fix(migration): atomic /usr/bin/update replacement to prevent syntax errors

All 8 migration scripts (runtipi, dockge, dokploy, coolify, komodo,
alpine-komodo, overseerr, jellyseerr) overwrote /usr/bin/update in-place
while the parent shell still had the file open for reading. Since the
new content is longer than the original, bash would read leftover bytes
after the child process exited, causing garbled output or syntax errors
like: /usr/bin/update: line 2: syntax error near unexpected token )

Fix:
- Write to a temp file first, then mv over /usr/bin/update (atomic
  inode replacement so parent shell sees EOF on old fd)
- Remove unnecessary shebang from heredoc content in overseerr/jellyseerr
  (consistent with all other update scripts and install.func)

CHANGELOG.md

@@ -416,23 +416,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
-    - fix: gitea-mirror [@CrazyWolf13](https://github.com/CrazyWolf13) ([#12549](https://github.com/community-scripts/ProxmoxVE/pull/12549))
     - fix(immich): correct LibRaw clone URL to official upstream [@DenislavDenev](https://github.com/DenislavDenev) ([#12526](https://github.com/community-scripts/ProxmoxVE/pull/12526))
-    - update: stirling-pdf: java 25 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#12552](https://github.com/community-scripts/ProxmoxVE/pull/12552))
-    - Docmost: register NoopAuditService globally when EE submodule is missing [@MickLesk](https://github.com/MickLesk) ([#12551](https://github.com/community-scripts/ProxmoxVE/pull/12551))
-    - jellyseer/overseer migration corrupting /usr/bin/update [@MickLesk](https://github.com/MickLesk) ([#12539](https://github.com/community-scripts/ProxmoxVE/pull/12539))
-    - PowerDNS: use gsqlite3 backend instead of BIND [@MickLesk](https://github.com/MickLesk) ([#12538](https://github.com/community-scripts/ProxmoxVE/pull/12538))
-    - addon migrations: /usr/bin/update replacement to prevent syntax error [@MickLesk](https://github.com/MickLesk) ([#12540](https://github.com/community-scripts/ProxmoxVE/pull/12540))
-
-  - #### 🔧 Refactor
-
-    - Refactor: LiteLLM [@tremor021](https://github.com/tremor021) ([#12550](https://github.com/community-scripts/ProxmoxVE/pull/12550))
 
 ### 💾 Core
 
   - #### 🐞 Bug Fixes
 
-    - tools: fall back to distro packages for psql [@MickLesk](https://github.com/MickLesk) ([#12542](https://github.com/community-scripts/ProxmoxVE/pull/12542))
     - fix: whitelist var_searchdomain and fix the handling of var_ns and va… [@tommoyer](https://github.com/tommoyer) ([#12521](https://github.com/community-scripts/ProxmoxVE/pull/12521))
 
 ## 2026-03-03

ct/docmost.sh

@@ -48,17 +48,6 @@ function update_script() {
     cd /opt/docmost
     mv /opt/.env /opt/docmost/.env
     mv /opt/data /opt/docmost/data
-
-    # Fix: Docmost EE (audit logs etc.) lives in a git submodule that is NOT
-    # included in GitHub tarballs.  The community NoopAuditService exists but
-    # is only exported by CoreModule – child modules such as UserModule cannot
-    # resolve it.  Making CoreModule @Global() exposes the token app-wide.
-    if [[ ! -f /opt/docmost/apps/server/src/ee/ee.module.ts ]] \
-      && ! grep -q '@Global()' /opt/docmost/apps/server/src/core/core.module.ts 2>/dev/null; then
-      sed -i '/^  Module,$/a\  Global,' /opt/docmost/apps/server/src/core/core.module.ts
-      sed -i '/^@Module({$/i @Global()' /opt/docmost/apps/server/src/core/core.module.ts
-    fi
-
     $STD pnpm install --force
     $STD pnpm build
     msg_ok "Updated ${APP}"

ct/gitea-mirror.sh

@@ -87,8 +87,6 @@ EOF
     msg_ok "Old Enviroment fixed"
   fi
 
-  ensure_dependencies git
-
   if check_for_gh_release "gitea-mirror" "RayLabsHQ/gitea-mirror"; then
     msg_info "Stopping Services"
     systemctl stop gitea-mirror
@@ -96,7 +94,7 @@ EOF
 
     msg_info "Backup Data"
     mkdir -p /opt/gitea-mirror-backup/data
-    cp -r /opt/gitea-mirror/data/* /opt/gitea-mirror-backup/data/
+    cp /opt/gitea-mirror/data/* /opt/gitea-mirror-backup/data/
     msg_ok "Backup Data"
 
     msg_info "Installing Bun"
@@ -113,11 +111,12 @@ EOF
     $STD bun run setup
     $STD bun run build
     APP_VERSION=$(grep -o '"version": *"[^"]*"' package.json | cut -d'"' -f4)
-    sed -i.bak "s|^npm_package_version=.*|npm_package_version=${APP_VERSION}|" /opt/gitea-mirror.env
+
+    sudo sed -i.bak "s|^npm_package_version=.*|npm_package_version=${APP_VERSION}|" /opt/gitea-mirror.env
     msg_ok "Updated and rebuilt ${APP}"
 
     msg_info "Restoring Data"
-    cp -r /opt/gitea-mirror-backup/data/* /opt/gitea-mirror/data
+    cp /opt/gitea-mirror-backup/data/* /opt/gitea-mirror/data
     msg_ok "Restored Data"
 
     msg_info "Starting Service"

ct/litellm.sh

@@ -34,7 +34,7 @@ function update_script() {
   msg_ok "Stopped Service"
 
   VENV_PATH="/opt/litellm/.venv"
-  PYTHON_VERSION="3.13" USE_UVX="YES" setup_uv
+  PYTHON_VERSION="3.13" setup_uv
 
   msg_info "Updating LiteLLM"
   $STD "$VENV_PATH/bin/python" -m pip install --upgrade litellm[proxy] prisma

ct/stirling-pdf.sh

@@ -35,7 +35,7 @@ function update_script() {
     fi
 
     PYTHON_VERSION="3.12" setup_uv
-    JAVA_VERSION="25" setup_java
+    JAVA_VERSION="21" setup_java
 
     msg_info "Stopping Services"
     systemctl stop stirlingpdf libreoffice-listener unoserver

install/docmost-install.sh

@@ -26,17 +26,6 @@ fetch_and_deploy_gh_release "docmost" "docmost/docmost" "tarball"
 
 msg_info "Configuring Docmost (Patience)"
 cd /opt/docmost
-
-# Fix: Docmost EE (audit logs etc.) lives in a git submodule that is NOT
-# included in GitHub tarballs.  The community NoopAuditService exists but
-# is only exported by CoreModule – child modules such as UserModule cannot
-# resolve it.  Making CoreModule @Global() exposes the token app-wide.
-if [[ ! -f /opt/docmost/apps/server/src/ee/ee.module.ts ]] \
-  && ! grep -q '@Global()' /opt/docmost/apps/server/src/core/core.module.ts 2>/dev/null; then
-  sed -i '/^  Module,$/a\  Global,' /opt/docmost/apps/server/src/core/core.module.ts
-  sed -i '/^@Module({$/i @Global()' /opt/docmost/apps/server/src/core/core.module.ts
-fi
-
 mv .env.example .env
 mkdir data
 sed -i -e "s|APP_SECRET=.*|APP_SECRET=$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | cut -c1-32)|" \

install/gitea-mirror-install.sh

@@ -18,8 +18,7 @@ $STD apt install -y \
   build-essential \
   openssl \
   sqlite3 \
-  unzip \
-  git
+  unzip
 msg_ok "Installed Dependencies"
 
 msg_info "Installing Bun"

install/litellm-install.sh

@@ -20,8 +20,24 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"
 
 PG_VERSION="17" setup_postgresql
-PG_DB_NAME="litellm_db" PG_DB_USER="litellm" setup_postgresql_db
-PYTHON_VERSION="3.13" USE_UVX="YES" setup_uv
+PYTHON_VERSION="3.13" setup_uv
+
+msg_info "Setting up PostgreSQL"
+DB_NAME="litellm_db"
+DB_USER="litellm"
+DB_PASS="$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)"
+$STD sudo -u postgres psql -c "CREATE ROLE $DB_USER WITH LOGIN PASSWORD '$DB_PASS';"
+$STD sudo -u postgres psql -c "CREATE DATABASE $DB_NAME WITH OWNER $DB_USER ENCODING 'UTF8' TEMPLATE template0;"
+$STD sudo -u postgres psql -c "ALTER ROLE $DB_USER SET client_encoding TO 'utf8';"
+$STD sudo -u postgres psql -c "ALTER ROLE $DB_USER SET default_transaction_isolation TO 'read committed';"
+$STD sudo -u postgres psql -c "ALTER ROLE $DB_USER SET timezone TO 'UTC';"
+{
+  echo "${APPLICATION} Credentials"
+  echo "Database Name: $DB_NAME"
+  echo "Database User: $DB_USER"
+  echo "Database Password: $DB_PASS"
+} >>~/litellm.creds
+msg_ok "Set up PostgreSQL"
 
 msg_info "Setting up Virtual Environment"
 mkdir -p /opt/litellm
@@ -37,9 +53,10 @@ mkdir -p /opt
 cat <<EOF >/opt/litellm/litellm.yaml
 general_settings:
   master_key: sk-1234
-  database_url: postgresql://$PG_DB_USER:$PG_DB_PASS@127.0.0.1:5432/$PG_DB_NAME
+  database_url: postgresql://$DB_USER:$DB_PASS@127.0.0.1:5432/$DB_NAME
   store_model_in_db: true
 EOF
+
 uv --directory=/opt/litellm run litellm --config /opt/litellm/litellm.yaml --use_prisma_db_push --skip_server_startup
 msg_ok "Configured LiteLLM"
 
@@ -56,6 +73,7 @@ Restart=always
 [Install]
 WantedBy=multi-user.target
 EOF
+
 systemctl enable -q --now litellm
 msg_ok "Created Service"
 

install/powerdns-install.sh

@@ -38,12 +38,6 @@ msg_info "Setting up PowerDNS"
 $STD apt install -y \
   pdns-server \
   pdns-backend-sqlite3
-sed -i 's/^launch=$/# launch=/' /etc/powerdns/pdns.conf
-rm -f /etc/powerdns/pdns.d/bind.conf
-cat <<EOF >/etc/powerdns/pdns.d/gsqlite3.conf
-launch+=gsqlite3
-gsqlite3-database=/opt/poweradmin/powerdns.db
-EOF
 msg_ok "Setup PowerDNS"
 
 fetch_and_deploy_gh_release "poweradmin" "poweradmin/poweradmin" "tarball"
@@ -132,10 +126,7 @@ cat <<EOF >/etc/apache2/sites-enabled/poweradmin.conf
 EOF
 $STD a2enmod rewrite headers
 chown -R www-data:www-data /opt/poweradmin
-chown pdns:pdns /opt/poweradmin/powerdns.db
-chmod 664 /opt/poweradmin/powerdns.db
-usermod -aG pdns www-data
-$STD systemctl restart pdns apache2
+$STD systemctl restart apache2
 msg_info "Created Service"
 
 motd_ssh

install/stirling-pdf-install.sh

@@ -31,7 +31,7 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"
 
 PYTHON_VERSION="3.12" setup_uv
-JAVA_VERSION="25" setup_java
+JAVA_VERSION="21" setup_java
 
 read -r -p "${TAB3}Do you want to use Stirling-PDF with Login? (no/n = without Login) [Y/n] " response
 response=${response,,} # Convert to lowercase

misc/tools.func

@@ -6500,13 +6500,14 @@ function setup_postgresql() {
   local SUITE
   case "$DISTRO_CODENAME" in
   trixie | forky | sid)
+
     if verify_repo_available "https://apt.postgresql.org/pub/repos/apt" "trixie-pgdg"; then
       SUITE="trixie-pgdg"
+
     else
-      msg_warn "PGDG repo not available for ${DISTRO_CODENAME}, falling back to distro packages"
-      USE_PGDG_REPO=false setup_postgresql
-      return $?
+      SUITE="bookworm-pgdg"
     fi
+
     ;;
   *)
     SUITE=$(get_fallback_suite "$DISTRO_ID" "$DISTRO_CODENAME" "https://apt.postgresql.org/pub/repos/apt")