26 +84,26 @@ installCrowdsecHost()
         echo "---- $menu_number. SaaS Console enrollment toggle."
         echo ""
 
-        # cscli console enroll <token> registers this agent with the hosted
+        # `console enroll <token>` registers this agent with the hosted
         # dashboard at app.crowdsec.net. Idempotent: if already enrolled,
         # skip. If toggled off, disenroll. Quietly skipped when the flag
         # is on but the token field is empty (user hasn't pasted one yet).
         local console_enroll="${CFG_CROWDSEC_CONSOLE_ENROLL:-false}"
         local console_token="${CFG_CROWDSEC_CONSOLE_TOKEN:-}"
         local enrolled=false
-        sudo cscli console status 2>&1 | grep -qi 'enrolled' && enrolled=true
+        runCrowdsec console status 2>&1 | grep -qi 'enrolled' && enrolled=true
         if [[ "$console_enroll" == "true" ]]; then
             if [[ -z "$console_token" ]]; then
                 isNotice "Console enrollment ON but CFG_CROWDSEC_CONSOLE_TOKEN is empty — paste your token from app.crowdsec.net to complete."
             elif [[ "$enrolled" == true ]]; then
                 isNotice "Already enrolled with the SaaS console — skipping."
             else
-                local result=$(sudo cscli console enroll "$console_token" 2>&1)
+                local result; result=$(runCrowdsec console enroll "$console_token" 2>&1)
                 checkSuccess "Enrolled with app.crowdsec.net SaaS console"
             fi
         else
             if [[ "$enrolled" == true ]]; then
-                local result=$(sudo cscli console disenroll 2>&1)
+                local result; result=$(runCrowdsec console disenroll 2>&1)
                 checkSuccess "Disenrolled from app.crowdsec.net SaaS console"
             else
                 isNotice "SaaS console enrollment disabled — skipping."
@@ -157,14 +119,14 @@ installCrowdsecHost()
         # via host.docker.internal:host-gateway. The bouncer API key is
         # required (HTTP 401 without it), so internet exposure is gated.
         # External access on 8080 should still be blocked at UFW.
-        local lapi_cfg="/etc/crowdsec/config.yaml"
-        if [[ -f "$lapi_cfg" ]] && ! sudo grep -qE 'listen_uri:[[:space:]]*0\.0\.0\.0:8080' "$lapi_cfg"; then
-            sudo sed -i 's|listen_uri:.*|listen_uri: 0.0.0.0:8080|' "$lapi_cfg"
-            checkSuccess "LAPI bound to 0.0.0.0:8080"
-            sudo systemctl restart crowdsec
-            checkSuccess "CrowdSec restarted"
-        else
+        local bind_result
+        bind_result=$(runCrowdsec bind-lapi 2>&1)
+        if [[ "$bind_result" == "ALREADY_BOUND" ]]; then
             isNotice "LAPI already bound to 0.0.0.0:8080 — skipping."
+        else
+            checkSuccess "LAPI bound to 0.0.0.0:8080"
+            runCrowdsec services restart
+            checkSuccess "CrowdSec restarted"
         fi
 
         ((menu_number++))
@@ -174,72 +136,62 @@ installCrowdsecHost()
 
         # When monitoring is on, bind CrowdSec's Prometheus metrics endpoint to
         # a docker-reachable address (the 127.0.0.1 default can't be scraped
-        # from the Prometheus container). The sed is scoped to the prometheus:
-        # block. When off, rebind to localhost if a prior run opened it.
-        local cs_cfg="/etc/crowdsec/config.yaml"
+        # from the Prometheus container). When off, rebind to localhost if a
+        # prior run opened it. The helper does the scoped edit in the
+        # prometheus: block.
         local mon_enabled="${CFG_CROWDSEC_MONITORING:-false}"
         local prom_listen="${CFG_CROWDSEC_PROMETHEUS_LISTEN:-0.0.0.0:6060}"
         local prom_addr="${prom_listen%%:*}"
         local prom_port="${prom_listen##*:}"
-        if [[ "$mon_enabled" == "true" && -f "$cs_cfg" ]]; then
-            if ! sudo grep -qE "listen_addr:[[:space:]]*${prom_addr}" "$cs_cfg"; then
-                sudo sed -i "/^prometheus:/,/^[^[:space:]#]/ {
-                    s|enabled:.*|enabled: true|
-                    s|listen_addr:.*|listen_addr: ${prom_addr}|
-                    s|listen_port:.*|listen_port: ${prom_port}|
-                }" "$cs_cfg"
-                checkSuccess "CrowdSec metrics endpoint bound to ${prom_listen}"
-                sudo systemctl restart crowdsec
-                checkSuccess "CrowdSec restarted"
-            else
-                isNotice "CrowdSec metrics already bound to ${prom_addr} — skipping."
-            fi
-        elif [[ -f "$cs_cfg" ]] && sudo grep -qE 'listen_addr:[[:space:]]*0\.0\.0\.0' "$cs_cfg"; then
-            sudo sed -i "/^prometheus:/,/^[^[:space:]#]/ s|listen_addr:.*|listen_addr: 127.0.0.1|" "$cs_cfg"
-            checkSuccess "CrowdSec metrics endpoint rebound to 127.0.0.1 (monitoring off)"
-            sudo systemctl restart crowdsec
+        if [[ "$mon_enabled" == "true" ]]; then
+            local result; result=$(runCrowdsec prometheus on "$prom_addr" "$prom_port")
+            checkSuccess "CrowdSec metrics endpoint bound to ${prom_listen}"
+            runCrowdsec services restart
             checkSuccess "CrowdSec restarted"
         else
-            isNotice "Monitoring off — CrowdSec metrics endpoint left at its default."
+            local result; result=$(runCrowdsec prometheus off)
+            checkSuccess "CrowdSec metrics endpoint rebound to 127.0.0.1 (monitoring off)"
+            runCrowdsec services restart
+            checkSuccess "CrowdSec restarted"
         fi
 
-        # Generate a dedicated bouncer key for Traefik (idempotent: skip if
-        # already registered). Two sinks for the value:
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Traefik bouncer API key."
+        echo ""
+
+        # Generate a dedicated bouncer key for Traefik. Two sinks for the value:
         #   1) /etc/crowdsec/traefik_bouncer.key — raw key, bind-mounted into
         #      the Traefik container read-only; the plugin reads it via
         #      crowdsecLapiKeyFile. /etc/crowdsec/ is outside the framework's
         #      sourceScanFiles sweep so a bare key file is safe here.
-        #   2) /docker/configs/network/network_crowdsec — CFG_CROWDSEC_TRAEFIK_LAPI_KEY
+        #   2) ${configs_dir}security/security_crowdsec — CFG_CROWDSEC_TRAEFIK_LAPI_KEY
         #      line, sourced by the framework and visible on the config page.
         #      Editing the CFG var manually does not re-register the bouncer
         #      (use the rotate Tools action for that); this is a visibility
         #      surface, not the auth source of truth.
-        local key_file="/etc/crowdsec/traefik_bouncer.key"
-        local cfg_file="/docker/configs/security/security_crowdsec"
+        # The helper handles cscli + tee + chown + chmod atomically.
+        local init_result
+        init_result=$(runCrowdsec bouncer-traefik-init 2>&1)
+        if [[ "$init_result" == "EXISTS" ]]; then
+            isNotice "Bouncer 'traefik-bouncer' already registered — leaving existing key file untouched at /etc/crowdsec/traefik_bouncer.key."
+        elif [[ "$init_result" == GENERATED:* ]]; then
+            local bouncer_key="${init_result#GENERATED:}"
+            checkSuccess "Traefik bouncer API key generated"
 
-        if ! sudo cscli bouncers list -o raw 2>/dev/null | grep -q '^traefik-bouncer'; then
-            local bouncer_key
-            bouncer_key=$(sudo cscli bouncers add traefik-bouncer -o raw 2>&1 | tail -1)
-            if [[ -n "$bouncer_key" && "$bouncer_key" != *"error"* ]]; then
-                echo "$bouncer_key" | sudo tee "$key_file" >/dev/null
-                sudo chown libreportal:libreportal "$key_file"
-                sudo chmod 0600 "$key_file"
-                checkSuccess "Traefik bouncer API key generated"
-
-                # Write the key into the live config file so it's visible /
-                # editable via the framework's config page like any other
-                # CFG_* setting.
-                if [[ -f "$cfg_file" ]]; then
-                    sudo sed -i "s|^CFG_CROWDSEC_TRAEFIK_LAPI_KEY=.*|CFG_CROWDSEC_TRAEFIK_LAPI_KEY=${bouncer_key}|" "$cfg_file"
-                    checkSuccess "Key mirrored to CFG_CROWDSEC_TRAEFIK_LAPI_KEY"
-                else
-                    isNotice "Live config not present yet — key applied on next install."
-                fi
+            # Mirror the key into the live config file so it's visible /
+            # editable via the framework's config page like any other CFG_*
+            # setting. configs/ is manager-owned, so runInstallOp suffices.
+            local cfg_file="${configs_dir}security/security_crowdsec"
+            if [[ -f "$cfg_file" ]]; then
+                runInstallOp sed -i "s|^CFG_CROWDSEC_TRAEFIK_LAPI_KEY=.*|CFG_CROWDSEC_TRAEFIK_LAPI_KEY=${bouncer_key}|" "$cfg_file"
+                checkSuccess "Key mirrored to CFG_CROWDSEC_TRAEFIK_LAPI_KEY"
             else
-                isNotice "Failed to generate bouncer key — Traefik integration won't authenticate. Re-run installCrowdsecHost to retry."
+                isNotice "Live config not present yet — key applied on next install."
             fi
         else
-            isNotice "Bouncer 'traefik-bouncer' already registered — leaving existing key file untouched at $key_file."
+            isNotice "Failed to generate bouncer key: $init_result"
+            isNotice "Traefik integration won't authenticate. Re-run installCrowdsecHost to retry."
         fi
 
         ((menu_number++))
@@ -250,16 +202,16 @@ installCrowdsecHost()
         # The firewall bouncer needs a moment to install its nftables table
         # after enable. Poll up to ~10s before deciding it's missing.
         local _wait=0
-        until sudo nft list tables 2>/dev/null | grep -qiE 'crowdsec' || [[ $_wait -ge 10 ]]; do
+        until runSystem nft list tables 2>/dev/null | grep -qiE 'crowdsec' || [[ $_wait -ge 10 ]]; do
             sleep 1; _wait=$((_wait+1))
         done
 
-        if ! sudo nft list tables 2>/dev/null | grep -qiE 'crowdsec'; then
+        if ! runSystem nft list tables 2>/dev/null | grep -qiE 'crowdsec'; then
             isNotice "CrowdSec nftables table not yet present after ${_wait}s. Bouncer may still be starting; re-run the verification Tools action in a minute if rules don't appear."
         else
             local cs_prio ufw_prio
-            cs_prio=$(sudo nft list ruleset 2>/dev/null | awk '/table .* crowdsec/{flag=1} flag && /priority/{match($0,/priority [-0-9]+/); print substr($0,RSTART+9,RLENGTH-9); exit}')
-            ufw_prio=$(sudo nft list ruleset 2>/dev/null | awk '/chain ufw[a-z0-9-]*input/{flag=1} flag && /priority/{match($0,/priority [-0-9]+/); print substr($0,RSTART+9,RLENGTH-9); exit}')
+            cs_prio=$(runSystem nft list ruleset 2>/dev/null | awk '/table .* crowdsec/{flag=1} flag && /priority/{match($0,/priority [-0-9]+/); print substr($0,RSTART+9,RLENGTH-9); exit}')
+            ufw_prio=$(runSystem nft list ruleset 2>/dev/null | awk '/chain ufw[a-z0-9-]*input/{flag=1} flag && /priority/{match($0,/priority [-0-9]+/); print substr($0,RSTART+9,RLENGTH-9); exit}')
 
             if [[ -z "$ufw_prio" ]]; then
                 isSuccessful "UFW not in nftables — no ordering needed (CrowdSec prio: ${cs_prio:-?})."
@@ -291,11 +243,8 @@ installCrowdsecHost()
             echo "---- $menu_number. Re-enabling CrowdSec services."
             echo ""
 
-            local result=$(sudo systemctl enable --now crowdsec)
-            checkSuccess "Enabling CrowdSec agent"
-
-            local result=$(sudo systemctl enable --now crowdsec-firewall-bouncer)
-            checkSuccess "Enabling CrowdSec firewall bouncer"
+            local result; result=$(runCrowdsec services enable)
+            checkSuccess "Enabling CrowdSec agent + firewall bouncer"
 
             isSuccessful "CrowdSec services re-enabled."
             menu_number=0
@@ -312,11 +261,8 @@ installCrowdsecHost()
         echo "---- $menu_number. Stopping and disabling CrowdSec services."
         echo ""
 
-        local result=$(sudo systemctl disable --now crowdsec-firewall-bouncer 2>&1)
-        checkSuccess "Disabling CrowdSec firewall bouncer"
-
-        local result=$(sudo systemctl disable --now crowdsec 2>&1)
-        checkSuccess "Disabling CrowdSec agent"
+        local result; result=$(runCrowdsec services disable)
+        checkSuccess "Disabling CrowdSec agent + firewall bouncer"
 
         isSuccessful "CrowdSec disabled. Package remains installed — set CFG_CROWDSEC_ENABLED=true to re-enable, or uninstall via the Tools tab."
         menu_number=0

containers/crowdsec/scripts/crowdsec_metrics.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
 
 appCrowdSecMetrics() {
-    sudo cscli metrics
+    runSystem cscli metrics
 }

containers/crowdsec/scripts/crowdsec_status.sh

@@ -8,9 +8,9 @@ appCrowdSecStatus() {
     systemctl status crowdsec-firewall-bouncer --no-pager --lines=5 2>&1 | head -15
     echo
     echo "=== installed collections ==="
-    sudo cscli collections list -o human 2>&1 | head -30
+    runSystem cscli collections list -o human 2>&1 | head -30
     echo
     echo "=== machines + bouncers ==="
-    sudo cscli machines list 2>&1
-    sudo cscli bouncers list 2>&1
+    runSystem cscli machines list 2>&1
+    runSystem cscli bouncers list 2>&1
 }

containers/crowdsec/scripts/crowdsec_unban.sh

@@ -7,6 +7,6 @@ appCrowdSecUnban() {
         isNotice "No IP provided — pass ip=<address> via the Tools modal."
         return 1
     fi
-    sudo cscli decisions delete --ip "$ip"
+    runSystem cscli decisions delete --ip "$ip"
     checkSuccess "Removed decisions for $ip"
 }

containers/crowdsec/scripts/crowdsec_update.sh

@@ -7,32 +7,32 @@ appCrowdSecUpdate() {
     echo ""
     echo "---- $menu_number. Updating apt package index."
     echo ""
-    local result=$(sudo apt-get update)
+    local result; result=$(runSystem apt-get update)
     checkSuccess "apt-get update"
 
     ((menu_number++))
     echo ""
     echo "---- $menu_number. Upgrading CrowdSec packages."
     echo ""
-    local result=$(sudo apt-get install -y --only-upgrade crowdsec crowdsec-firewall-bouncer-nftables)
+    local result; result=$(runSystem apt-get install -y --only-upgrade crowdsec crowdsec-firewall-bouncer-nftables)
     checkSuccess "Upgraded crowdsec + crowdsec-firewall-bouncer-nftables"
 
     ((menu_number++))
     echo ""
     echo "---- $menu_number. Refreshing hub collections."
     echo ""
-    local result=$(sudo cscli hub update)
+    local result; result=$(runSystem cscli hub update)
     checkSuccess "Refreshed hub index"
-    local result=$(sudo cscli hub upgrade)
+    local result; result=$(runSystem cscli hub upgrade)
     checkSuccess "Upgraded installed collections"
 
     ((menu_number++))
     echo ""
     echo "---- $menu_number. Reloading services."
     echo ""
-    local result=$(sudo systemctl reload crowdsec)
+    local result; result=$(runSystem systemctl reload crowdsec)
     checkSuccess "Reloaded crowdsec agent"
-    local result=$(sudo systemctl restart crowdsec-firewall-bouncer)
+    local result; result=$(runSystem systemctl restart crowdsec-firewall-bouncer)
     checkSuccess "Restarted crowdsec-firewall-bouncer"
 
     isSuccessful "CrowdSec updated. Run 'crowdsec_verify_firewall' if you want to re-check nftables priorities."

containers/crowdsec/scripts/crowdsec_verify_firewall.sh

@@ -2,22 +2,22 @@
 
 appCrowdSecVerifyFirewall() {
     echo "=== nftables tables present ==="
-    sudo nft list tables 2>&1
+    runSystem nft list tables 2>&1
     echo
     echo "=== chain priorities (input hook) ==="
-    sudo nft list ruleset 2>/dev/null | grep -E 'chain |hook input.*priority' | head -30
+    runSystem nft list ruleset 2>/dev/null | grep -E 'chain |hook input.*priority' | head -30
     echo
     echo "=== priority comparison ==="
     local cs_prio ufw_prio
-    cs_prio=$(sudo nft list ruleset 2>/dev/null | awk '/table .* crowdsec/{flag=1} flag && /priority/{match($0,/priority [-0-9]+/); print substr($0,RSTART+9,RLENGTH-9); exit}')
-    ufw_prio=$(sudo nft list ruleset 2>/dev/null | awk '/chain ufw[a-z0-9-]*input/{flag=1} flag && /priority/{match($0,/priority [-0-9]+/); print substr($0,RSTART+9,RLENGTH-9); exit}')
+    cs_prio=$(runSystem nft list ruleset 2>/dev/null | awk '/table .* crowdsec/{flag=1} flag && /priority/{match($0,/priority [-0-9]+/); print substr($0,RSTART+9,RLENGTH-9); exit}')
+    ufw_prio=$(runSystem nft list ruleset 2>/dev/null | awk '/chain ufw[a-z0-9-]*input/{flag=1} flag && /priority/{match($0,/priority [-0-9]+/); print substr($0,RSTART+9,RLENGTH-9); exit}')
 
     echo "CrowdSec priority: ${cs_prio:-not present}"
     echo "UFW priority:      ${ufw_prio:-not present}"
 
     if [[ -z "$cs_prio" ]]; then
         isNotice "CrowdSec nftables table missing — bouncer may not be running."
-        sudo systemctl is-active crowdsec-firewall-bouncer
+        runSystem systemctl is-active crowdsec-firewall-bouncer
         return 1
     fi
     if [[ -z "$ufw_prio" ]]; then

containers/dashy/dashy.config

@@ -11,6 +11,7 @@
 #
 CFG_DASHY_APP_NAME=dashy
 CFG_DASHY_BACKUP=true
+CFG_DASHY_BACKUP_STRATEGY=auto
 CFG_DASHY_COMPOSE_FILE=default
 CFG_DASHY_HEALTHCHECK=true
 CFG_DASHY_AUTHELIA=false

containers/dashy/dashy.sh

@@ -1,114 +0,0 @@
-#!/bin/bash
-
-# Category : Miscellaneous
-# Description : Dashy - Dashboard Tool (c/t/u/s/r/i):
-
-installDashy()
-{
-    local config_variables="$1"
-
-    if [[ "$dashy" == *[cCtTuUsSrRiI]* ]]; then
-        dockerConfigSetupToContainer silent dashy;
-        local app_name=$CFG_DASHY_APP_NAME
-		initializeAppVariables $app_name;
-    fi
-
-    if [[ "$dashy" == *[cC]* ]]; then
-        editAppConfig $app_name;
-    fi
-
-    if [[ "$dashy" == *[tT]* ]]; then
-        dashyToolsMenu;
-    fi
-
-    if [[ "$dashy" == *[uU]* ]]; then
-        dockerUninstallApp $app_name;
-    fi
-
-    if [[ "$dashy" == *[sS]* ]]; then
-        dockerComposeDown $app_name;
-    fi
-
-    if [[ "$dashy" == *[rR]* ]]; then
-        dockerComposeRestart $app_name;
-    fi
-
-    if [[ "$dashy" == *[iI]* ]]; then
-        isHeader "Install $app_name"
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Setting up install folder and config file for $app_name."
-        echo ""
-
-        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
-        isSuccessful "Install folders and Config files have been setup for $app_name."
-
-        ((menu_number++))
-        echo ""
-
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
-        echo ""
-
-        dockerComposeSetupFile $app_name;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Updating file permissions before starting."
-        echo ""
-
-		fixPermissionsBeforeStart $app_name;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
-        echo ""
-
-		dockerComposeUpdateAndStartApp $app_name install;
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running Application specific updates (if required)"
-        echo ""
-
-        appUpdateSpecifics $app_name;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running Headscale setup (if required)"
-        echo ""
-
-		setupHeadscale $app_name;
-
-		((menu_number++))
-		echo ""
-        echo "---- $menu_number. Adding $app_name to the Apps Database table."
-        echo ""
-
-		databaseInstallApp $app_name;
-
-		((menu_number++))
-		echo ""
-		echo "---- $menu_number. Updating WebUI config file."
-		echo ""
-
-		webuiContainerSetup $app_name install;
-
-		((menu_number++))
-		echo ""
-		echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
-        echo ""
-        echo "    You can now navigate to your new service using one of the options below : "
-        echo ""
-
-        menuShowFinalMessages $app_name;
-
-		menu_number=0
-        #sleep 3s
-        cd
-    fi
-    dashy=n
-}

containers/dashy/scripts/dashy_update_conf.sh

@@ -17,7 +17,7 @@ appDashyUpdateConf()
     # row, so dockerCheckAppInstalled would say not_installed and bail.
     # Look at the actual docker container instead — if the container
     # exists or the install dir is present, generate the conf.
-    if ! sudo docker ps -a --format '{{.Names}}' 2>/dev/null | grep -qE '^(dashy|dashy-service)$' \
+    if ! runFileOp docker ps -a --format '{{.Names}}' 2>/dev/null | grep -qE '^(dashy|dashy-service)$' \
        && [[ ! -d "${containers_dir}dashy" ]]; then
         return 0
     fi
@@ -30,8 +30,8 @@ appDashyUpdateConf()
     # bootstrap and the full render — will overwrite this.
     _dashyWriteSkeleton() {
         local install_name="${CFG_INSTALL_NAME:-LibrePortal}"
-        sudo mkdir -p "$(dirname "$conf_file")"
-        sudo tee "$conf_file" >/dev/null <<EOF
+        runFileOp mkdir -p "$(dirname "$conf_file")"
+        runFileWrite "$conf_file" <<EOF
 ---
 pageInfo:
   title: Dashy - LibrePortal - ${install_name}
@@ -47,7 +47,7 @@ appConfig:
 
 sections: []
 EOF
-        sudo chown "$docker_install_user:$docker_install_user" "$conf_file" 2>/dev/null || true
+        runFileOp chown "$docker_install_user:$docker_install_user" "$conf_file" 2>/dev/null || true
     }
 
     if ! command -v jq >/dev/null 2>&1; then
@@ -63,9 +63,9 @@ EOF
     fi
 
     local original_md5=""
-    [[ -f "$conf_file" ]] && original_md5=$(sudo md5sum "$conf_file" 2>/dev/null | awk '{print $1}')
+    [[ -f "$conf_file" ]] && original_md5=$(runFileOp md5sum "$conf_file" 2>/dev/null | awk '{print $1}')
 
-    sudo mkdir -p "$(dirname "$conf_file")"
+    runFileOp mkdir -p "$(dirname "$conf_file")"
 
     # Build the selected-id set (empty CFG = include every URL).
     local _selected_set=""
@@ -192,7 +192,7 @@ EOF
     [[ -z "$page_title" ]] && page_title="Dashy - LibrePortal - ${install_name}"
     [[ -z "$page_desc"  ]] && page_desc="Welcome to your LibrePortal Dashy dashboard!"
 
-    sudo tee "$conf_file" >/dev/null <<EOF
+    runFileWrite "$conf_file" <<EOF
 ---
 pageInfo:
   title: ${page_title}
@@ -232,7 +232,7 @@ EOF
     local cat
     for cat in "${_cat_order[@]}"; do
         printf -- "- name: %s\n  icon: fas fa-cube\n  items:\n" "$cat" \
-            | sudo tee -a "$conf_file" >/dev/null
+            | runFileWrite -a "$conf_file"
         local IFS_BAK="$IFS"
         local entry
         while IFS= read -r entry; do
@@ -267,18 +267,18 @@ EOF
             fi
             printf -- "  - title: %s\n    description: %s\n    icon: %s\n    url: %s\n    statusCheck: %s\n    target: %s\n" \
                 "$tile_title" "$tile_desc" "$icon_ref" "$url" "$status_check" "$open_target" \
-                | sudo tee -a "$conf_file" >/dev/null
+                | runFileWrite -a "$conf_file"
             _total_items=$((_total_items + 1))
         done <<< "${_cat_buckets[$cat]}"
         IFS="$IFS_BAK"
     done
 
-    sudo chown "$docker_install_user:$docker_install_user" "$conf_file" 2>/dev/null || true
+    runFileOp chown "$docker_install_user:$docker_install_user" "$conf_file" 2>/dev/null || true
 
-    local updated_md5=$(sudo md5sum "$conf_file" 2>/dev/null | awk '{print $1}')
+    local updated_md5=$(runFileOp md5sum "$conf_file" 2>/dev/null | awk '{print $1}')
     if [[ "$original_md5" != "$updated_md5" ]]; then
         isNotice "Dashy config changed — restarting container..."
-        sudo docker restart dashy-service >/dev/null 2>&1 || sudo docker restart dashy >/dev/null 2>&1 || true
+        runFileOp docker restart dashy-service >/dev/null 2>&1 || runFileOp docker restart dashy >/dev/null 2>&1 || true
         local _cat_label="categories"
         [[ ${#_cat_order[@]} -eq 1 ]] && _cat_label="category"
         isSuccessful "Restarted dashy (${#_cat_order[@]} ${_cat_label}, ${_total_items} URL(s))."

containers/dashy/scripts/dashy_update_specifics.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+# Post-install/update specifics for Dashy — dispatched by appUpdateSpecifics.
+appUpdateSpecifics_dashy() {
+    # Refresh apps-services.json (the source of truth appDashyUpdateConf reads)
+    # before generating dashy's conf.yml. On a first dashy install the file may
+    # not yet reflect dashy itself; on a re-install the previous selection survives.
+    webuiLibrePortalUpdate
+    appDashyUpdateConf
+}

containers/dashy/tools/dashy.tools.json

@@ -0,0 +1,21 @@
+{
+  "tools": [
+    {
+      "id": "manage_shortcuts",
+      "label": "Manage Shortcuts",
+      "description": "Pick which apps appear on the Dashy dashboard.",
+      "icon": "🧩",
+      "fields": [
+        {
+          "name": "selected",
+          "label": "Apps to show on the dashboard",
+          "type": "app_urls_multi",
+          "prefillFromCfgKey": "CFG_DASHY_SHORTCUTS",
+          "excludeApps": [
+            "dashy"
+          ]
+        }
+      ]
+    }
+  ]
+}

containers/focalboard/docker-compose.yml

@@ -11,7 +11,7 @@ services:
       - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
     # GLUETUN_OFF_END
     volumes:
-      - ./data:/data
+      - ./data:/opt/focalboard/data
     environment:
       - VIRTUAL_HOST:DOMAINSUBNAME_DATA #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
       - VIRTUAL_PORT:8000
@@ -22,6 +22,8 @@ services:
     labels:
       libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
       libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
+      libreportal.backup.db: "sqlite:::data/focalboard.db"
+      libreportal.backup.files: "focalboard-service:/opt/focalboard/data:data"
       traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
       # TRAEFIK_PORT_1_BEGIN
       traefik.http.routers.focalboard-service.entrypoints: web,websecure

containers/focalboard/focalboard.config

@@ -11,6 +11,7 @@
 #
 CFG_FOCALBOARD_APP_NAME=focalboard
 CFG_FOCALBOARD_BACKUP=true
+CFG_FOCALBOARD_BACKUP_STRATEGY=auto
 CFG_FOCALBOARD_COMPOSE_FILE=default
 CFG_FOCALBOARD_HEALTHCHECK=true
 CFG_FOCALBOARD_AUTHELIA=false

containers/focalboard/focalboard.sh

@@ -1,110 +0,0 @@
-#!/bin/bash
-
-# Category : Productivity
-# Description : Focalboard - Project Management (c/u/s/r/i):
-
-installFocalboard()
-{
-    local config_variables="$1"
-
-    if [[ "$focalboard" == *[cCtTuUsSrRiI]* ]]; then
-        dockerConfigSetupToContainer silent focalboard;
-        local app_name=$CFG_FOCALBOARD_APP_NAME
-		initializeAppVariables $app_name;
-    fi
-
-    if [[ "$focalboard" == *[cC]* ]]; then
-        editAppConfig $app_name;
-    fi
-
-	if [[ "$focalboard" == *[uU]* ]]; then
-		dockerUninstallApp $app_name;
-	fi
-
-	if [[ "$focalboard" == *[sS]* ]]; then
-		dockerComposeDown $app_name;
-	fi
-
-    if [[ "$focalboard" == *[rR]* ]]; then
-        dockerComposeRestart $app_name;
-    fi
-
-    if [[ "$focalboard" == *[iI]* ]]; then
-        isHeader "Install $app_name"
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Setting up install folder and config file for $app_name."
-        echo ""
-
-        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
-        isSuccessful "Install folders and Config files have been setup for $app_name."
-
-        ((menu_number++))
-        echo ""
-
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
-        echo ""
-
-        dockerComposeSetupFile $app_name;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Updating file permissions before starting."
-        echo ""
-
-		fixPermissionsBeforeStart $app_name;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
-        echo ""
-
-		dockerComposeUpdateAndStartApp $app_name install;
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running Application specific updates (if required)"
-        echo ""
-
-        appUpdateSpecifics $app_name;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running Headscale setup (if required)"
-        echo ""
-
-		setupHeadscale $app_name;
-
-		((menu_number++))
-		echo ""
-        echo "---- $menu_number. Adding $app_name to the Apps Database table."
-        echo ""
-
-		databaseInstallApp $app_name;
-
-		((menu_number++))
-		echo ""
-		echo "---- $menu_number. Updating WebUI config file."
-		echo ""
-
-		webuiContainerSetup $app_name install;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
-        echo ""
-        echo "    You can now navigate to your $app_name service using one of the options below : "
-        echo ""
-
-        menuShowFinalMessages $app_name;
-
-		menu_number=0
-        #sleep 3s
-        cd
-	fi
-	focalboard=n
-}

containers/focalboard/scripts/focalboard_auth.sh

@@ -1,14 +1,17 @@
 #!/bin/bash
 
 _focalboardSqlite() {
-    sudo docker exec -i focalboard-service sqlite3 /data/focalboard.db "$1" 2>&1
+    # The compose mount is ./data:/opt/focalboard/data — focalboard writes its
+    # sqlite db at /opt/focalboard/data/focalboard.db, so the auth tools must
+    # reach it there (the bare /data inside the container isn't mounted).
+    runFileOp docker exec -i focalboard-service sqlite3 /opt/focalboard/data/focalboard.db "$1" 2>&1
 }
 
 _focalboardBcrypt() {
     if ! command -v htpasswd >/dev/null 2>&1; then
         isError "htpasswd is required to bcrypt the password."; return 1
     fi
-    sudo htpasswd -bnBC 10 "" "$1" | tr -d ':\n'
+    htpasswd -bnBC 10 "" "$1" | tr -d ':\n'
 }
 
 authAdapter_focalboard_setPassword() {

containers/focalboard/scripts/focalboard_update_specifics.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# Post-install/update specifics for Focalboard — dispatched by appUpdateSpecifics.
+appUpdateSpecifics_focalboard() {
+    local app_name="$1"
+    # Focalboard runs as nobody (65534) and writes its sqlite db + uploads under
+    # its mounted data dir; fixPermissionsBeforeStart hands the dir to the install
+    # user, so give it to 65534 here or the server can't open the database.
+    # Setting shouldrestart (not local) requests the restart in appUpdateSpecifics.
+    runOwnership app-data-nobody "$app_name"
+    shouldrestart="true"
+}

containers/focalboard/tools/focalboard.tools.json

@@ -0,0 +1,83 @@
+{
+  "tools": [
+    {
+      "id": "reset_password",
+      "category": "users",
+      "label": "Reset User Password",
+      "description": "Set a new password for an existing user. Leave blank to generate one.",
+      "icon": "🔑",
+      "fields": [
+        {
+          "name": "username",
+          "label": "Username",
+          "type": "text",
+          "required": true
+        },
+        {
+          "name": "password",
+          "label": "New password",
+          "type": "password",
+          "placeholder": "Leave blank to generate"
+        }
+      ]
+    },
+    {
+      "id": "create_account",
+      "category": "users",
+      "label": "Create User Account",
+      "description": "Add a new user. Tick \"Make admin\" for full rights.",
+      "icon": "👤",
+      "fields": [
+        {
+          "name": "username",
+          "label": "Username",
+          "type": "text",
+          "required": true
+        },
+        {
+          "name": "email",
+          "label": "Email",
+          "type": "text",
+          "required": true
+        },
+        {
+          "name": "password",
+          "label": "Password",
+          "type": "password",
+          "placeholder": "Leave blank to generate"
+        },
+        {
+          "name": "admin",
+          "label": "Make admin",
+          "type": "checkbox",
+          "default": false
+        }
+      ]
+    },
+    {
+      "id": "list_users",
+      "category": "users",
+      "label": "List Users",
+      "description": "List every user.",
+      "icon": "📋",
+      "fields": []
+    },
+    {
+      "id": "delete_user",
+      "category": "users",
+      "label": "Delete User Account",
+      "description": "Permanently remove a user.",
+      "icon": "🗑",
+      "destructive": true,
+      "confirm": "This cannot be undone.",
+      "fields": [
+        {
+          "name": "username",
+          "label": "Username",
+          "type": "text",
+          "required": true
+        }
+      ]
+    }
+  ]
+}

containers/gitea/docker-compose.yml

@@ -64,6 +64,8 @@ services:
     labels:
       libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
       libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
+      libreportal.backup.db: "sqlite:::data/gitea/gitea/gitea.db"
+      libreportal.backup.files: "gitea-service:/data:data/gitea"
       traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
       # TRAEFIK_PORT_1_BEGIN
       traefik.http.routers.gitea-service.entrypoints: web,websecure

containers/gitea/gitea.config

@@ -13,6 +13,7 @@
 #
 CFG_GITEA_APP_NAME=gitea
 CFG_GITEA_BACKUP=true
+CFG_GITEA_BACKUP_STRATEGY=auto
 CFG_GITEA_COMPOSE_FILE=default
 CFG_GITEA_HEALTHCHECK=true
 CFG_GITEA_AUTHELIA=false

containers/gitea/gitea.sh

@@ -1,139 +0,0 @@
-#!/bin/bash
-
-# Category : Development & Version Control
-# Description : Gitea - Git Repository Management (c/u/s/r/i):
-
-installGitea()
-{
-    local config_variables="$1"
-
-    if [[ "$gitea" == *[cCtTuUsSrRiI]* ]]; then
-        dockerConfigSetupToContainer silent gitea;
-        local app_name=$CFG_GITEA_APP_NAME
-		initializeAppVariables $app_name;
-    fi
-
-    if [[ "$gitea" == *[cC]* ]]; then
-        editAppConfig $app_name;
-    fi
-
-	if [[ "$gitea" == *[uU]* ]]; then
-		dockerUninstallApp $app_name;
-	fi
-
-	if [[ "$gitea" == *[sS]* ]]; then
-		dockerComposeDown $app_name;
-	fi
-
-    if [[ "$gitea" == *[rR]* ]]; then
-        dockerComposeRestart $app_name;
-    fi
-
-    if [[ "$gitea" == *[iI]* ]]; then
-        isHeader "Install $app_name"
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Setting up install folder and config file for $app_name."
-        echo ""
-
-        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
-        isSuccessful "Install folders and Config files have been setup for $app_name."
-
-        ((menu_number++))
-        echo ""
-
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
-        echo ""
-
-        dockerComposeSetupFile $app_name;
-
-        # Enable Gitea's /metrics endpoint only when CFG_GITEA_MONITORING=true
-        # (toggles the libreportal-monitoring marker block in the compose).
-        monitoringToggleAppConfig "$app_name" "docker-compose.yml";
-
-        # /metrics rides Gitea's public web port, so it's locked behind a
-        # bearer token. CFG_GITEA_METRICS_TOKEN lives in the .config (filled
-        # once by the RANDOMIZEDPASSWORD scanner, preserved across reinstalls)
-        # and reaches the compose via the GITEA_METRICS_TOKEN_TAG tag — mirror
-        # that same value into the Prometheus scrape fragment so the two agree.
-        if monitoringAppEnabled "$app_name"; then
-            if [[ -n "$CFG_GITEA_METRICS_TOKEN" ]]; then
-                sudo sed -i "s|GITEA_METRICS_TOKEN_PLACEHOLDER|${CFG_GITEA_METRICS_TOKEN}|g" \
-                    "$containers_dir$app_name/resources/monitoring/prometheus-scrape.yml"
-                checkSuccess "Synced Gitea /metrics token to the Prometheus scrape config"
-            else
-                isNotice "CFG_GITEA_METRICS_TOKEN is empty — Gitea /metrics scrape may 401."
-            fi
-        fi
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Updating file permissions before starting."
-        echo ""
-
-		fixPermissionsBeforeStart $app_name;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
-        echo ""
-
-		dockerComposeUpdateAndStartApp $app_name install;
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running Application specific updates (if required)"
-        echo ""
-
-        appUpdateSpecifics $app_name;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running Headscale setup (if required)"
-        echo ""
-
-		setupHeadscale $app_name;
-
-		((menu_number++))
-		echo ""
-        echo "---- $menu_number. Adding $app_name to the Apps Database table."
-        echo ""
-
-		databaseInstallApp $app_name;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. Updating WebUI config file."
-        echo ""
-
-        webuiContainerSetup $app_name install;
-
-		((menu_number++))
-		echo ""
-		echo "---- $menu_number. Refreshing monitoring integration."
-		echo ""
-
-		# Self-correcting: adds Gitea's scrape target + dashboard to
-		# Prometheus/Grafana when CFG_GITEA_MONITORING=true, removes them when
-		# it's off. No-ops with a notice if either app isn't installed.
-		monitoringRefreshAll;
-
-		((menu_number++))
-        echo ""
-        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
-        echo ""
-        echo "    You can now navigate to your $app_name service using one of the options below : "
-        echo ""
-
-        menuShowFinalMessages $app_name;
-
-		menu_number=0
-        #sleep 3s
-        cd
-	fi
-	gitea=n
-}

containers/gitea/scripts/gitea_auth.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 _giteaCmd() {
-    sudo docker exec -u git gitea-service gitea admin "$@" 2>&1
+    runFileOp docker exec -u git gitea-service gitea admin "$@" 2>&1
 }
 
 authAdapter_gitea_setPassword() {

containers/gitea/scripts/gitea_install_hooks.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+# Gitea install hooks — mirror CFG_GITEA_METRICS_TOKEN into the Prometheus
+# scrape fragment so the bearer token in the compose env matches what the
+# Prometheus side sends.
+
+gitea_install_post_compose()
+{
+    local app_name="$1"
+
+    # The driver already ran monitoringToggleAppConfig "$app_name" docker-compose.yml,
+    # so the metrics block reflects CFG_GITEA_MONITORING. /metrics rides
+    # Gitea's public web port and is token-protected; sync the token into
+    # the scrape config so the two sides agree.
+    if monitoringAppEnabled "$app_name"; then
+        if [[ -n "$CFG_GITEA_METRICS_TOKEN" ]]; then
+            local result
+            result=$(runFileOp sed -i "s|GITEA_METRICS_TOKEN_PLACEHOLDER|${CFG_GITEA_METRICS_TOKEN}|g" \
+                "$containers_dir$app_name/resources/monitoring/prometheus-scrape.yml")
+            checkSuccess "Synced Gitea /metrics token to the Prometheus scrape config"
+        else
+            isNotice "CFG_GITEA_METRICS_TOKEN is empty — Gitea /metrics scrape may 401."
+        fi
+    fi
+}

containers/gitea/tools/gitea.tools.json

@@ -0,0 +1,105 @@
+{
+  "tools": [
+    {
+      "id": "reset_password",
+      "category": "users",
+      "label": "Reset User Password",
+      "description": "Set a new password for an existing user. Leave blank to generate one.",
+      "icon": "🔑",
+      "fields": [
+        {
+          "name": "username",
+          "label": "Username",
+          "type": "text",
+          "required": true
+        },
+        {
+          "name": "password",
+          "label": "New password",
+          "type": "password",
+          "placeholder": "Leave blank to generate"
+        }
+      ]
+    },
+    {
+      "id": "create_account",
+      "category": "users",
+      "label": "Create User Account",
+      "description": "Add a new user. Tick \"Make admin\" for full rights.",
+      "icon": "👤",
+      "fields": [
+        {
+          "name": "username",
+          "label": "Username",
+          "type": "text",
+          "required": true
+        },
+        {
+          "name": "email",
+          "label": "Email",
+          "type": "text",
+          "placeholder": "user@example.com",
+          "required": true
+        },
+        {
+          "name": "password",
+          "label": "Password",
+          "type": "password",
+          "placeholder": "Leave blank to generate"
+        },
+        {
+          "name": "admin",
+          "label": "Make admin",
+          "type": "checkbox",
+          "default": false
+        }
+      ]
+    },
+    {
+      "id": "list_users",
+      "category": "users",
+      "label": "List Users",
+      "description": "List every user.",
+      "icon": "📋",
+      "fields": []
+    },
+    {
+      "id": "delete_user",
+      "category": "users",
+      "label": "Delete User Account",
+      "description": "Permanently remove a user.",
+      "icon": "🗑",
+      "destructive": true,
+      "confirm": "This cannot be undone.",
+      "fields": [
+        {
+          "name": "username",
+          "label": "Username",
+          "type": "text",
+          "required": true
+        }
+      ]
+    },
+    {
+      "id": "set_admin",
+      "category": "users",
+      "label": "Set Admin Status",
+      "description": "Promote or demote a user.",
+      "icon": "👑",
+      "fields": [
+        {
+          "name": "username",
+          "label": "Username",
+          "type": "text",
+          "required": true
+        },
+        {
+          "name": "admin",
+          "label": "Make admin",
+          "type": "checkbox",
+          "default": false
+        }
+      ]
+    }
+  ]
+}

containers/gluetun/gluetun.config

@@ -12,6 +12,7 @@
 #
 CFG_GLUETUN_APP_NAME=gluetun
 CFG_GLUETUN_BACKUP=true
+CFG_GLUETUN_BACKUP_STRATEGY=auto
 CFG_GLUETUN_COMPOSE_FILE=default
 CFG_GLUETUN_HEALTHCHECK=true
 CFG_GLUETUN_AUTHELIA=false

containers/gluetun/gluetun.sh

@@ -1,136 +0,0 @@
-#!/bin/bash
-
-# Category : Networking
-# Description : Gluetun - VPN client for routing other containers (c/u/s/r/i):
-
-installGluetun()
-{
-    local config_variables="$1"
-
-    if [[ "$gluetun" == *[cCtTuUsSrRiI]* ]]; then
-        dockerConfigSetupToContainer silent gluetun;
-        local app_name=$CFG_GLUETUN_APP_NAME
-        initializeAppVariables $app_name;
-    fi
-
-    if [[ "$gluetun" == *[cC]* ]]; then
-        editAppConfig $app_name;
-    fi
-
-    if [[ "$gluetun" == *[uU]* ]]; then
-        dockerUninstallApp $app_name;
-    fi
-
-    if [[ "$gluetun" == *[sS]* ]]; then
-        dockerComposeDown $app_name;
-    fi
-
-    if [[ "$gluetun" == *[rR]* ]]; then
-        dockerComposeRestart $app_name;
-    fi
-
-    if [[ "$gluetun" == *[iI]* ]]; then
-        isHeader "Install $app_name"
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Setting up install folder and config file for $app_name."
-        echo ""
-
-        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
-        isSuccessful "Install folders and Config files have been setup for $app_name."
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
-        echo ""
-
-        dockerComposeSetupFile $app_name;
-
-        monitoringToggleAppConfig "$app_name" "docker-compose.yml";
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Updating file permissions before starting."
-        echo ""
-
-        fixPermissionsBeforeStart $app_name;
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
-        echo ""
-
-        dockerComposeUpdateAndStartApp $app_name install;
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running Application specific updates (if required)"
-        echo ""
-
-        appUpdateSpecifics $app_name;
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Running Headscale setup (if required)"
-        echo ""
-
-        setupHeadscale $app_name;
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Adding $app_name to the Apps Database table."
-        echo ""
-
-        databaseInstallApp $app_name;
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Updating the WebUI config file."
-        echo ""
-
-        webuiContainerSetup $app_name install;
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Refreshing Gluetun provider snapshot."
-        echo ""
-
-        webuiGenerateGluetunProviders;
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Re-attaching gluetun-routed apps (post-recreate)."
-        echo ""
-
-        # Gluetun was just (re)created — every existing routed app holds a
-        # stale container ID in its network_mode. Reattach them now so the
-        # user doesn't have to chase silent netns drift later.
-        appGluetunRoutedRecreate
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. Routing existing apps through Gluetun (optional)."
-        echo ""
-
-        gluetunRouteExistingAppsPrompt;
-
-		((menu_number++))
-		echo ""
-		echo "---- $menu_number. Refreshing monitoring integration."
-		echo ""
-
-		monitoringRefreshAll;
-
-        ((menu_number++))
-        echo ""
-        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
-        echo ""
-
-        menuShowFinalMessages "$app_name";
-
-        menu_number=0
-        cd
-    fi
-    gluetun=n
-}

containers/gluetun/scripts/gluetun_compose_tags.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+# App-specific compose tags for Gluetun (VPN gateway) + its forwarded-port wiring.
+appSetupComposeTags_gluetun() {
+    local full_file_path="$1"
+    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_VPN_SERVICE_PROVIDER_TAG" "$CFG_GLUETUN_VPN_SERVICE_PROVIDER"
+    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_VPN_TYPE_TAG" "$CFG_GLUETUN_VPN_TYPE"
+    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_VPN_COUNTRIES_TAG" "$CFG_GLUETUN_VPN_COUNTRIES"
+    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_OPENVPN_USER_TAG" "$CFG_GLUETUN_OPENVPN_USER"
+    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_OPENVPN_PASSWORD_TAG" "$CFG_GLUETUN_OPENVPN_PASSWORD"
+    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_WIREGUARD_PRIVATE_KEY_TAG" "$CFG_GLUETUN_WIREGUARD_PRIVATE_KEY"
+    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_WIREGUARD_ADDRESSES_TAG" "$CFG_GLUETUN_WIREGUARD_ADDRESSES"
+    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_HEALTH_TARGETS_TAG"  "${CFG_GLUETUN_HEALTH_TARGETS:-mullvad.net:443,eff.org:443}"
+    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_HEALTH_ICMP_IPS_TAG" "${CFG_GLUETUN_HEALTH_ICMP_IPS:-9.9.9.9}"
+    appNetworkRegisterPorts_gluetun
+}

containers/gluetun/scripts/gluetun_install_hooks.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+
+# Gluetun install hooks — post-start provider snapshot refresh + reattach
+# any apps routed through gluetun (their network_mode holds a stale
+# container ID after gluetun was just recreated) + offer to onboard
+# existing apps.
+
+gluetun_install_post_start()
+{
+    local app_name="$1"
+
+    ((menu_number++))
+    echo ""
+    echo "---- $menu_number. Refreshing Gluetun provider snapshot."
+    echo ""
+
+    appWebuiRefresh_gluetun
+
+    ((menu_number++))
+    echo ""
+    echo "---- $menu_number. Re-attaching gluetun-routed apps (post-recreate)."
+    echo ""
+
+    # Gluetun was just (re)created — every existing routed app holds a
+    # stale container ID in its network_mode. Reattach them now so the
+    # user doesn't have to chase silent netns drift later.
+    appGluetunRoutedRecreate
+
+    ((menu_number++))
+    echo ""
+    echo "---- $menu_number. Routing existing apps through Gluetun (optional)."
+    echo ""
+
+    gluetunRouteExistingAppsPrompt
+}

containers/gluetun/scripts/gluetun_network.sh

@@ -1,25 +1,21 @@
 #!/bin/bash
 
-# Toggles a per-app compose between default networking and gluetun-routed
-# networking by editing marker regions: GLUETUN_OFF_*  and GLUETUN_ON_*.
-#
-# default → keep OFF region as-is, ON region stays commented (no-op).
-# gluetun → comment out everything in OFF region, uncomment ON region,
-#           force traefik.enable to false (app reached via gluetun ports).
-tagsProcessorNetworkMode()
+# Gluetun network-routing provider hooks. An app routes through gluetun by setting
+# CFG_<APP>_NETWORK=gluetun; the central compose templater + uninstall flow call
+# these by convention (appNetworkApplyMode_<provider> / appNetworkRegisterPorts_
+# <provider>) with no provider name hardcoded centrally — so this lives with the
+# app that owns it.
+
+# Switch a routed app's compose between default and gluetun networking by editing
+# its marker regions (GLUETUN_OFF_* / GLUETUN_ON_*) and forcing traefik off (the
+# app is reached via gluetun's published ports instead).
+appNetworkApplyMode_gluetun()
 {
     local file="$1"
-    local mode="$2"
-
-    if [[ -z "$file" || ! -f "$file" ]]; then
-        return 0
-    fi
-    if [[ "$mode" != "gluetun" ]]; then
-        return 0
-    fi
+    [[ -z "$file" || ! -f "$file" ]] && return 0
 
     local tmp="${file}.netmode.$$"
-    sudo awk '
+    runFileOp awk '
         BEGIN { in_off=0; in_on=0 }
         /# *GLUETUN_OFF_BEGIN/ { in_off=1; print; next }
         /# *GLUETUN_OFF_END/   { in_off=0; print; next }
@@ -44,17 +40,17 @@ tagsProcessorNetworkMode()
             }
             print
         }
-    ' "$file" | sudo tee "$tmp" >/dev/null
+    ' "$file" | runFileWrite "$tmp"
 
-    sudo mv "$tmp" "$file"
+    runFileOp mv "$tmp" "$file"
 
     tagsManagerUpdateUniversalTag "$file" "TRAEFIK_ENABLE_TAG" "false"
 }
 
-# Rebuilds gluetun's GLUETUN_FORWARDED_PORTS region from every installed
-# app whose CFG_<APP>_NETWORK is gluetun. Region is fully rewritten on every
-# call so removed apps drop out automatically.
-tagsProcessorGluetunForwardedPorts()
+# Rebuild gluetun's GLUETUN_FORWARDED_PORTS region from every installed app whose
+# CFG_<APP>_NETWORK is gluetun. Region is fully rewritten on every call so removed
+# apps drop out automatically. Self-skips if gluetun isn't installed.
+appNetworkRegisterPorts_gluetun()
 {
     local gluetun_compose="${containers_dir}gluetun/docker-compose.yml"
     if [[ ! -f "$gluetun_compose" ]]; then return 0; fi
@@ -62,7 +58,7 @@ tagsProcessorGluetunForwardedPorts()
     if [[ ! -f "$docker_dir/$db_file" ]]; then return 0; fi
 
     local installed_apps
-    installed_apps=$(sudo sqlite3 "$docker_dir/$db_file" \
+    installed_apps=$(runInstallOp sqlite3 "$docker_dir/$db_file" \
         "SELECT name FROM apps WHERE status = 1 ORDER BY name;" 2>/dev/null)
 
     local routed_lines=""
@@ -75,7 +71,7 @@ tagsProcessorGluetunForwardedPorts()
         [[ "$net" != "gluetun" ]] && continue
 
         local ports
-        ports=$(sudo sqlite3 "$docker_dir/$db_file" \
+        ports=$(runInstallOp sqlite3 "$docker_dir/$db_file" \
             "SELECT resource_value FROM network_resources WHERE app_name = '$app' AND resource_type = 'port' AND status = 'active';" 2>/dev/null)
         while IFS= read -r p; do
             [[ -z "$p" ]] && continue
@@ -90,7 +86,7 @@ tagsProcessorGluetunForwardedPorts()
     done <<< "$installed_apps"
 
     local tmp="${gluetun_compose}.fwd.$$"
-    sudo awk -v block="$routed_lines" '
+    runFileOp awk -v block="$routed_lines" '
         BEGIN { in_region=0 }
         /# *GLUETUN_FORWARDED_PORTS_BEGIN/ {
             print
@@ -100,20 +96,19 @@ tagsProcessorGluetunForwardedPorts()
         }
         /# *GLUETUN_FORWARDED_PORTS_END/ { in_region=0; print; next }
         { if (!in_region) print }
-    ' "$gluetun_compose" | sudo tee "$tmp" >/dev/null
+    ' "$gluetun_compose" | runFileWrite "$tmp"
 
-    if ! sudo cmp -s "$tmp" "$gluetun_compose"; then
-        sudo mv "$tmp" "$gluetun_compose"
-        if sudo docker ps --format '{{.Names}}' 2>/dev/null | grep -q '^gluetun-service$'; then
+    if ! runFileOp cmp -s "$tmp" "$gluetun_compose"; then
+        runFileOp mv "$tmp" "$gluetun_compose"
+        if runFileOp docker ps --format '{{.Names}}' 2>/dev/null | grep -q '^gluetun-service$'; then
             isNotice "Gluetun forwarded ports changed; recreating gluetun-service to apply."
-            (cd "${containers_dir}gluetun" && sudo docker compose up -d --force-recreate gluetun-service >/dev/null 2>&1) || true
-            # Recreating gluetun gives it a new container ID, which orphans
-            # every `network_mode: container:gluetun-service` reference. Re-
-            # attach all routed apps so they share the new netns instead of
-            # silently getting their own.
+            (cd "${containers_dir}gluetun" && runFileOp docker compose up -d --force-recreate gluetun-service >/dev/null 2>&1) || true
+            # Recreating gluetun gives it a new container ID, which orphans every
+            # `network_mode: container:gluetun-service` reference. Re-attach all
+            # routed apps so they share the new netns instead of getting their own.
             appGluetunRecreateRouted
         fi
     else
-        sudo rm -f "$tmp"
+        runFileOp rm -f "$tmp"
     fi
 }

containers/gluetun/scripts/gluetun_providers.sh

@@ -1,17 +1,21 @@
 #!/bin/bash
 
+# Per-app routine WebUI-refresh hook (appWebuiRefresh_<app>): webui_updater calls
+# it on every WebUI update while gluetun is installed; the installer (gluetun.sh)
+# and the 'gluetun_refresh_providers' tool call it directly too.
+#
 # Fetches gluetun's upstream servers.json, slims it down to a
 # { providers: { <name>: { vpnTypes, countries } } } shape, and writes it
 # to the WebUI data dir so the per-app config dropdowns stay honest as
 # gluetun adds/removes providers and protocols. Falls back silently to the
 # previous snapshot (or the bundled default) on network failure.
-webuiGenerateGluetunProviders() {
+appWebuiRefresh_gluetun() {
     local output_file="${containers_dir}libreportal/frontend/data/apps/generated/gluetun-providers.json"
     local upstream="https://raw.githubusercontent.com/qdm12/gluetun/master/internal/storage/servers.json"
-    local tmp="${output_file}.tmp.$$"
+    local tmp="$(mktemp)"
     local raw="${output_file}.raw.$$"
 
-    mkdir -p "$(dirname "$output_file")"
+    runFileOp mkdir -p "$(dirname "$output_file")"
 
     if ! command -v jq >/dev/null 2>&1; then
         isNotice "jq not installed; skipping gluetun provider refresh."
@@ -32,18 +36,24 @@ webuiGenerateGluetunProviders() {
             -D "$headers" -o "$raw" \
             -w '%{http_code}' "$upstream") || http_code=""
 
+    # $raw and $headers live next to $output_file (under containers_dir/
+    # libreportal/frontend/data/, dockerinstall-owned in rootless). The
+    # manager can't `rm` them directly without a Permission denied — same
+    # class of bug as the updateConfigOption sed-i issue. runFileOp routes
+    # the rm through the right user. $tmp is from mktemp (/tmp), so
+    # `rm -f $tmp` stays unwrapped.
     if [[ "$http_code" == "304" ]]; then
-        rm -f "$raw" "$headers"
+        runFileOp rm -f "$raw" "$headers"
         return 0
     fi
     if [[ "$http_code" != "200" ]]; then
         isNotice "Upstream fetch failed (${http_code:-no response}); keeping existing snapshot."
-        rm -f "$raw" "$headers"
+        runFileOp rm -f "$raw" "$headers"
         return 0
     fi
     local new_etag
     new_etag=$(awk 'tolower($1)=="etag:"{print $2}' "$headers" | tr -d '\r')
-    rm -f "$headers"
+    runFileOp rm -f "$headers"
 
     # servers.json is a top-level object keyed by provider; each provider
     # entry has a `servers` array whose items have `vpn` (wireguard|openvpn),
@@ -63,16 +73,16 @@ webuiGenerateGluetunProviders() {
         | { providers: . }
     ' "$raw" > "$tmp" 2>/dev/null; then
         isNotice "Failed to parse gluetun servers.json; keeping existing provider snapshot."
-        rm -f "$raw" "$tmp"
+        runFileOp rm -f "$raw"
+        rm -f "$tmp"
         return 0
     fi
 
-    rm -f "$raw"
+    runFileOp rm -f "$raw"
 
     if [ -s "$tmp" ]; then
-        mv "$tmp" "$output_file"
-        createTouch "$output_file" "$docker_install_user"
-        [[ -n "$new_etag" ]] && echo "$new_etag" | tee "$etag_file" >/dev/null
+        runFileWrite "$output_file" < "$tmp"; rm -f "$tmp"
+        [[ -n "$new_etag" ]] && echo "$new_etag" | runFileWrite "$etag_file"
         isSuccessful "Refreshed gluetun provider snapshot ($(jq '.providers | length' "$output_file") providers)."
     else
         rm -f "$tmp"

containers/gluetun/scripts/gluetun_recreate_routed.sh

@@ -12,7 +12,7 @@
 # app's HTTP server is no longer in gluetun's namespace.
 #
 # Call this whenever you've just touched gluetun in a way that recreates
-# its container — see tagsProcessorGluetunForwardedPorts and the gluetun
+# its container — see appNetworkRegisterPorts_gluetun and the gluetun
 # install lifecycle for the two existing wiring sites.
 appGluetunRecreateRouted()
 {
@@ -24,10 +24,10 @@ appGluetunRecreateRouted()
     fi
 
     local installed_apps
-    installed_apps=$(sudo sqlite3 "$docker_dir/$db_file" \
+    installed_apps=$(runInstallOp sqlite3 "$docker_dir/$db_file" \
         "SELECT name FROM apps WHERE status = 1 ORDER BY name;" 2>/dev/null)
 
-    if ! sudo docker ps --format '{{.Names}}' 2>/dev/null | grep -q '^gluetun-service$'; then
+    if ! runFileOp docker ps --format '{{.Names}}' 2>/dev/null | grep -q '^gluetun-service$'; then
         # Nothing to re-attach against; gluetun isn't running.
         return 0
     fi
@@ -48,15 +48,13 @@ appGluetunRecreateRouted()
 
         # Skip apps with no running/created container — recreate would
         # do nothing useful and we'd just emit noise.
-        if ! sudo docker ps -a --format '{{.Names}}' 2>/dev/null \
+        if ! runFileOp docker ps -a --format '{{.Names}}' 2>/dev/null \
             | grep -q "^${app}-service$"; then
             continue
         fi
 
         isNotice "Re-attaching ${app} to gluetun's namespace (force-recreate)..."
-        (cd "${containers_dir}${app}" \
-            && sudo docker compose up -d --force-recreate "${app}-service" \
-                >/dev/null 2>&1) || true
+        dockerCommandRun "cd ${containers_dir}${app} && docker compose up -d --force-recreate ${app}-service" >/dev/null 2>&1 || true
         ((recreated++))
     done <<< "$installed_apps"
 

containers/gluetun/scripts/gluetun_route_apps.sh

@@ -19,7 +19,7 @@ gluetunRouteExistingAppsPrompt()
     fi
 
     local installed
-    installed=$(sudo sqlite3 "$docker_dir/$db_file" \
+    installed=$(runInstallOp sqlite3 "$docker_dir/$db_file" \
         "SELECT name FROM apps WHERE status = 1 AND name NOT IN ('gluetun','libreportal','traefik','fail2ban') ORDER BY name;" 2>/dev/null)
 
     if [[ -z "$installed" ]]; then

containers/gluetun/tools/gluetun.tools.json

@@ -0,0 +1,11 @@
+{
+  "tools": [
+    {
+      "id": "refresh_providers",
+      "label": "Refresh VPN Providers",
+      "description": "Refresh the VPN provider and country lists.",
+      "icon": "🔄",
+      "fields": []
+    }
+  ]
+}