From 6881dc9de12eab7349fe7ef52ac563e3581b3c81 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Tue, 24 Feb 2026 09:32:56 +0100
Subject: [PATCH] cleanup

---
 misc/bak_december/build.func.pve9-update | 3925 ------------------
 misc/bak_december/install copy.func      |  277 --
 misc/bak_december/install.func.bak       |  287 --
 misc/bak_december/install.func.unified   |  992 -----
 misc/data/.gitignore                     |   34 -
 misc/data/Dockerfile                     |   52 -
 misc/data/LICENSE                        |   21 -
 misc/data/README.md                      |   81 -
 misc/data/alerts.go                      |  853 ----
 misc/data/cache.go                       |  158 -
 misc/data/cleanup.go                     |  173 -
 misc/data/dashboard.go                   | 2937 -------------
 misc/data/entrypoint.sh                  |   55 -
 misc/data/go.mod                         |   10 -
 misc/data/go.sum                         |   10 -
 misc/data/migrate.go                     |  366 --
 misc/data/migrate.sh                     |   67 -
 misc/data/migration/fix-timestamps.sh    |  106 -
 misc/data/migration/import-direct.sh     |   77 -
 misc/data/migration/migrate-linux.sh     |   89 -
 misc/data/migration/migrate.go           | 1295 ------
 misc/data/migration/migrate.sh           |   67 -
 misc/data/migration/migration.go         |  492 ---
 misc/data/service.go                     | 1261 ------
 misc/old_misc/alpine-install.func        |  172 -
 misc/old_misc/api.func                   |  130 -
 misc/old_misc/build.func                 | 1439 -------
 misc/old_misc/config-file.func           |  699 ----
 misc/old_misc/core.func                  |  452 --
 misc/old_misc/create_lxc.sh              |  385 --
 misc/old_misc/install.func               |  217 -
 misc/old_misc/tools.func                 | 4818 ----------------------
 32 files changed, 21997 deletions(-)
 delete mode 100644 misc/bak_december/build.func.pve9-update
 delete mode 100644 misc/bak_december/install copy.func
 delete mode 100644 misc/bak_december/install.func.bak
 delete mode 100644 misc/bak_december/install.func.unified
 delete mode 100644 misc/data/.gitignore
 delete mode 100644 misc/data/Dockerfile
 delete mode 100644 misc/data/LICENSE
 delete mode 100644 misc/data/README.md
 delete mode 100644 misc/data/alerts.go
 delete mode 100644 misc/data/cache.go
 delete mode 100644 misc/data/cleanup.go
 delete mode 100644 misc/data/dashboard.go
 delete mode 100644 misc/data/entrypoint.sh
 delete mode 100644 misc/data/go.mod
 delete mode 100644 misc/data/go.sum
 delete mode 100644 misc/data/migrate.go
 delete mode 100755 misc/data/migrate.sh
 delete mode 100644 misc/data/migration/fix-timestamps.sh
 delete mode 100644 misc/data/migration/import-direct.sh
 delete mode 100644 misc/data/migration/migrate-linux.sh
 delete mode 100644 misc/data/migration/migrate.go
 delete mode 100644 misc/data/migration/migrate.sh
 delete mode 100644 misc/data/migration/migration.go
 delete mode 100644 misc/data/service.go
 delete mode 100644 misc/old_misc/alpine-install.func
 delete mode 100644 misc/old_misc/api.func
 delete mode 100644 misc/old_misc/build.func
 delete mode 100644 misc/old_misc/config-file.func
 delete mode 100644 misc/old_misc/core.func
 delete mode 100644 misc/old_misc/create_lxc.sh
 delete mode 100644 misc/old_misc/install.func
 delete mode 100644 misc/old_misc/tools.func

diff --git a/misc/bak_december/build.func.pve9-update b/misc/bak_december/build.func.pve9-update
deleted file mode 100644
index 7ce1537a..00000000
--- a/misc/bak_december/build.func.pve9-update
+++ /dev/null
@@ -1,3925 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: tteck (tteckster) | MickLesk | michelroegl-brunner
-# License: MIT | https://github.com/community-scripts/ProxmoxVED/raw/branch/main/LICENSE
-# Revision: 1
-
-# ==============================================================================
-# BUILD.FUNC - LXC CONTAINER BUILD & CONFIGURATION
-# ==============================================================================
-#
-# This file provides the main build functions for creating and configuring
-# LXC containers in Proxmox VE. It handles:
-#
-#   - Variable initialization and defaults
-#   - Container creation and resource allocation
-#   - Storage selection and management
-#   - Advanced configuration and customization
-#   - User interaction menus and prompts
-#
-# Usage:
-#   - Sourced automatically by CT creation scripts
-#   - Requires core.func and error_handler.func to be loaded first
-#
-# ==============================================================================
-
-# ==============================================================================
-# SECTION 1: INITIALIZATION & CORE VARIABLES
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# variables()
-#
-# - Initializes core variables for container creation
-# - Normalizes application name (NSAPP = lowercase, no spaces)
-# - Builds installer filename (var_install)
-# - Defines regex patterns for validation
-# - Fetches Proxmox hostname and version
-# - Generates unique session ID for tracking and logging
-# - Captures app-declared resource defaults (CPU, RAM, Disk)
-# ------------------------------------------------------------------------------
-variables() {
-    NSAPP=$(echo "${APP,,}" | tr -d ' ')              # This function sets the NSAPP variable by converting the value of the APP variable to lowercase and removing any spaces.
-    var_install="${NSAPP}-install"                    # sets the var_install variable by appending "-install" to the value of NSAPP.
-    INTEGER='^[0-9]+([.][0-9]+)?$'                    # it defines the INTEGER regular expression pattern.
-    PVEHOST_NAME=$(hostname)                          # gets the Proxmox Hostname and sets it to Uppercase
-    DIAGNOSTICS="yes"                                 # sets the DIAGNOSTICS variable to "yes", used for the API call.
-    METHOD="default"                                  # sets the METHOD variable to "default", used for the API call.
-    RANDOM_UUID="$(cat /proc/sys/kernel/random/uuid)" # generates a random UUID and sets it to the RANDOM_UUID variable.
-    SESSION_ID="${RANDOM_UUID:0:8}"                   # Short session ID (first 8 chars of UUID) for log files
-    BUILD_LOG="/tmp/create-lxc-${SESSION_ID}.log"     # Host-side container creation log
-    CTTYPE="${CTTYPE:-${CT_TYPE:-1}}"
-
-    # Parse dev_mode early
-    parse_dev_mode
-
-    # Setup persistent log directory if logs mode active
-    if [[ "${DEV_MODE_LOGS:-false}" == "true" ]]; then
-        mkdir -p /var/log/community-scripts
-        BUILD_LOG="/var/log/community-scripts/create-lxc-${SESSION_ID}-$(date +%Y%m%d_%H%M%S).log"
-    fi
-
-    # Get Proxmox VE version and kernel version
-    if command -v pveversion >/dev/null 2>&1; then
-        PVEVERSION="$(pveversion | awk -F'/' '{print $2}' | awk -F'-' '{print $1}')"
-    else
-        PVEVERSION="N/A"
-    fi
-    KERNEL_VERSION=$(uname -r)
-
-    # Capture app-declared defaults (for precedence logic)
-    # These values are set by the app script BEFORE default.vars is loaded
-    # If app declares higher values than default.vars, app values take precedence
-    if [[ -n "${var_cpu:-}" && "${var_cpu}" =~ ^[0-9]+$ ]]; then
-        export APP_DEFAULT_CPU="${var_cpu}"
-    fi
-    if [[ -n "${var_ram:-}" && "${var_ram}" =~ ^[0-9]+$ ]]; then
-        export APP_DEFAULT_RAM="${var_ram}"
-    fi
-    if [[ -n "${var_disk:-}" && "${var_disk}" =~ ^[0-9]+$ ]]; then
-        export APP_DEFAULT_DISK="${var_disk}"
-    fi
-}
-
-# -----------------------------------------------------------------------------
-# Community-Scripts bootstrap loader
-# - Always sources build.func from remote
-# - Updates local core files only if build.func changed
-# - Local cache: /usr/local/community-scripts/core
-# -----------------------------------------------------------------------------
-
-# FUNC_DIR="/usr/local/community-scripts/core"
-# mkdir -p "$FUNC_DIR"
-
-# BUILD_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/misc/build.func"
-# BUILD_REV="$FUNC_DIR/build.rev"
-# DEVMODE="${DEVMODE:-no}"
-
-# # --- Step 1: fetch build.func content once, compute hash ---
-# build_content="$(curl -fsSL "$BUILD_URL")" || {
-#   echo "❌ Failed to fetch build.func"
-#   exit 1
-# }
-
-# newhash=$(printf "%s" "$build_content" | sha256sum | awk '{print $1}')
-# oldhash=$(cat "$BUILD_REV" 2>/dev/null || echo "")
-
-# # --- Step 2: if build.func changed, offer update for core files ---
-# if [ "$newhash" != "$oldhash" ]; then
-#   echo "⚠️  build.func changed!"
-
-#   while true; do
-#     read -rp "Refresh local core files? [y/N/diff]: " ans
-#     case "$ans" in
-#     [Yy]*)
-#       echo "$newhash" >"$BUILD_REV"
-
-#       update_func_file() {
-#         local file="$1"
-#         local url="https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/misc/$file"
-#         local local_path="$FUNC_DIR/$file"
-
-#         echo "⬇️  Downloading $file ..."
-#         curl -fsSL "$url" -o "$local_path" || {
-#           echo "❌ Failed to fetch $file"
-#           exit 1
-#         }
-#         echo "✔️  Updated $file"
-#       }
-
-#       update_func_file core.func
-#       update_func_file error_handler.func
-#       update_func_file tools.func
-#       break
-#       ;;
-#     [Dd]*)
-#       for file in core.func error_handler.func tools.func; do
-#         local_path="$FUNC_DIR/$file"
-#         url="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/$file"
-#         remote_tmp="$(mktemp)"
-
-#         curl -fsSL "$url" -o "$remote_tmp" || continue
-
-#         if [ -f "$local_path" ]; then
-#           echo "🔍 Diff for $file:"
-#           diff -u "$local_path" "$remote_tmp" || echo "(no differences)"
-#         else
-#           echo "📦 New file $file will be installed"
-#         fi
-
-#         rm -f "$remote_tmp"
-#       done
-#       ;;
-#     *)
-#       echo "❌ Skipped updating local core files"
-#       break
-#       ;;
-#     esac
-#   done
-# else
-#   if [ "$DEVMODE" != "yes" ]; then
-#     echo "✔️  build.func unchanged → using existing local core files"
-#   fi
-# fi
-
-# if [ -n "${_COMMUNITY_SCRIPTS_LOADER:-}" ]; then
-#   return 0 2>/dev/null || exit 0
-# fi
-# _COMMUNITY_SCRIPTS_LOADER=1
-
-# # --- Step 3: always source local versions of the core files ---
-# source "$FUNC_DIR/core.func"
-# source "$FUNC_DIR/error_handler.func"
-# source "$FUNC_DIR/tools.func"
-
-# # --- Step 4: finally, source build.func directly from memory ---
-# # (no tmp file needed)
-# source <(printf "%s" "$build_content")
-
-# ------------------------------------------------------------------------------
-# Load core + error handler functions from community-scripts repo
-#
-# - Prefer curl if available, fallback to wget
-# - Load: core.func, error_handler.func, api.func
-# - Initialize error traps after loading
-# ------------------------------------------------------------------------------
-
-source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/api.func)
-
-if command -v curl >/dev/null 2>&1; then
-    source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/core.func)
-    source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/error_handler.func)
-    load_functions
-    catch_errors
-    #echo "(build.func) Loaded core.func via curl"
-elif command -v wget >/dev/null 2>&1; then
-    source <(wget -qO- https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/core.func)
-    source <(wget -qO- https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/error_handler.func)
-    load_functions
-    catch_errors
-    #echo "(build.func) Loaded core.func via wget"
-fi
-
-# ==============================================================================
-# SECTION 2: PRE-FLIGHT CHECKS & SYSTEM VALIDATION
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# maxkeys_check()
-#
-# - Reads kernel keyring limits (maxkeys, maxbytes)
-# - Checks current usage for LXC user (UID 100000)
-# - Warns if usage is close to limits and suggests sysctl tuning
-# - Exits if thresholds are exceeded
-# - https://cleveruptime.com/docs/files/proc-key-users | https://docs.kernel.org/security/keys/core.html
-# ------------------------------------------------------------------------------
-
-maxkeys_check() {
-    # Read kernel parameters
-    per_user_maxkeys=$(cat /proc/sys/kernel/keys/maxkeys 2>/dev/null || echo 0)
-    per_user_maxbytes=$(cat /proc/sys/kernel/keys/maxbytes 2>/dev/null || echo 0)
-
-    # Exit if kernel parameters are unavailable
-    if [[ "$per_user_maxkeys" -eq 0 || "$per_user_maxbytes" -eq 0 ]]; then
-        echo -e "${CROSS}${RD} Error: Unable to read kernel parameters. Ensure proper permissions.${CL}"
-        exit 1
-    fi
-
-    # Fetch key usage for user ID 100000 (typical for containers)
-    used_lxc_keys=$(awk '/100000:/ {print $2}' /proc/key-users 2>/dev/null || echo 0)
-    used_lxc_bytes=$(awk '/100000:/ {split($5, a, "/"); print a[1]}' /proc/key-users 2>/dev/null || echo 0)
-
-    # Calculate thresholds and suggested new limits
-    threshold_keys=$((per_user_maxkeys - 100))
-    threshold_bytes=$((per_user_maxbytes - 1000))
-    new_limit_keys=$((per_user_maxkeys * 2))
-    new_limit_bytes=$((per_user_maxbytes * 2))
-
-    # Check if key or byte usage is near limits
-    failure=0
-    if [[ "$used_lxc_keys" -gt "$threshold_keys" ]]; then
-        echo -e "${CROSS}${RD} Warning: Key usage is near the limit (${used_lxc_keys}/${per_user_maxkeys}).${CL}"
-        echo -e "${INFO} Suggested action: Set ${GN}kernel.keys.maxkeys=${new_limit_keys}${CL} in ${BOLD}/etc/sysctl.d/98-community-scripts.conf${CL}."
-        failure=1
-    fi
-    if [[ "$used_lxc_bytes" -gt "$threshold_bytes" ]]; then
-        echo -e "${CROSS}${RD} Warning: Key byte usage is near the limit (${used_lxc_bytes}/${per_user_maxbytes}).${CL}"
-        echo -e "${INFO} Suggested action: Set ${GN}kernel.keys.maxbytes=${new_limit_bytes}${CL} in ${BOLD}/etc/sysctl.d/98-community-scripts.conf${CL}."
-        failure=1
-    fi
-
-    # Provide next steps if issues are detected
-    if [[ "$failure" -eq 1 ]]; then
-        echo -e "${INFO} To apply changes, run: ${BOLD}service procps force-reload${CL}"
-        exit 1
-    fi
-
-    # Silent success - only show errors if they exist
-}
-
-# ==============================================================================
-# SECTION 3: CONTAINER SETUP UTILITIES
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# get_current_ip()
-#
-# - Returns current container IP depending on OS type
-# - Debian/Ubuntu: uses `hostname -I`
-# - Alpine: parses eth0 via `ip -4 addr`
-# - Returns "Unknown" if OS type cannot be determined
-# ------------------------------------------------------------------------------
-get_current_ip() {
-    if [ -f /etc/os-release ]; then
-        # Check for Debian/Ubuntu (uses hostname -I)
-        if grep -qE 'ID=debian|ID=ubuntu' /etc/os-release; then
-            CURRENT_IP=$(hostname -I | awk '{print $1}')
-        # Check for Alpine (uses ip command)
-        elif grep -q 'ID=alpine' /etc/os-release; then
-            CURRENT_IP=$(ip -4 addr show eth0 | awk '/inet / {print $2}' | cut -d/ -f1 | head -n 1)
-        else
-            CURRENT_IP="Unknown"
-        fi
-    fi
-    echo "$CURRENT_IP"
-}
-
-# ------------------------------------------------------------------------------
-# update_motd_ip()
-#
-# - Updates /etc/motd with current container IP
-# - Removes old IP entries to avoid duplicates
-# ------------------------------------------------------------------------------
-update_motd_ip() {
-    MOTD_FILE="/etc/motd"
-
-    if [ -f "$MOTD_FILE" ]; then
-        # Remove existing IP Address lines to prevent duplication
-        sed -i '/IP Address:/d' "$MOTD_FILE"
-
-        IP=$(get_current_ip)
-        # Add the new IP address
-        echo -e "${TAB}${NETWORK}${YW} IP Address: ${GN}${IP}${CL}" >>"$MOTD_FILE"
-    fi
-}
-
-# ------------------------------------------------------------------------------
-# install_ssh_keys_into_ct()
-#
-# - Installs SSH keys into container root account if SSH is enabled
-# - Uses pct push or direct input to authorized_keys
-# - Falls back to warning if no keys provided
-# ------------------------------------------------------------------------------
-install_ssh_keys_into_ct() {
-    [[ "$SSH" != "yes" ]] && return 0
-
-    if [[ -n "$SSH_KEYS_FILE" && -s "$SSH_KEYS_FILE" ]]; then
-        msg_info "Installing selected SSH keys into CT ${CTID}"
-        pct exec "$CTID" -- sh -c 'mkdir -p /root/.ssh && chmod 700 /root/.ssh' || {
-            msg_error "prepare /root/.ssh failed"
-            return 1
-        }
-        pct push "$CTID" "$SSH_KEYS_FILE" /root/.ssh/authorized_keys >/dev/null 2>&1 ||
-            pct exec "$CTID" -- sh -c "cat > /root/.ssh/authorized_keys" <"$SSH_KEYS_FILE" || {
-            msg_error "write authorized_keys failed"
-            return 1
-        }
-        pct exec "$CTID" -- sh -c 'chmod 600 /root/.ssh/authorized_keys' || true
-        msg_ok "Installed SSH keys into CT ${CTID}"
-        return 0
-    fi
-
-    # Fallback: nichts ausgewählt
-    msg_warn "No SSH keys to install (skipping)."
-    return 0
-}
-
-# ------------------------------------------------------------------------------
-# find_host_ssh_keys()
-#
-# - Scans system for available SSH keys
-# - Supports defaults (~/.ssh, /etc/ssh/authorized_keys)
-# - Returns list of files containing valid SSH public keys
-# - Sets FOUND_HOST_KEY_COUNT to number of keys found
-# ------------------------------------------------------------------------------
-find_host_ssh_keys() {
-    local re='(ssh-(rsa|ed25519)|ecdsa-sha2-nistp256|sk-(ssh-ed25519|ecdsa-sha2-nistp256))'
-    local -a files=() cand=()
-    local g="${var_ssh_import_glob:-}"
-    local total=0 f base c
-
-    shopt -s nullglob
-    if [[ -n "$g" ]]; then
-        for pat in $g; do cand+=($pat); done
-    else
-        cand+=(/root/.ssh/authorized_keys /root/.ssh/authorized_keys2)
-        cand+=(/root/.ssh/*.pub)
-        cand+=(/etc/ssh/authorized_keys /etc/ssh/authorized_keys.d/*)
-    fi
-    shopt -u nullglob
-
-    for f in "${cand[@]}"; do
-        [[ -f "$f" && -r "$f" ]] || continue
-        base="$(basename -- "$f")"
-        case "$base" in
-        known_hosts | known_hosts.* | config) continue ;;
-        id_*) [[ "$f" != *.pub ]] && continue ;;
-        esac
-
-        # CRLF safe check for host keys
-        c=$(tr -d '\r' <"$f" | awk '
-      /^[[:space:]]*#/ {next}
-      /^[[:space:]]*$/ {next}
-      {print}
-    ' | grep -E -c '"$re"' || true)
-
-        if ((c > 0)); then
-            files+=("$f")
-            total=$((total + c))
-        fi
-    done
-
-    # Fallback to /root/.ssh/authorized_keys
-    if ((${#files[@]} == 0)) && [[ -r /root/.ssh/authorized_keys ]]; then
-        if grep -E -q "$re" /root/.ssh/authorized_keys; then
-            files+=(/root/.ssh/authorized_keys)
-            total=$((total + $(grep -E -c "$re" /root/.ssh/authorized_keys || echo 0)))
-        fi
-    fi
-
-    FOUND_HOST_KEY_COUNT="$total"
-    (
-        IFS=:
-        echo "${files[*]}"
-    )
-}
-
-# ==============================================================================
-# SECTION 4: STORAGE & RESOURCE MANAGEMENT
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# _write_storage_to_vars()
-#
-# - Writes storage selection to vars file
-# - Removes old entries (commented and uncommented) to avoid duplicates
-# - Arguments: vars_file, key (var_container_storage/var_template_storage), value
-# ------------------------------------------------------------------------------
-_write_storage_to_vars() {
-    # $1 = vars_file, $2 = key (var_container_storage / var_template_storage), $3 = value
-    local vf="$1" key="$2" val="$3"
-    # remove uncommented and commented versions to avoid duplicates
-    sed -i "/^[#[:space:]]*${key}=/d" "$vf"
-    echo "${key}=${val}" >>"$vf"
-}
-
-choose_and_set_storage_for_file() {
-    # $1 = vars_file, $2 = class ('container'|'template')
-    local vf="$1" class="$2" key="" current=""
-    case "$class" in
-    container) key="var_container_storage" ;;
-    template) key="var_template_storage" ;;
-    *)
-        msg_error "Unknown storage class: $class"
-        return 1
-        ;;
-    esac
-
-    current=$(awk -F= -v k="^${key}=" '$0 ~ k {print $2; exit}' "$vf")
-
-    # If only one storage exists for the content type, auto-pick. Else always ask (your wish #4).
-    local content="rootdir"
-    [[ "$class" == "template" ]] && content="vztmpl"
-    local count
-    count=$(pvesm status -content "$content" | awk 'NR>1{print $1}' | wc -l)
-
-    if [[ "$count" -eq 1 ]]; then
-        STORAGE_RESULT=$(pvesm status -content "$content" | awk 'NR>1{print $1; exit}')
-        STORAGE_INFO=""
-    else
-        # If the current value is preselectable, we could show it, but per your requirement we always offer selection
-        select_storage "$class" || return 1
-    fi
-
-    _write_storage_to_vars "$vf" "$key" "$STORAGE_RESULT"
-
-    # Keep environment in sync for later steps (e.g. app-default save)
-    if [[ "$class" == "container" ]]; then
-        export var_container_storage="$STORAGE_RESULT"
-        export CONTAINER_STORAGE="$STORAGE_RESULT"
-    else
-        export var_template_storage="$STORAGE_RESULT"
-        export TEMPLATE_STORAGE="$STORAGE_RESULT"
-    fi
-
-    # Silent operation - no output message
-}
-
-# ==============================================================================
-# SECTION 5: CONFIGURATION & DEFAULTS MANAGEMENT
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# base_settings()
-#
-# - Defines all base/default variables for container creation
-# - Reads from environment variables (var_*)
-# - Provides fallback defaults for OS type/version
-# - App-specific values take precedence when they are HIGHER (for CPU, RAM, DISK)
-# - Sets up container type, resources, network, SSH, features, and tags
-# ------------------------------------------------------------------------------
-base_settings() {
-    # Default Settings
-    CT_TYPE=${var_unprivileged:-"1"}
-
-    # Resource allocation: App defaults take precedence if HIGHER
-    # Compare app-declared values (saved in APP_DEFAULT_*) with current var_* values
-    local final_disk="${var_disk:-4}"
-    local final_cpu="${var_cpu:-1}"
-    local final_ram="${var_ram:-1024}"
-
-    # If app declared higher values, use those instead
-    if [[ -n "${APP_DEFAULT_DISK:-}" && "${APP_DEFAULT_DISK}" =~ ^[0-9]+$ ]]; then
-        if [[ "${APP_DEFAULT_DISK}" -gt "${final_disk}" ]]; then
-            final_disk="${APP_DEFAULT_DISK}"
-        fi
-    fi
-
-    if [[ -n "${APP_DEFAULT_CPU:-}" && "${APP_DEFAULT_CPU}" =~ ^[0-9]+$ ]]; then
-        if [[ "${APP_DEFAULT_CPU}" -gt "${final_cpu}" ]]; then
-            final_cpu="${APP_DEFAULT_CPU}"
-        fi
-    fi
-
-    if [[ -n "${APP_DEFAULT_RAM:-}" && "${APP_DEFAULT_RAM}" =~ ^[0-9]+$ ]]; then
-        if [[ "${APP_DEFAULT_RAM}" -gt "${final_ram}" ]]; then
-            final_ram="${APP_DEFAULT_RAM}"
-        fi
-    fi
-
-    DISK_SIZE="${final_disk}"
-    CORE_COUNT="${final_cpu}"
-    RAM_SIZE="${final_ram}"
-    VERBOSE=${var_verbose:-"${1:-no}"}
-    PW=${var_pw:-""}
-    CT_ID=${var_ctid:-$NEXTID}
-    HN=${var_hostname:-$NSAPP}
-    BRG=${var_brg:-"vmbr0"}
-    NET=${var_net:-"dhcp"}
-    IPV6_METHOD=${var_ipv6_method:-"none"}
-    IPV6_STATIC=${var_ipv6_static:-""}
-    GATE=${var_gateway:-""}
-    APT_CACHER=${var_apt_cacher:-""}
-    APT_CACHER_IP=${var_apt_cacher_ip:-""}
-
-    # Runtime check: Verify APT cacher is reachable if configured
-    if [[ -n "$APT_CACHER_IP" && "$APT_CACHER" == "yes" ]]; then
-        if ! curl -s --connect-timeout 2 "http://${APT_CACHER_IP}:3142" >/dev/null 2>&1; then
-            msg_warn "APT Cacher configured but not reachable at ${APT_CACHER_IP}:3142"
-            msg_custom "⚠️" "${YW}" "Disabling APT Cacher for this installation"
-            APT_CACHER=""
-            APT_CACHER_IP=""
-        else
-            msg_ok "APT Cacher verified at ${APT_CACHER_IP}:3142"
-        fi
-    fi
-
-    MTU=${var_mtu:-""}
-    SD=${var_storage:-""}
-    NS=${var_ns:-""}
-    MAC=${var_mac:-""}
-    VLAN=${var_vlan:-""}
-    SSH=${var_ssh:-"no"}
-    SSH_AUTHORIZED_KEY=${var_ssh_authorized_key:-""}
-    UDHCPC_FIX=${var_udhcpc_fix:-""}
-    TAGS="community-script,${var_tags:-}"
-    ENABLE_FUSE=${var_fuse:-"${1:-no}"}
-    ENABLE_TUN=${var_tun:-"${1:-no}"}
-
-    # Since these 2 are only defined outside of default_settings function, we add a temporary fallback. TODO: To align everything, we should add these as constant variables (e.g. OSTYPE and OSVERSION), but that would currently require updating the default_settings function for all existing scripts
-    if [ -z "$var_os" ]; then
-        var_os="debian"
-    fi
-    if [ -z "$var_version" ]; then
-        var_version="12"
-    fi
-}
-
-# ------------------------------------------------------------------------------
-# load_vars_file()
-#
-# - Safe parser for KEY=VALUE lines from vars files
-# - Used by default_var_settings and app defaults loading
-# - Only loads whitelisted var_* keys
-# ------------------------------------------------------------------------------
-load_vars_file() {
-    local file="$1"
-    [ -f "$file" ] || return 0
-    msg_info "Loading defaults from ${file}"
-
-    # Allowed var_* keys
-    local VAR_WHITELIST=(
-        var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_keyctl
-        var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
-        var_net var_nesting var_ns var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
-        var_verbose var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage
-    )
-
-    # Whitelist check helper
-    _is_whitelisted() {
-        local k="$1" w
-        for w in "${VAR_WHITELIST[@]}"; do [ "$k" = "$w" ] && return 0; done
-        return 1
-    }
-
-    local line key val
-    while IFS= read -r line || [ -n "$line" ]; do
-        line="${line#"${line%%[![:space:]]*}"}"
-        line="${line%"${line##*[![:space:]]}"}"
-        [[ -z "$line" || "$line" == \#* ]] && continue
-        if [[ "$line" =~ ^([A-Za-z_][A-Za-z0-9_]*)=(.*)$ ]]; then
-            local var_key="${BASH_REMATCH[1]}"
-            local var_val="${BASH_REMATCH[2]}"
-
-            [[ "$var_key" != var_* ]] && continue
-            _is_whitelisted "$var_key" || continue
-
-            # Strip quotes
-            if [[ "$var_val" =~ ^\"(.*)\"$ ]]; then
-                var_val="${BASH_REMATCH[1]}"
-            elif [[ "$var_val" =~ ^\'(.*)\'$ ]]; then
-                var_val="${BASH_REMATCH[1]}"
-            fi
-
-            # Set only if not already exported
-            [[ -z "${!var_key+x}" ]] && export "${var_key}=${var_val}"
-        fi
-    done <"$file"
-    msg_ok "Loaded ${file}"
-}
-
-# ------------------------------------------------------------------------------
-# default_var_settings
-#
-# - Ensures /usr/local/community-scripts/default.vars exists (creates if missing)
-# - Loads var_* values from default.vars (safe parser, no source/eval)
-# - Precedence: ENV var_* > default.vars > built-in defaults
-# - Maps var_verbose → VERBOSE
-# - Calls base_settings "$VERBOSE" and echo_default
-# ------------------------------------------------------------------------------
-default_var_settings() {
-    # Allowed var_* keys (alphabetically sorted)
-    # Note: Removed var_ctid (can only exist once), var_ipv6_static (static IPs are unique)
-    local VAR_WHITELIST=(
-        var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_keyctl
-        var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
-        var_net var_nesting var_ns var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
-        var_verbose var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage
-    )
-
-    # Snapshot: environment variables (highest precedence)
-    declare -A _HARD_ENV=()
-    local _k
-    for _k in "${VAR_WHITELIST[@]}"; do
-        if printenv "$_k" >/dev/null 2>&1; then _HARD_ENV["$_k"]=1; fi
-    done
-
-    # Find default.vars location
-    local _find_default_vars
-    _find_default_vars() {
-        local f
-        for f in \
-            /usr/local/community-scripts/default.vars \
-            "$HOME/.config/community-scripts/default.vars" \
-            "./default.vars"; do
-            [ -f "$f" ] && {
-                echo "$f"
-                return 0
-            }
-        done
-        return 1
-    }
-    # Allow override of storages via env (for non-interactive use cases)
-    [ -n "${var_template_storage:-}" ] && TEMPLATE_STORAGE="$var_template_storage"
-    [ -n "${var_container_storage:-}" ] && CONTAINER_STORAGE="$var_container_storage"
-
-    # Create once, with storages already selected, no var_ctid/var_hostname lines
-    local _ensure_default_vars
-    _ensure_default_vars() {
-        _find_default_vars >/dev/null 2>&1 && return 0
-
-        local canonical="/usr/local/community-scripts/default.vars"
-        # Silent creation - no msg_info output
-        mkdir -p /usr/local/community-scripts
-
-        # Pick storages before writing the file (always ask unless only one)
-        # Create a minimal temp file to write into
-        : >"$canonical"
-
-        # Base content (no var_ctid / var_hostname here)
-        cat >"$canonical" <<'EOF'
-# Community-Scripts defaults (var_* only). Lines starting with # are comments.
-# Precedence: ENV var_* > default.vars > built-ins.
-# Keep keys alphabetically sorted.
-#
-# Supported OS types (PVE 9.x):
-#   alpine, archlinux, centos, debian, devuan, fedora, gentoo,
-#   nixos, opensuse, ubuntu, unmanaged
-#   Also: almalinux, rocky (RHEL derivatives)
-#
-# Supported architectures (PVE 9.x):
-#   amd64, arm64, armhf, i386, riscv32, riscv64
-
-# Container type
-var_unprivileged=1
-
-# Resources
-var_cpu=1
-var_disk=4
-var_ram=1024
-
-# Network
-var_brg=vmbr0
-var_net=dhcp
-var_ipv6_method=none
-# var_gateway=
-# var_vlan=
-# var_mtu=
-# var_mac=
-# var_ns=
-
-# SSH
-var_ssh=no
-# var_ssh_authorized_key=
-
-# APT cacher (optional - with example)
-# var_apt_cacher=yes
-# var_apt_cacher_ip=192.168.1.10
-
-# Features/Tags/verbosity
-var_fuse=no
-var_tun=no
-
-# Advanced Settings (Proxmox-official features)
-var_nesting=1          # Allow nesting (required for Docker/LXC in CT)
-var_keyctl=0           # Allow keyctl() - needed for Docker (systemd-networkd workaround)
-var_mknod=0            # Allow device node creation (requires kernel 5.3+, experimental)
-var_mount_fs=          # Allow specific filesystems: nfs,fuse,ext4,etc (leave empty for defaults)
-var_protection=no      # Prevent accidental deletion of container
-var_timezone=          # Container timezone (e.g. Europe/Berlin, leave empty for host timezone)
-var_tags=community-script
-var_verbose=no
-
-# Security (root PW) – empty => autologin
-# var_pw=
-EOF
-
-        # Now choose storages (always prompt unless just one exists)
-        choose_and_set_storage_for_file "$canonical" template
-        choose_and_set_storage_for_file "$canonical" container
-
-        chmod 0644 "$canonical"
-        # Silent creation - no output message
-    }
-
-    # Whitelist check
-    local _is_whitelisted_key
-    _is_whitelisted_key() {
-        local k="$1"
-        local w
-        for w in "${VAR_WHITELIST[@]}"; do [ "$k" = "$w" ] && return 0; done
-        return 1
-    }
-
-    # 1) Ensure file exists
-    _ensure_default_vars
-
-    # 2) Load file
-    local dv
-    dv="$(_find_default_vars)" || {
-        msg_error "default.vars not found after ensure step"
-        return 1
-    }
-    load_vars_file "$dv"
-
-    # 3) Map var_verbose → VERBOSE
-    if [[ -n "${var_verbose:-}" ]]; then
-        case "${var_verbose,,}" in 1 | yes | true | on) VERBOSE="yes" ;; 0 | no | false | off) VERBOSE="no" ;; *) VERBOSE="${var_verbose}" ;; esac
-    else
-        VERBOSE="no"
-    fi
-
-    # 4) Apply base settings and show summary
-    METHOD="mydefaults-global"
-    base_settings "$VERBOSE"
-    header_info
-    echo -e "${DEFAULT}${BOLD}${BL}Using User Defaults (default.vars) on node $PVEHOST_NAME${CL}"
-    echo_default
-}
-
-# ------------------------------------------------------------------------------
-# get_app_defaults_path()
-#
-# - Returns full path for app-specific defaults file
-# - Example: /usr/local/community-scripts/defaults/<app>.vars
-# ------------------------------------------------------------------------------
-
-get_app_defaults_path() {
-    local n="${NSAPP:-${APP,,}}"
-    echo "/usr/local/community-scripts/defaults/${n}.vars"
-}
-
-# ------------------------------------------------------------------------------
-# maybe_offer_save_app_defaults
-#
-# - Called after advanced_settings returned with fully chosen values.
-# - If no <nsapp>.vars exists, offers to persist current advanced settings
-#   into /usr/local/community-scripts/defaults/<nsapp>.vars
-# - Only writes whitelisted var_* keys.
-# - Extracts raw values from flags like ",gw=..." ",mtu=..." etc.
-# ------------------------------------------------------------------------------
-if ! declare -p VAR_WHITELIST >/dev/null 2>&1; then
-    # Note: Removed var_ctid (can only exist once), var_ipv6_static (static IPs are unique)
-    declare -ag VAR_WHITELIST=(
-        var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse
-        var_gateway var_hostname var_ipv6_method var_mac var_mtu
-        var_net var_ns var_pw var_ram var_tags var_tun var_unprivileged
-        var_verbose var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage
-    )
-fi
-
-# Global whitelist check function (used by _load_vars_file_to_map and others)
-_is_whitelisted_key() {
-    local k="$1"
-    local w
-    for w in "${VAR_WHITELIST[@]}"; do [ "$k" = "$w" ] && return 0; done
-    return 1
-}
-
-_sanitize_value() {
-    # Disallow Command-Substitution / Shell-Meta
-    case "$1" in
-    *'$('* | *'`'* | *';'* | *'&'* | *'<('*)
-        echo ""
-        return 0
-        ;;
-    esac
-    echo "$1"
-}
-
-# Map-Parser: read var_* from file into _VARS_IN associative array
-# Note: Main _load_vars_file() with full validation is defined in default_var_settings section
-# This simplified version is used specifically for diff operations via _VARS_IN array
-declare -A _VARS_IN
-_load_vars_file_to_map() {
-    local file="$1"
-    [ -f "$file" ] || return 0
-    _VARS_IN=() # Clear array
-    local line key val
-    while IFS= read -r line || [ -n "$line" ]; do
-        line="${line#"${line%%[![:space:]]*}"}"
-        line="${line%"${line##*[![:space:]]}"}"
-        [ -z "$line" ] && continue
-        case "$line" in
-        \#*) continue ;;
-        esac
-        key=$(printf "%s" "$line" | cut -d= -f1)
-        val=$(printf "%s" "$line" | cut -d= -f2-)
-        case "$key" in
-        var_*)
-            if _is_whitelisted_key "$key"; then
-                _VARS_IN["$key"]="$val"
-            fi
-            ;;
-        esac
-    done <"$file"
-}
-
-# Diff function for two var_* files -> produces human-readable diff list for $1 (old) vs $2 (new)
-_build_vars_diff() {
-    local oldf="$1" newf="$2"
-    local k
-    local -A OLD=() NEW=()
-    _load_vars_file_to_map "$oldf"
-    for k in "${!_VARS_IN[@]}"; do OLD["$k"]="${_VARS_IN[$k]}"; done
-    _load_vars_file_to_map "$newf"
-    for k in "${!_VARS_IN[@]}"; do NEW["$k"]="${_VARS_IN[$k]}"; done
-
-    local out
-    out+="# Diff for ${APP} (${NSAPP})\n"
-    out+="# Old: ${oldf}\n# New: ${newf}\n\n"
-
-    local found_change=0
-
-    # Changed & Removed
-    for k in "${!OLD[@]}"; do
-        if [[ -v NEW["$k"] ]]; then
-            if [[ "${OLD[$k]}" != "${NEW[$k]}" ]]; then
-                out+="~ ${k}\n    - old: ${OLD[$k]}\n    + new: ${NEW[$k]}\n"
-                found_change=1
-            fi
-        else
-            out+="- ${k}\n    - old: ${OLD[$k]}\n"
-            found_change=1
-        fi
-    done
-
-    # Added
-    for k in "${!NEW[@]}"; do
-        if [[ ! -v OLD["$k"] ]]; then
-            out+="+ ${k}\n    + new: ${NEW[$k]}\n"
-            found_change=1
-        fi
-    done
-
-    if [[ $found_change -eq 0 ]]; then
-        out+="(No differences)\n"
-    fi
-
-    printf "%b" "$out"
-}
-
-# Build a temporary <app>.vars file from current advanced settings
-_build_current_app_vars_tmp() {
-    tmpf="$(mktemp /tmp/${NSAPP:-app}.vars.new.XXXXXX)"
-
-    # NET/GW
-    _net="${NET:-}"
-    _gate=""
-    case "${GATE:-}" in
-    ,gw=*) _gate=$(echo "$GATE" | sed 's/^,gw=//') ;;
-    esac
-
-    # IPv6
-    _ipv6_method="${IPV6_METHOD:-auto}"
-    _ipv6_static=""
-    _ipv6_gateway=""
-    if [ "$_ipv6_method" = "static" ]; then
-        _ipv6_static="${IPV6_ADDR:-}"
-        _ipv6_gateway="${IPV6_GATE:-}"
-    fi
-
-    # MTU/VLAN/MAC
-    _mtu=""
-    _vlan=""
-    _mac=""
-    case "${MTU:-}" in
-    ,mtu=*) _mtu=$(echo "$MTU" | sed 's/^,mtu=//') ;;
-    esac
-    case "${VLAN:-}" in
-    ,tag=*) _vlan=$(echo "$VLAN" | sed 's/^,tag=//') ;;
-    esac
-    case "${MAC:-}" in
-    ,hwaddr=*) _mac=$(echo "$MAC" | sed 's/^,hwaddr=//') ;;
-    esac
-
-    # DNS / Searchdomain
-    _ns=""
-    _searchdomain=""
-    case "${NS:-}" in
-    -nameserver=*) _ns=$(echo "$NS" | sed 's/^-nameserver=//') ;;
-    esac
-    case "${SD:-}" in
-    -searchdomain=*) _searchdomain=$(echo "$SD" | sed 's/^-searchdomain=//') ;;
-    esac
-
-    # SSH / APT / Features
-    _ssh="${SSH:-no}"
-    _ssh_auth="${SSH_AUTHORIZED_KEY:-}"
-    _apt_cacher="${APT_CACHER:-}"
-    _apt_cacher_ip="${APT_CACHER_IP:-}"
-    _fuse="${ENABLE_FUSE:-no}"
-    _tun="${ENABLE_TUN:-no}"
-    _nesting="${ENABLE_NESTING:-1}"
-    _keyctl="${ENABLE_KEYCTL:-0}"
-    _mknod="${ENABLE_MKNOD:-0}"
-    _mount_fs="${ALLOW_MOUNT_FS:-}"
-    _protect="${PROTECT_CT:-no}"
-    _timezone="${CT_TIMEZONE:-}"
-    _tags="${TAGS:-}"
-    _verbose="${VERBOSE:-no}"
-
-    # Type / Resources / Identity
-    _unpriv="${CT_TYPE:-1}"
-    _cpu="${CORE_COUNT:-1}"
-    _ram="${RAM_SIZE:-1024}"
-    _disk="${DISK_SIZE:-4}"
-    _hostname="${HN:-$NSAPP}"
-
-    # Storage
-    _tpl_storage="${TEMPLATE_STORAGE:-${var_template_storage:-}}"
-    _ct_storage="${CONTAINER_STORAGE:-${var_container_storage:-}}"
-
-    {
-        echo "# App-specific defaults for ${APP} (${NSAPP})"
-        echo "# Generated on $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
-        echo
-
-        echo "var_unprivileged=$(_sanitize_value "$_unpriv")"
-        echo "var_cpu=$(_sanitize_value "$_cpu")"
-        echo "var_ram=$(_sanitize_value "$_ram")"
-        echo "var_disk=$(_sanitize_value "$_disk")"
-
-        [ -n "${BRG:-}" ] && echo "var_brg=$(_sanitize_value "$BRG")"
-        [ -n "$_net" ] && echo "var_net=$(_sanitize_value "$_net")"
-        [ -n "$_gate" ] && echo "var_gateway=$(_sanitize_value "$_gate")"
-        [ -n "$_mtu" ] && echo "var_mtu=$(_sanitize_value "$_mtu")"
-        [ -n "$_vlan" ] && echo "var_vlan=$(_sanitize_value "$_vlan")"
-        [ -n "$_mac" ] && echo "var_mac=$(_sanitize_value "$_mac")"
-        [ -n "$_ns" ] && echo "var_ns=$(_sanitize_value "$_ns")"
-
-        [ -n "$_ipv6_method" ] && echo "var_ipv6_method=$(_sanitize_value "$_ipv6_method")"
-        # var_ipv6_static removed - static IPs are unique, can't be default
-
-        [ -n "$_ssh" ] && echo "var_ssh=$(_sanitize_value "$_ssh")"
-        [ -n "$_ssh_auth" ] && echo "var_ssh_authorized_key=$(_sanitize_value "$_ssh_auth")"
-
-        [ -n "$_apt_cacher" ] && echo "var_apt_cacher=$(_sanitize_value "$_apt_cacher")"
-        [ -n "$_apt_cacher_ip" ] && echo "var_apt_cacher_ip=$(_sanitize_value "$_apt_cacher_ip")"
-
-        [ -n "$_fuse" ] && echo "var_fuse=$(_sanitize_value "$_fuse")"
-        [ -n "$_tun" ] && echo "var_tun=$(_sanitize_value "$_tun")"
-        [ -n "$_nesting" ] && echo "var_nesting=$(_sanitize_value "$_nesting")"
-        [ -n "$_keyctl" ] && echo "var_keyctl=$(_sanitize_value "$_keyctl")"
-        [ -n "$_mknod" ] && echo "var_mknod=$(_sanitize_value "$_mknod")"
-        [ -n "$_mount_fs" ] && echo "var_mount_fs=$(_sanitize_value "$_mount_fs")"
-        [ -n "$_protect" ] && echo "var_protection=$(_sanitize_value "$_protect")"
-        [ -n "$_timezone" ] && echo "var_timezone=$(_sanitize_value "$_timezone")"
-        [ -n "$_tags" ] && echo "var_tags=$(_sanitize_value "$_tags")"
-        [ -n "$_verbose" ] && echo "var_verbose=$(_sanitize_value "$_verbose")"
-
-        [ -n "$_hostname" ] && echo "var_hostname=$(_sanitize_value "$_hostname")"
-        [ -n "$_searchdomain" ] && echo "var_searchdomain=$(_sanitize_value "$_searchdomain")"
-
-        [ -n "$_tpl_storage" ] && echo "var_template_storage=$(_sanitize_value "$_tpl_storage")"
-        [ -n "$_ct_storage" ] && echo "var_container_storage=$(_sanitize_value "$_ct_storage")"
-    } >"$tmpf"
-
-    echo "$tmpf"
-}
-
-# ------------------------------------------------------------------------------
-# maybe_offer_save_app_defaults()
-#
-# - Called after advanced_settings()
-# - Offers to save current values as app defaults if not existing
-# - If file exists: shows diff and allows Update, Keep, View Diff, or Cancel
-# ------------------------------------------------------------------------------
-maybe_offer_save_app_defaults() {
-    local app_vars_path
-    app_vars_path="$(get_app_defaults_path)"
-
-    # always build from current settings
-    local new_tmp diff_tmp
-    new_tmp="$(_build_current_app_vars_tmp)"
-    diff_tmp="$(mktemp -p /tmp "${NSAPP:-app}.vars.diff.XXXXXX")"
-
-    # 1) if no file → offer to create
-    if [[ ! -f "$app_vars_path" ]]; then
-        if whiptail --backtitle "[dev] Proxmox VE Helper Scripts" \
-            --yesno "Save these advanced settings as defaults for ${APP}?\n\nThis will create:\n${app_vars_path}" 12 72; then
-            mkdir -p "$(dirname "$app_vars_path")"
-            install -m 0644 "$new_tmp" "$app_vars_path"
-            msg_ok "Saved app defaults: ${app_vars_path}"
-        fi
-        rm -f "$new_tmp" "$diff_tmp"
-        return 0
-    fi
-
-    # 2) if file exists → build diff
-    _build_vars_diff "$app_vars_path" "$new_tmp" >"$diff_tmp"
-
-    # if no differences → do nothing
-    if grep -q "^(No differences)$" "$diff_tmp"; then
-        rm -f "$new_tmp" "$diff_tmp"
-        return 0
-    fi
-
-    # 3) if file exists → show menu with default selection "Update Defaults"
-    local app_vars_file
-    app_vars_file="$(basename "$app_vars_path")"
-
-    while true; do
-        local sel
-        sel="$(whiptail --backtitle "[dev] Proxmox VE Helper Scripts" \
-            --title "APP DEFAULTS – ${APP}" \
-            --menu "Differences detected. What do you want to do?" 20 78 10 \
-            "Update Defaults" "Write new values to ${app_vars_file}" \
-            "Keep Current" "Keep existing defaults (no changes)" \
-            "View Diff" "Show a detailed diff" \
-            "Cancel" "Abort without changes" \
-            --default-item "Update Defaults" \
-            3>&1 1>&2 2>&3)" || { sel="Cancel"; }
-
-        case "$sel" in
-        "Update Defaults")
-            install -m 0644 "$new_tmp" "$app_vars_path"
-            msg_ok "Updated app defaults: ${app_vars_path}"
-            break
-            ;;
-        "Keep Current")
-            msg_custom "ℹ️" "${BL}" "Keeping current app defaults: ${app_vars_path}"
-            break
-            ;;
-        "View Diff")
-            whiptail --backtitle "[dev] Proxmox VE Helper Scripts" \
-                --title "Diff – ${APP}" \
-                --scrolltext --textbox "$diff_tmp" 25 100
-            ;;
-        "Cancel" | *)
-            msg_custom "🚫" "${YW}" "Canceled. No changes to app defaults."
-            break
-            ;;
-        esac
-    done
-
-    rm -f "$new_tmp" "$diff_tmp"
-}
-
-ensure_storage_selection_for_vars_file() {
-    local vf="$1"
-
-    # Read stored values (if any)
-    local tpl ct
-    tpl=$(grep -E '^var_template_storage=' "$vf" | cut -d= -f2-)
-    ct=$(grep -E '^var_container_storage=' "$vf" | cut -d= -f2-)
-
-    if [[ -n "$tpl" && -n "$ct" ]]; then
-        TEMPLATE_STORAGE="$tpl"
-        CONTAINER_STORAGE="$ct"
-        return 0
-    fi
-
-    choose_and_set_storage_for_file "$vf" template
-    choose_and_set_storage_for_file "$vf" container
-
-    # Silent operation - no output message
-}
-
-ensure_global_default_vars_file() {
-    local vars_path="/usr/local/community-scripts/default.vars"
-    if [[ ! -f "$vars_path" ]]; then
-        mkdir -p "$(dirname "$vars_path")"
-        touch "$vars_path"
-    fi
-    echo "$vars_path"
-}
-
-# ==============================================================================
-# SECTION 6: ADVANCED INTERACTIVE CONFIGURATION
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# advanced_settings()
-#
-# - Interactive wizard-style configuration with BACK navigation
-# - State-machine approach: each step can go forward or backward
-# - Cancel at Step 1 = Exit Script, Cancel at other steps = Go Back
-# - Allows user to customize all container settings
-# ------------------------------------------------------------------------------
-advanced_settings() {
-    # Enter alternate screen buffer to prevent flicker between dialogs
-    tput smcup 2>/dev/null || true
-    trap 'tput rmcup 2>/dev/null || true' RETURN
-
-    # Initialize defaults
-    TAGS="community-script;${var_tags:-}"
-    local STEP=1
-    local MAX_STEP=19
-
-    # Store values for back navigation
-    local _ct_type="${CT_TYPE:-1}"
-    local _pw=""
-    local _pw_display="Automatic Login"
-    local _ct_id="$NEXTID"
-    local _hostname="$NSAPP"
-    local _disk_size="$var_disk"
-    local _core_count="$var_cpu"
-    local _ram_size="$var_ram"
-    local _bridge="vmbr0"
-    local _net="dhcp"
-    local _gate=""
-    local _ipv6_method="auto"
-    local _ipv6_addr=""
-    local _ipv6_gate=""
-    local _apt_cacher_ip=""
-    local _mtu=""
-    local _sd=""
-    local _ns=""
-    local _mac=""
-    local _vlan=""
-    local _tags="$TAGS"
-    local _enable_fuse="no"
-    local _verbose="no"
-    local _enable_keyctl="0"
-    local _enable_mknod="0"
-    local _mount_fs=""
-    local _protect_ct="no"
-    local _ct_timezone=""
-
-    # Helper to show current progress
-    show_progress() {
-        local current=$1
-        local total=$MAX_STEP
-        echo -e "\n${INFO}${BOLD}${DGN}Step $current of $total${CL}"
-    }
-
-    # Detect available bridges (do this once)
-    local BRIDGES=""
-    local BRIDGE_MENU_OPTIONS=()
-    _detect_bridges() {
-        IFACE_FILEPATH_LIST="/etc/network/interfaces"$'\n'$(find "/etc/network/interfaces.d/" -type f 2>/dev/null)
-        BRIDGES=""
-        local OLD_IFS=$IFS
-        IFS=$'\n'
-        for iface_filepath in ${IFACE_FILEPATH_LIST}; do
-            local iface_indexes_tmpfile=$(mktemp -q -u '.iface-XXXX')
-            (grep -Pn '^\s*iface' "${iface_filepath}" 2>/dev/null | cut -d':' -f1 && wc -l "${iface_filepath}" 2>/dev/null | cut -d' ' -f1) | awk 'FNR==1 {line=$0; next} {print line":"$0-1; line=$0}' >"${iface_indexes_tmpfile}" 2>/dev/null || true
-            if [ -f "${iface_indexes_tmpfile}" ]; then
-                while read -r pair; do
-                    local start=$(echo "${pair}" | cut -d':' -f1)
-                    local end=$(echo "${pair}" | cut -d':' -f2)
-                    if awk "NR >= ${start} && NR <= ${end}" "${iface_filepath}" 2>/dev/null | grep -qP '^\s*(bridge[-_](ports|stp|fd|vlan-aware|vids)|ovs_type\s+OVSBridge)\b'; then
-                        local iface_name=$(sed "${start}q;d" "${iface_filepath}" | awk '{print $2}')
-                        BRIDGES="${iface_name}"$'\n'"${BRIDGES}"
-                    fi
-                done <"${iface_indexes_tmpfile}"
-                rm -f "${iface_indexes_tmpfile}"
-            fi
-        done
-        IFS=$OLD_IFS
-        BRIDGES=$(echo "$BRIDGES" | grep -v '^\s*$' | sort | uniq)
-
-        # Build bridge menu
-        BRIDGE_MENU_OPTIONS=()
-        if [[ -n "$BRIDGES" ]]; then
-            while IFS= read -r bridge; do
-                if [[ -n "$bridge" ]]; then
-                    local description=$(grep -A 10 "iface $bridge" /etc/network/interfaces 2>/dev/null | grep '^#' | head -n1 | sed 's/^#\s*//')
-                    BRIDGE_MENU_OPTIONS+=("$bridge" "${description:- }")
-                fi
-            done <<<"$BRIDGES"
-        fi
-    }
-    _detect_bridges
-
-    # Main wizard loop
-    while [ $STEP -le $MAX_STEP ]; do
-        case $STEP in
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 1: Container Type
-        # ═══════════════════════════════════════════════════════════════════════════
-        1)
-            local default_on="ON"
-            local default_off="OFF"
-            [[ "$_ct_type" == "0" ]] && {
-                default_on="OFF"
-                default_off="ON"
-            }
-
-            if result=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "CONTAINER TYPE" \
-                --ok-button "Next" --cancel-button "Exit" \
-                --radiolist "\nChoose container type:\n\nUse SPACE to select, ENTER to confirm." 14 58 2 \
-                "1" "Unprivileged (recommended)" $default_on \
-                "0" "Privileged" $default_off \
-                3>&1 1>&2 2>&3); then
-                [[ -n "$result" ]] && _ct_type="$result"
-                ((STEP++))
-            else
-                exit_script
-            fi
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 2: Root Password
-        # ═══════════════════════════════════════════════════════════════════════════
-        2)
-            if PW1=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "ROOT PASSWORD" \
-                --ok-button "Next" --cancel-button "Back" \
-                --passwordbox "\nSet Root Password (needed for root ssh access)\n\nLeave blank for automatic login (no password)" 12 58 \
-                3>&1 1>&2 2>&3); then
-
-                if [[ -z "$PW1" ]]; then
-                    _pw=""
-                    _pw_display="Automatic Login"
-                    ((STEP++))
-                elif [[ "$PW1" == *" "* ]]; then
-                    whiptail --msgbox "Password cannot contain spaces." 8 58
-                elif ((${#PW1} < 5)); then
-                    whiptail --msgbox "Password must be at least 5 characters." 8 58
-                else
-                    # Verify password
-                    if PW2=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                        --title "PASSWORD VERIFICATION" \
-                        --ok-button "Confirm" --cancel-button "Back" \
-                        --passwordbox "\nVerify Root Password" 10 58 \
-                        3>&1 1>&2 2>&3); then
-                        if [[ "$PW1" == "$PW2" ]]; then
-                            _pw="-password $PW1"
-                            _pw_display="********"
-                            ((STEP++))
-                        else
-                            whiptail --msgbox "Passwords do not match. Please try again." 8 58
-                        fi
-                    else
-                        ((STEP--))
-                    fi
-                fi
-            else
-                ((STEP--))
-            fi
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 3: Container ID
-        # ═══════════════════════════════════════════════════════════════════════════
-        3)
-            if result=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "CONTAINER ID" \
-                --ok-button "Next" --cancel-button "Back" \
-                --inputbox "\nSet Container ID" 10 58 "$_ct_id" \
-                3>&1 1>&2 2>&3); then
-                _ct_id="${result:-$NEXTID}"
-                ((STEP++))
-            else
-                ((STEP--))
-            fi
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 4: Hostname
-        # ═══════════════════════════════════════════════════════════════════════════
-        4)
-            if result=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "HOSTNAME" \
-                --ok-button "Next" --cancel-button "Back" \
-                --inputbox "\nSet Hostname (lowercase, alphanumeric, hyphens only)" 10 58 "$_hostname" \
-                3>&1 1>&2 2>&3); then
-                local hn_test="${result:-$NSAPP}"
-                hn_test=$(echo "${hn_test,,}" | tr -d ' ')
-                if [[ "$hn_test" =~ ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ ]]; then
-                    _hostname="$hn_test"
-                    ((STEP++))
-                else
-                    whiptail --msgbox "Invalid hostname: '$hn_test'\n\nOnly lowercase letters, digits and hyphens are allowed." 10 58
-                fi
-            else
-                ((STEP--))
-            fi
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 5: Disk Size
-        # ═══════════════════════════════════════════════════════════════════════════
-        5)
-            if result=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "DISK SIZE" \
-                --ok-button "Next" --cancel-button "Back" \
-                --inputbox "\nSet Disk Size in GB" 10 58 "$_disk_size" \
-                3>&1 1>&2 2>&3); then
-                local disk_test="${result:-$var_disk}"
-                if [[ "$disk_test" =~ ^[1-9][0-9]*$ ]]; then
-                    _disk_size="$disk_test"
-                    ((STEP++))
-                else
-                    whiptail --msgbox "Disk size must be a positive integer!" 8 58
-                fi
-            else
-                ((STEP--))
-            fi
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 6: CPU Cores
-        # ═══════════════════════════════════════════════════════════════════════════
-        6)
-            if result=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "CPU CORES" \
-                --ok-button "Next" --cancel-button "Back" \
-                --inputbox "\nAllocate CPU Cores" 10 58 "$_core_count" \
-                3>&1 1>&2 2>&3); then
-                local cpu_test="${result:-$var_cpu}"
-                if [[ "$cpu_test" =~ ^[1-9][0-9]*$ ]]; then
-                    _core_count="$cpu_test"
-                    ((STEP++))
-                else
-                    whiptail --msgbox "CPU core count must be a positive integer!" 8 58
-                fi
-            else
-                ((STEP--))
-            fi
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 7: RAM Size
-        # ═══════════════════════════════════════════════════════════════════════════
-        7)
-            if result=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "RAM SIZE" \
-                --ok-button "Next" --cancel-button "Back" \
-                --inputbox "\nAllocate RAM in MiB" 10 58 "$_ram_size" \
-                3>&1 1>&2 2>&3); then
-                local ram_test="${result:-$var_ram}"
-                if [[ "$ram_test" =~ ^[1-9][0-9]*$ ]]; then
-                    _ram_size="$ram_test"
-                    ((STEP++))
-                else
-                    whiptail --msgbox "RAM size must be a positive integer!" 8 58
-                fi
-            else
-                ((STEP--))
-            fi
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 8: Network Bridge
-        # ═══════════════════════════════════════════════════════════════════════════
-        8)
-            if [[ ${#BRIDGE_MENU_OPTIONS[@]} -eq 0 ]]; then
-                _bridge="vmbr0"
-                ((STEP++))
-            else
-                if result=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                    --title "NETWORK BRIDGE" \
-                    --ok-button "Next" --cancel-button "Back" \
-                    --menu "\nSelect network bridge:" 16 58 6 \
-                    "${BRIDGE_MENU_OPTIONS[@]}" \
-                    3>&1 1>&2 2>&3); then
-                    _bridge="${result:-vmbr0}"
-                    ((STEP++))
-                else
-                    ((STEP--))
-                fi
-            fi
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 9: IPv4 Configuration
-        # ═══════════════════════════════════════════════════════════════════════════
-        9)
-            if result=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "IPv4 CONFIGURATION" \
-                --ok-button "Next" --cancel-button "Back" \
-                --menu "\nSelect IPv4 Address Assignment:" 14 60 2 \
-                "dhcp" "Automatic (DHCP, recommended)" \
-                "static" "Static (manual entry)" \
-                3>&1 1>&2 2>&3); then
-
-                if [[ "$result" == "static" ]]; then
-                    # Get static IP
-                    local static_ip
-                    if static_ip=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                        --title "STATIC IPv4 ADDRESS" \
-                        --ok-button "Next" --cancel-button "Back" \
-                        --inputbox "\nEnter Static IPv4 CIDR Address\n(e.g. 192.168.1.100/24)" 12 58 "" \
-                        3>&1 1>&2 2>&3); then
-                        if [[ "$static_ip" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$ ]]; then
-                            # Get gateway
-                            local gateway_ip
-                            if gateway_ip=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                                --title "GATEWAY IP" \
-                                --ok-button "Next" --cancel-button "Back" \
-                                --inputbox "\nEnter Gateway IP address" 10 58 "" \
-                                3>&1 1>&2 2>&3); then
-                                if [[ "$gateway_ip" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
-                                    _net="$static_ip"
-                                    _gate=",gw=$gateway_ip"
-                                    ((STEP++))
-                                else
-                                    whiptail --msgbox "Invalid Gateway IP format." 8 58
-                                fi
-                            fi
-                        else
-                            whiptail --msgbox "Invalid IPv4 CIDR format.\nExample: 192.168.1.100/24" 8 58
-                        fi
-                    fi
-                else
-                    _net="dhcp"
-                    _gate=""
-                    ((STEP++))
-                fi
-            else
-                ((STEP--))
-            fi
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 10: IPv6 Configuration
-        # ═══════════════════════════════════════════════════════════════════════════
-        10)
-            if result=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "IPv6 CONFIGURATION" \
-                --ok-button "Next" --cancel-button "Back" \
-                --menu "\nSelect IPv6 Address Management:" 16 70 5 \
-                "auto" "SLAAC/AUTO (recommended) - Dynamic IPv6 from network" \
-                "dhcp" "DHCPv6 - DHCP-assigned IPv6 address" \
-                "static" "Static - Manual IPv6 address configuration" \
-                "none" "None - No IPv6 assignment (most containers)" \
-                "disable" "Fully Disabled - (breaks some services)" \
-                3>&1 1>&2 2>&3); then
-
-                _ipv6_method="$result"
-                case "$result" in
-                static)
-                    local ipv6_addr
-                    if ipv6_addr=$(whiptail --backtitle "Proxmox VE Helper Scripts" \
-                        --title "STATIC IPv6 ADDRESS" \
-                        --inputbox "\nEnter IPv6 CIDR address\n(e.g. 2001:db8::1/64)" 12 58 "" \
-                        3>&1 1>&2 2>&3); then
-                        if [[ "$ipv6_addr" =~ ^([0-9a-fA-F:]+:+)+[0-9a-fA-F]+(/[0-9]{1,3})$ ]]; then
-                            _ipv6_addr="$ipv6_addr"
-                            # Optional gateway
-                            _ipv6_gate=$(whiptail --backtitle "Proxmox VE Helper Scripts" \
-                                --title "IPv6 GATEWAY" \
-                                --inputbox "\nEnter IPv6 gateway (optional, leave blank for none)" 10 58 "" \
-                                3>&1 1>&2 2>&3) || true
-                            ((STEP++))
-                        else
-                            whiptail --msgbox "Invalid IPv6 CIDR format." 8 58
-                        fi
-                    fi
-                    ;;
-                dhcp)
-                    _ipv6_addr="dhcp"
-                    _ipv6_gate=""
-                    ((STEP++))
-                    ;;
-                disable)
-                    _ipv6_addr=""
-                    _ipv6_gate=""
-                    ((STEP++))
-                    ;;
-                none)
-                    _ipv6_addr="none"
-                    _ipv6_gate=""
-                    ((STEP++))
-                    ;;
-                *)
-                    _ipv6_addr=""
-                    _ipv6_gate=""
-                    ((STEP++))
-                    ;;
-                esac
-            else
-                ((STEP--))
-            fi
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 11: MTU Size
-        # ═══════════════════════════════════════════════════════════════════════════
-        11)
-            if result=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "MTU SIZE" \
-                --ok-button "Next" --cancel-button "Back" \
-                --inputbox "\nSet Interface MTU Size\n(leave blank for default 1500)" 12 58 "" \
-                3>&1 1>&2 2>&3); then
-                _mtu="$result"
-                ((STEP++))
-            else
-                ((STEP--))
-            fi
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 12: DNS Search Domain
-        # ═══════════════════════════════════════════════════════════════════════════
-        12)
-            if result=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "DNS SEARCH DOMAIN" \
-                --ok-button "Next" --cancel-button "Back" \
-                --inputbox "\nSet DNS Search Domain\n(leave blank to use host setting)" 12 58 "" \
-                3>&1 1>&2 2>&3); then
-                _sd="$result"
-                ((STEP++))
-            else
-                ((STEP--))
-            fi
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 13: DNS Server
-        # ═══════════════════════════════════════════════════════════════════════════
-        13)
-            if result=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "DNS SERVER" \
-                --ok-button "Next" --cancel-button "Back" \
-                --inputbox "\nSet DNS Server IP\n(leave blank to use host setting)" 12 58 "" \
-                3>&1 1>&2 2>&3); then
-                _ns="$result"
-                ((STEP++))
-            else
-                ((STEP--))
-            fi
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 14: MAC Address
-        # ═══════════════════════════════════════════════════════════════════════════
-        14)
-            if result=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "MAC ADDRESS" \
-                --ok-button "Next" --cancel-button "Back" \
-                --inputbox "\nSet MAC Address\n(leave blank for auto-generated)" 12 58 "" \
-                3>&1 1>&2 2>&3); then
-                _mac="$result"
-                ((STEP++))
-            else
-                ((STEP--))
-            fi
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 15: VLAN Tag
-        # ═══════════════════════════════════════════════════════════════════════════
-        15)
-            if result=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "VLAN TAG" \
-                --ok-button "Next" --cancel-button "Back" \
-                --inputbox "\nSet VLAN Tag\n(leave blank for no VLAN)" 12 58 "" \
-                3>&1 1>&2 2>&3); then
-                _vlan="$result"
-                ((STEP++))
-            else
-                ((STEP--))
-            fi
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 16: Tags
-        # ═══════════════════════════════════════════════════════════════════════════
-        16)
-            if result=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "CONTAINER TAGS" \
-                --ok-button "Next" --cancel-button "Back" \
-                --inputbox "\nSet Custom Tags (semicolon-separated)\n(remove all for no tags)" 12 58 "$_tags" \
-                3>&1 1>&2 2>&3); then
-                _tags="${result:-;}"
-                _tags=$(echo "$_tags" | tr -d '[:space:]')
-                ((STEP++))
-            else
-                ((STEP--))
-            fi
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 17: SSH Settings
-        # ═══════════════════════════════════════════════════════════════════════════
-        17)
-            configure_ssh_settings
-            # configure_ssh_settings handles its own flow, always advance
-            ((STEP++))
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 18: FUSE & Verbose Mode
-        # ═══════════════════════════════════════════════════════════════════════════
-        18)
-            if whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "FUSE SUPPORT" \
-                --ok-button "Next" --cancel-button "Back" \
-                --defaultno \
-                --yesno "\nEnable FUSE support?\n\nRequired for: rclone, mergerfs, AppImage, etc." 12 58; then
-                _enable_fuse="yes"
-            else
-                if [ $? -eq 1 ]; then
-                    _enable_fuse="no"
-                else
-                    ((STEP--))
-                    continue
-                fi
-            fi
-
-            if whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "VERBOSE MODE" \
-                --defaultno \
-                --yesno "\nEnable Verbose Mode?\n\nShows detailed output during installation." 12 58; then
-                _verbose="yes"
-            else
-                _verbose="no"
-            fi
-            ((STEP++))
-            ;;
-
-        # ═══════════════════════════════════════════════════════════════════════════
-        # STEP 19: Confirmation
-        # ═══════════════════════════════════════════════════════════════════════════
-        19)
-            # Build summary
-            local ct_type_desc="Unprivileged"
-            [[ "$_ct_type" == "0" ]] && ct_type_desc="Privileged"
-
-            local summary="Container Type: $ct_type_desc
-Container ID: $_ct_id
-Hostname: $_hostname
-
-Resources:
-  Disk: ${_disk_size} GB
-  CPU: $_core_count cores
-  RAM: $_ram_size MiB
-
-Network:
-  Bridge: $_bridge
-  IPv4: $_net
-  IPv6: $_ipv6_method
-
-Options:
-  FUSE: $_enable_fuse
-  Verbose: $_verbose"
-
-            if whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-                --title "CONFIRM SETTINGS" \
-                --ok-button "Create LXC" --cancel-button "Back" \
-                --yesno "$summary\n\nCreate ${APP} LXC with these settings?" 26 58; then
-                ((STEP++))
-            else
-                ((STEP--))
-            fi
-            ;;
-        esac
-    done
-
-    # ═══════════════════════════════════════════════════════════════════════════
-    # Apply all collected values to global variables
-    # ═══════════════════════════════════════════════════════════════════════════
-    CT_TYPE="$_ct_type"
-    PW="$_pw"
-    CT_ID="$_ct_id"
-    HN="$_hostname"
-    DISK_SIZE="$_disk_size"
-    CORE_COUNT="$_core_count"
-    RAM_SIZE="$_ram_size"
-    BRG="$_bridge"
-    NET="$_net"
-    GATE="$_gate"
-    IPV6_METHOD="$_ipv6_method"
-    IPV6_ADDR="$_ipv6_addr"
-    IPV6_GATE="$_ipv6_gate"
-    TAGS="$_tags"
-    ENABLE_FUSE="$_enable_fuse"
-    VERBOSE="$_verbose"
-
-    # Format optional values
-    [[ -n "$_mtu" ]] && MTU=",mtu=$_mtu" || MTU=""
-    [[ -n "$_sd" ]] && SD="-searchdomain=$_sd" || SD=""
-    [[ -n "$_ns" ]] && NS="-nameserver=$_ns" || NS=""
-    [[ -n "$_mac" ]] && MAC=",hwaddr=$_mac" || MAC=""
-    [[ -n "$_vlan" ]] && VLAN=",tag=$_vlan" || VLAN=""
-
-    # Alpine UDHCPC fix
-    if [ "$var_os" == "alpine" ] && [ "$NET" == "dhcp" ] && [ -n "$_ns" ]; then
-        UDHCPC_FIX="yes"
-    else
-        UDHCPC_FIX="no"
-    fi
-    export UDHCPC_FIX
-    export SSH_KEYS_FILE
-
-    # Display final summary
-    echo -e "\n${INFO}${BOLD}${DGN}PVE Version ${PVEVERSION} (Kernel: ${KERNEL_VERSION})${CL}"
-    echo -e "${OS}${BOLD}${DGN}Operating System: ${BGN}$var_os${CL}"
-    echo -e "${OSVERSION}${BOLD}${DGN}Version: ${BGN}$var_version${CL}"
-    echo -e "${CONTAINERTYPE}${BOLD}${DGN}Container Type: ${BGN}$([ "$CT_TYPE" == "1" ] && echo "Unprivileged" || echo "Privileged")${CL}"
-    echo -e "${CONTAINERID}${BOLD}${DGN}Container ID: ${BGN}$CT_ID${CL}"
-    echo -e "${HOSTNAME}${BOLD}${DGN}Hostname: ${BGN}$HN${CL}"
-    echo -e "${DISKSIZE}${BOLD}${DGN}Disk Size: ${BGN}${DISK_SIZE} GB${CL}"
-    echo -e "${CPUCORE}${BOLD}${DGN}CPU Cores: ${BGN}$CORE_COUNT${CL}"
-    echo -e "${RAMSIZE}${BOLD}${DGN}RAM Size: ${BGN}${RAM_SIZE} MiB${CL}"
-    echo -e "${BRIDGE}${BOLD}${DGN}Bridge: ${BGN}$BRG${CL}"
-    echo -e "${NETWORK}${BOLD}${DGN}IPv4: ${BGN}$NET${CL}"
-    echo -e "${NETWORK}${BOLD}${DGN}IPv6: ${BGN}$IPV6_METHOD${CL}"
-    echo -e "${FUSE}${BOLD}${DGN}FUSE Support: ${BGN}$ENABLE_FUSE${CL}"
-    echo -e "${SEARCH}${BOLD}${DGN}Verbose Mode: ${BGN}$VERBOSE${CL}"
-    echo -e "${CREATING}${BOLD}${RD}Creating a ${APP} LXC using the above advanced settings${CL}"
-}
-
-# ==============================================================================
-# SECTION 7: USER INTERFACE & DIAGNOSTICS
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# diagnostics_check()
-#
-# - Ensures diagnostics config file exists at /usr/local/community-scripts/diagnostics
-# - Asks user whether to send anonymous diagnostic data
-# - Saves DIAGNOSTICS=yes/no in the config file
-# - Creates file if missing with default DIAGNOSTICS=yes
-# - Reads current diagnostics setting from file
-# - Sets global DIAGNOSTICS variable for API telemetry opt-in/out
-# ------------------------------------------------------------------------------
-diagnostics_check() {
-    if ! [ -d "/usr/local/community-scripts" ]; then
-        mkdir -p /usr/local/community-scripts
-    fi
-
-    if ! [ -f "/usr/local/community-scripts/diagnostics" ]; then
-        if (whiptail --backtitle "[dev] Proxmox VE Helper Scripts" --title "DIAGNOSTICS" --yesno "Send Diagnostics of LXC Installation?\n\n(This only transmits data without user data, just RAM, CPU, LXC name, ...)" 10 58); then
-            cat <<EOF >/usr/local/community-scripts/diagnostics
-DIAGNOSTICS=yes
-
-#This file is used to store the diagnostics settings for the Community-Scripts API.
-#https://github.com/community-scripts/ProxmoxVED/discussions/1836
-#Your diagnostics will be sent to the Community-Scripts API for troubleshooting/statistical purposes.
-#You can review the data at https://community-scripts.github.io/ProxmoxVE/data
-#If you do not wish to send diagnostics, please set the variable 'DIAGNOSTICS' to "no" in /usr/local/community-scripts/diagnostics, or use the menue.
-#This will disable the diagnostics feature.
-#To send diagnostics, set the variable 'DIAGNOSTICS' to "yes" in /usr/local/community-scripts/diagnostics, or use the menue.
-#This will enable the diagnostics feature.
-#The following information will be sent:
-#"disk_size"
-#"core_count"
-#"ram_size"
-#"os_type"
-#"os_version"
-#"nsapp"
-#"method"
-#"pve_version"
-#"status"
-#If you have any concerns, please review the source code at /misc/build.func
-EOF
-            DIAGNOSTICS="yes"
-        else
-            cat <<EOF >/usr/local/community-scripts/diagnostics
-DIAGNOSTICS=no
-
-#This file is used to store the diagnostics settings for the Community-Scripts API.
-#https://github.com/community-scripts/ProxmoxVED/discussions/1836
-#Your diagnostics will be sent to the Community-Scripts API for troubleshooting/statistical purposes.
-#You can review the data at https://community-scripts.github.io/ProxmoxVE/data
-#If you do not wish to send diagnostics, please set the variable 'DIAGNOSTICS' to "no" in /usr/local/community-scripts/diagnostics, or use the menue.
-#This will disable the diagnostics feature.
-#To send diagnostics, set the variable 'DIAGNOSTICS' to "yes" in /usr/local/community-scripts/diagnostics, or use the menue.
-#This will enable the diagnostics feature.
-#The following information will be sent:
-#"disk_size"
-#"core_count"
-#"ram_size"
-#"os_type"
-#"os_version"
-#"nsapp"
-#"method"
-#"pve_version"
-#"status"
-#If you have any concerns, please review the source code at /misc/build.func
-EOF
-            DIAGNOSTICS="no"
-        fi
-    else
-        DIAGNOSTICS=$(awk -F '=' '/^DIAGNOSTICS/ {print $2}' /usr/local/community-scripts/diagnostics)
-
-    fi
-}
-
-diagnostics_menu() {
-    if [ "${DIAGNOSTICS:-no}" = "yes" ]; then
-        if whiptail --backtitle "[dev] Proxmox VE Helper Scripts" \
-            --title "DIAGNOSTIC SETTINGS" \
-            --yesno "Send Diagnostics?\n\nCurrent: ${DIAGNOSTICS}" 10 58 \
-            --yes-button "No" --no-button "Back"; then
-            DIAGNOSTICS="no"
-            sed -i 's/^DIAGNOSTICS=.*/DIAGNOSTICS=no/' /usr/local/community-scripts/diagnostics
-            whiptail --msgbox "Diagnostics set to ${DIAGNOSTICS}." 8 58
-        fi
-    else
-        if whiptail --backtitle "[dev] Proxmox VE Helper Scripts" \
-            --title "DIAGNOSTIC SETTINGS" \
-            --yesno "Send Diagnostics?\n\nCurrent: ${DIAGNOSTICS}" 10 58 \
-            --yes-button "Yes" --no-button "Back"; then
-            DIAGNOSTICS="yes"
-            sed -i 's/^DIAGNOSTICS=.*/DIAGNOSTICS=yes/' /usr/local/community-scripts/diagnostics
-            whiptail --msgbox "Diagnostics set to ${DIAGNOSTICS}." 8 58
-        fi
-    fi
-}
-
-# ------------------------------------------------------------------------------
-# echo_default()
-#
-# - Prints summary of default values (ID, OS, type, disk, RAM, CPU, etc.)
-# - Uses icons and formatting for readability
-# - Convert CT_TYPE to description
-# ------------------------------------------------------------------------------
-echo_default() {
-    CT_TYPE_DESC="Unprivileged"
-    if [ "$CT_TYPE" -eq 0 ]; then
-        CT_TYPE_DESC="Privileged"
-    fi
-    echo -e "${INFO}${BOLD}${DGN}PVE Version ${PVEVERSION} (Kernel: ${KERNEL_VERSION})${CL}"
-    echo -e "${CONTAINERID}${BOLD}${DGN}Container ID: ${BGN}${CT_ID}${CL}"
-    echo -e "${OS}${BOLD}${DGN}Operating System: ${BGN}$var_os ($var_version)${CL}"
-    echo -e "${CONTAINERTYPE}${BOLD}${DGN}Container Type: ${BGN}$CT_TYPE_DESC${CL}"
-    echo -e "${DISKSIZE}${BOLD}${DGN}Disk Size: ${BGN}${DISK_SIZE} GB${CL}"
-    echo -e "${CPUCORE}${BOLD}${DGN}CPU Cores: ${BGN}${CORE_COUNT}${CL}"
-    echo -e "${RAMSIZE}${BOLD}${DGN}RAM Size: ${BGN}${RAM_SIZE} MiB${CL}"
-    if [ "$VERBOSE" == "yes" ]; then
-        echo -e "${SEARCH}${BOLD}${DGN}Verbose Mode: ${BGN}Enabled${CL}"
-    fi
-    echo -e "${CREATING}${BOLD}${BL}Creating a ${APP} LXC using the above default settings${CL}"
-    echo -e "  "
-}
-
-# ------------------------------------------------------------------------------
-# install_script()
-#
-# - Main entrypoint for installation mode
-# - Runs safety checks (pve_check, root_check, maxkeys_check, diagnostics_check)
-# - Builds interactive menu (Default, Verbose, Advanced, My Defaults, App Defaults, Diagnostics, Storage, Exit)
-# - Applies chosen settings and triggers container build
-# ------------------------------------------------------------------------------
-install_script() {
-    pve_check
-    shell_check
-    root_check
-    arch_check
-    ssh_check
-    maxkeys_check
-    diagnostics_check
-
-    if systemctl is-active -q ping-instances.service; then
-        systemctl -q stop ping-instances.service
-    fi
-
-    NEXTID=$(pvesh get /cluster/nextid)
-
-    # Get timezone using timedatectl (Debian 13+ compatible)
-    # Fallback to /etc/timezone for older systems
-    if command -v timedatectl >/dev/null 2>&1; then
-        timezone=$(timedatectl show --value --property=Timezone 2>/dev/null || echo "UTC")
-    elif [ -f /etc/timezone ]; then
-        timezone=$(cat /etc/timezone)
-    else
-        timezone="UTC"
-    fi
-
-    # Show APP Header
-    header_info
-
-    # --- Support CLI argument as direct preset (default, advanced, …) ---
-    CHOICE="${mode:-${1:-}}"
-
-    # If no CLI argument → show whiptail menu
-    # Build menu dynamically based on available options
-    local appdefaults_option=""
-    local settings_option=""
-    local menu_items=(
-        "1" "Default Install"
-        "2" "Advanced Install"
-        "3" "User Defaults"
-    )
-
-    if [ -f "$(get_app_defaults_path)" ]; then
-        appdefaults_option="4"
-        menu_items+=("4" "App Defaults for ${APP}")
-        settings_option="5"
-        menu_items+=("5" "Settings")
-    else
-        settings_option="4"
-        menu_items+=("4" "Settings")
-    fi
-
-    APPDEFAULTS_OPTION="$appdefaults_option"
-    SETTINGS_OPTION="$settings_option"
-
-    # Main menu loop - allows returning from Settings
-    while true; do
-        if [ -z "$CHOICE" ]; then
-            TMP_CHOICE=$(whiptail \
-                --backtitle "Proxmox VE Helper Scripts" \
-                --title "Community-Scripts Options" \
-                --ok-button "Select" --cancel-button "Exit Script" \
-                --notags \
-                --menu "\nChoose an option:\n Use TAB or Arrow keys to navigate, ENTER to select.\n" \
-                20 60 9 \
-                "${menu_items[@]}" \
-                --default-item "1" \
-                3>&1 1>&2 2>&3) || exit_script
-            CHOICE="$TMP_CHOICE"
-        fi
-
-        # --- Main case ---
-        local defaults_target=""
-        local run_maybe_offer="no"
-        case "$CHOICE" in
-        1 | default | DEFAULT)
-            header_info
-            echo -e "${DEFAULT}${BOLD}${BL}Using Default Settings on node $PVEHOST_NAME${CL}"
-            VERBOSE="no"
-            METHOD="default"
-            base_settings "$VERBOSE"
-            echo_default
-            defaults_target="$(ensure_global_default_vars_file)"
-            break
-            ;;
-        2 | advanced | ADVANCED)
-            header_info
-            echo -e "${ADVANCED}${BOLD}${RD}Using Advanced Install on node $PVEHOST_NAME${CL}"
-            echo -e "${INFO}${BOLD}${DGN}PVE Version ${PVEVERSION} (Kernel: ${KERNEL_VERSION})${CL}"
-            METHOD="advanced"
-            base_settings
-            advanced_settings
-            defaults_target="$(ensure_global_default_vars_file)"
-            run_maybe_offer="yes"
-            break
-            ;;
-        3 | mydefaults | MYDEFAULTS | userdefaults | USERDEFAULTS)
-            default_var_settings || {
-                msg_error "Failed to apply default.vars"
-                exit 1
-            }
-            defaults_target="/usr/local/community-scripts/default.vars"
-            break
-            ;;
-        "$APPDEFAULTS_OPTION" | appdefaults | APPDEFAULTS)
-            if [ -f "$(get_app_defaults_path)" ]; then
-                header_info
-                echo -e "${DEFAULT}${BOLD}${BL}Using App Defaults for ${APP} on node $PVEHOST_NAME${CL}"
-                METHOD="appdefaults"
-                base_settings
-                load_vars_file "$(get_app_defaults_path)"
-                echo_default
-                defaults_target="$(get_app_defaults_path)"
-                break
-            else
-                msg_error "No App Defaults available for ${APP}"
-                exit 1
-            fi
-            ;;
-        "$SETTINGS_OPTION" | settings | SETTINGS)
-            settings_menu
-            # After settings menu, show main menu again
-            header_info
-            CHOICE=""
-            ;;
-        *)
-            echo -e "${CROSS}${RD}Invalid option: $CHOICE${CL}"
-            exit 1
-            ;;
-        esac
-    done
-
-    if [[ -n "$defaults_target" ]]; then
-        ensure_storage_selection_for_vars_file "$defaults_target"
-    fi
-
-    if [[ "$run_maybe_offer" == "yes" ]]; then
-        maybe_offer_save_app_defaults
-    fi
-}
-
-edit_default_storage() {
-    local vf="/usr/local/community-scripts/default.vars"
-
-    # Ensure file exists
-    if [[ ! -f "$vf" ]]; then
-        mkdir -p "$(dirname "$vf")"
-        touch "$vf"
-    fi
-
-    # Let ensure_storage_selection_for_vars_file handle everything
-    ensure_storage_selection_for_vars_file "$vf"
-}
-
-settings_menu() {
-    while true; do
-        local settings_items=(
-            "1" "Manage API-Diagnostic Setting"
-            "2" "Edit Default.vars"
-        )
-        if [ -f "$(get_app_defaults_path)" ]; then
-            settings_items+=("3" "Edit App.vars for ${APP}")
-            settings_items+=("4" "Back to Main Menu")
-        else
-            settings_items+=("3" "Back to Main Menu")
-        fi
-
-        local choice
-        choice=$(whiptail --backtitle "Proxmox VE Helper Scripts" \
-            --title "Community-Scripts SETTINGS Menu" \
-            --ok-button "Select" --cancel-button "Exit Script" \
-            --menu "\n\nChoose a settings option:\n\nUse Arrow keys to navigate, ENTER to select, TAB for buttons." 20 60 9 \
-            "${settings_items[@]}" \
-            3>&1 1>&2 2>&3) || exit_script
-
-        case "$choice" in
-        1) diagnostics_menu ;;
-        2) nano /usr/local/community-scripts/default.vars ;;
-        3)
-            if [ -f "$(get_app_defaults_path)" ]; then
-                nano "$(get_app_defaults_path)"
-            else
-                # Back was selected (no app.vars available)
-                return
-            fi
-            ;;
-        4)
-            # Back to main menu
-            return
-            ;;
-        esac
-    done
-}
-
-# ------------------------------------------------------------------------------
-# check_container_resources()
-#
-# - Compares host RAM/CPU with required values
-# - Warns if under-provisioned and asks user to continue or abort
-# ------------------------------------------------------------------------------
-check_container_resources() {
-    current_ram=$(free -m | awk 'NR==2{print $2}')
-    current_cpu=$(nproc)
-
-    if [[ "$current_ram" -lt "$var_ram" ]] || [[ "$current_cpu" -lt "$var_cpu" ]]; then
-        echo -e "\n${INFO}${HOLD} ${GN}Required: ${var_cpu} CPU, ${var_ram}MB RAM ${CL}| ${RD}Current: ${current_cpu} CPU, ${current_ram}MB RAM${CL}"
-        echo -e "${YWB}Please ensure that the ${APP} LXC is configured with at least ${var_cpu} vCPU and ${var_ram} MB RAM for the build process.${CL}\n"
-        echo -ne "${INFO}${HOLD} May cause data loss! ${INFO} Continue update with under-provisioned LXC? <yes/No>  "
-        read -r prompt
-        if [[ ! ${prompt,,} =~ ^(yes)$ ]]; then
-            echo -e "${CROSS}${HOLD} ${YWB}Exiting based on user input.${CL}"
-            exit 1
-        fi
-    else
-        echo -e ""
-    fi
-}
-
-# ------------------------------------------------------------------------------
-# check_container_storage()
-#
-# - Checks /boot partition usage
-# - Warns if usage >80% and asks user confirmation before proceeding
-# ------------------------------------------------------------------------------
-check_container_storage() {
-    total_size=$(df /boot --output=size | tail -n 1)
-    local used_size=$(df /boot --output=used | tail -n 1)
-    usage=$((100 * used_size / total_size))
-    if ((usage > 80)); then
-        echo -e "${INFO}${HOLD} ${YWB}Warning: Storage is dangerously low (${usage}%).${CL}"
-        echo -ne "Continue anyway? <y/N>  "
-        read -r prompt
-        if [[ ! ${prompt,,} =~ ^(y|yes)$ ]]; then
-            echo -e "${CROSS}${HOLD}${YWB}Exiting based on user input.${CL}"
-            exit 1
-        fi
-    fi
-}
-
-# ------------------------------------------------------------------------------
-# ssh_extract_keys_from_file()
-#
-# - Extracts valid SSH public keys from given file
-# - Supports RSA, Ed25519, ECDSA and filters out comments/invalid lines
-# ------------------------------------------------------------------------------
-ssh_extract_keys_from_file() {
-    local f="$1"
-    [[ -r "$f" ]] || return 0
-    tr -d '\r' <"$f" | awk '
-    /^[[:space:]]*#/ {next}
-    /^[[:space:]]*$/ {next}
-    # nackt: typ base64 [comment]
-    /^(ssh-(rsa|ed25519)|ecdsa-sha2-nistp256|sk-(ssh-ed25519|ecdsa-sha2-nistp256))[[:space:]]+/ {print; next}
-    # mit Optionen: finde ab erstem Key-Typ
-    {
-      match($0, /(ssh-(rsa|ed25519)|ecdsa-sha2-nistp256|sk-(ssh-ed25519|ecdsa-sha2-nistp256))[[:space:]]+/)
-      if (RSTART>0) { print substr($0, RSTART) }
-    }
-  '
-}
-
-# ------------------------------------------------------------------------------
-# ssh_build_choices_from_files()
-#
-# - Builds interactive whiptail checklist of available SSH keys
-# - Generates fingerprint, type and comment for each key
-# ------------------------------------------------------------------------------
-ssh_build_choices_from_files() {
-    local -a files=("$@")
-    CHOICES=()
-    COUNT=0
-    MAPFILE="$(mktemp)"
-    local id key typ fp cmt base ln=0
-
-    for f in "${files[@]}"; do
-        [[ -f "$f" && -r "$f" ]] || continue
-        base="$(basename -- "$f")"
-        case "$base" in
-        known_hosts | known_hosts.* | config) continue ;;
-        id_*) [[ "$f" != *.pub ]] && continue ;;
-        esac
-
-        # map every key in file
-        while IFS= read -r key; do
-            [[ -n "$key" ]] || continue
-
-            typ=""
-            fp=""
-            cmt=""
-            # Only the pure key part (without options) is already included in ‘key’.
-            read -r _typ _b64 _cmt <<<"$key"
-            typ="${_typ:-key}"
-            cmt="${_cmt:-}"
-            # Fingerprint via ssh-keygen (if available)
-            if command -v ssh-keygen >/dev/null 2>&1; then
-                fp="$(printf '%s\n' "$key" | ssh-keygen -lf - 2>/dev/null | awk '{print $2}')"
-            fi
-            # Label shorten
-            [[ ${#cmt} -gt 40 ]] && cmt="${cmt:0:37}..."
-
-            ln=$((ln + 1))
-            COUNT=$((COUNT + 1))
-            id="K${COUNT}"
-            echo "${id}|${key}" >>"$MAPFILE"
-            CHOICES+=("$id" "[$typ] ${fp:+$fp }${cmt:+$cmt }— ${base}" "OFF")
-        done < <(ssh_extract_keys_from_file "$f")
-    done
-}
-
-# ------------------------------------------------------------------------------
-# ssh_discover_default_files()
-#
-# - Scans standard paths for SSH keys
-# - Includes ~/.ssh/*.pub, /etc/ssh/authorized_keys, etc.
-# ------------------------------------------------------------------------------
-ssh_discover_default_files() {
-    local -a cand=()
-    shopt -s nullglob
-    cand+=(/root/.ssh/authorized_keys /root/.ssh/authorized_keys2)
-    cand+=(/root/.ssh/*.pub)
-    cand+=(/etc/ssh/authorized_keys /etc/ssh/authorized_keys.d/*)
-    shopt -u nullglob
-    printf '%s\0' "${cand[@]}"
-}
-
-configure_ssh_settings() {
-    SSH_KEYS_FILE="$(mktemp)"
-    : >"$SSH_KEYS_FILE"
-
-    IFS=$'\0' read -r -d '' -a _def_files < <(ssh_discover_default_files && printf '\0')
-    ssh_build_choices_from_files "${_def_files[@]}"
-    local default_key_count="$COUNT"
-
-    local ssh_key_mode
-    if [[ "$default_key_count" -gt 0 ]]; then
-        ssh_key_mode=$(whiptail --backtitle "[dev] Proxmox VE Helper Scripts" --title "SSH KEY SOURCE" --menu \
-            "Provision SSH keys for root:" 14 72 4 \
-            "found" "Select from detected keys (${default_key_count})" \
-            "manual" "Paste a single public key" \
-            "folder" "Scan another folder (path or glob)" \
-            "none" "No keys" 3>&1 1>&2 2>&3) || exit_script
-    else
-        ssh_key_mode=$(whiptail --backtitle "[dev] Proxmox VE Helper Scripts" --title "SSH KEY SOURCE" --menu \
-            "No host keys detected; choose manual/none:" 12 72 2 \
-            "manual" "Paste a single public key" \
-            "none" "No keys" 3>&1 1>&2 2>&3) || exit_script
-    fi
-
-    case "$ssh_key_mode" in
-    found)
-        local selection
-        selection=$(whiptail --backtitle "[dev] Proxmox VE Helper Scripts" --title "SELECT HOST KEYS" \
-            --checklist "Select one or more keys to import:" 20 140 10 "${CHOICES[@]}" 3>&1 1>&2 2>&3) || exit_script
-        for tag in $selection; do
-            tag="${tag%\"}"
-            tag="${tag#\"}"
-            local line
-            line=$(grep -E "^${tag}\|" "$MAPFILE" | head -n1 | cut -d'|' -f2-)
-            [[ -n "$line" ]] && printf '%s\n' "$line" >>"$SSH_KEYS_FILE"
-        done
-        ;;
-    manual)
-        SSH_AUTHORIZED_KEY="$(whiptail --backtitle "[dev] Proxmox VE Helper Scripts" \
-            --inputbox "Paste one SSH public key line (ssh-ed25519/ssh-rsa/...)" 10 72 --title "SSH Public Key" 3>&1 1>&2 2>&3)"
-        [[ -n "$SSH_AUTHORIZED_KEY" ]] && printf '%s\n' "$SSH_AUTHORIZED_KEY" >>"$SSH_KEYS_FILE"
-        ;;
-    folder)
-        local glob_path
-        glob_path=$(whiptail --backtitle "[dev] Proxmox VE Helper Scripts" \
-            --inputbox "Enter a folder or glob to scan (e.g. /root/.ssh/*.pub)" 10 72 --title "Scan Folder/Glob" 3>&1 1>&2 2>&3)
-        if [[ -n "$glob_path" ]]; then
-            shopt -s nullglob
-            read -r -a _scan_files <<<"$glob_path"
-            shopt -u nullglob
-            if [[ "${#_scan_files[@]}" -gt 0 ]]; then
-                ssh_build_choices_from_files "${_scan_files[@]}"
-                if [[ "$COUNT" -gt 0 ]]; then
-                    local folder_selection
-                    folder_selection=$(whiptail --backtitle "[dev] Proxmox VE Helper Scripts" --title "SELECT FOLDER KEYS" \
-                        --checklist "Select key(s) to import:" 20 78 10 "${CHOICES[@]}" 3>&1 1>&2 2>&3) || exit_script
-                    for tag in $folder_selection; do
-                        tag="${tag%\"}"
-                        tag="${tag#\"}"
-                        local line
-                        line=$(grep -E "^${tag}\|" "$MAPFILE" | head -n1 | cut -d'|' -f2-)
-                        [[ -n "$line" ]] && printf '%s\n' "$line" >>"$SSH_KEYS_FILE"
-                    done
-                else
-                    whiptail --backtitle "[dev] Proxmox VE Helper Scripts" --msgbox "No keys found in: $glob_path" 8 60
-                fi
-            else
-                whiptail --backtitle "[dev] Proxmox VE Helper Scripts" --msgbox "Path/glob returned no files." 8 60
-            fi
-        fi
-        ;;
-    none)
-        :
-        ;;
-    esac
-
-    if [[ -s "$SSH_KEYS_FILE" ]]; then
-        sort -u -o "$SSH_KEYS_FILE" "$SSH_KEYS_FILE"
-        printf '\n' >>"$SSH_KEYS_FILE"
-    fi
-
-    if [[ -s "$SSH_KEYS_FILE" || "$PW" == -password* ]]; then
-        if (whiptail --backtitle "[dev] Proxmox VE Helper Scripts" --defaultno --title "SSH ACCESS" --yesno "Enable root SSH access?" 10 58); then
-            SSH="yes"
-        else
-            SSH="no"
-        fi
-    else
-        SSH="no"
-    fi
-}
-
-# ------------------------------------------------------------------------------
-# start()
-#
-# - Entry point of script
-# - On Proxmox host: calls install_script
-# - In silent mode: runs update_script
-# - Otherwise: shows update/setting menu
-# ------------------------------------------------------------------------------
-start() {
-    source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/tools.func)
-    if command -v pveversion >/dev/null 2>&1; then
-        install_script || return 0
-        return 0
-    elif [ ! -z ${PHS_SILENT+x} ] && [[ "${PHS_SILENT}" == "1" ]]; then
-        VERBOSE="no"
-        set_std_mode
-        update_script
-    else
-        CHOICE=$(whiptail --backtitle "[dev] Proxmox VE Helper Scripts" --title "${APP} LXC Update/Setting" --menu \
-            "Support/Update functions for ${APP} LXC. Choose an option:" \
-            12 60 3 \
-            "1" "YES (Silent Mode)" \
-            "2" "YES (Verbose Mode)" \
-            "3" "NO (Cancel Update)" --nocancel --default-item "1" 3>&1 1>&2 2>&3)
-
-        case "$CHOICE" in
-        1)
-            VERBOSE="no"
-            set_std_mode
-            ;;
-        2)
-            VERBOSE="yes"
-            set_std_mode
-            ;;
-        3)
-            clear
-            exit_script
-            exit
-            ;;
-        esac
-        update_script
-    fi
-}
-
-# ==============================================================================
-# SECTION 8: CONTAINER CREATION & DEPLOYMENT
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# build_container()
-#
-# - Main function for creating and configuring LXC container
-# - Builds network configuration string (IP, gateway, VLAN, MTU, MAC, IPv6)
-# - Creates container via pct create with all specified settings
-# - Applies features: FUSE, TUN, keyctl, VAAPI passthrough
-# - Starts container and waits for network connectivity
-# - Installs base packages (curl, sudo, etc.)
-# - Injects SSH keys if configured
-# - Executes <app>-install.sh inside container
-# - Posts installation telemetry to API if diagnostics enabled
-# ------------------------------------------------------------------------------
-build_container() {
-    #  if [ "$VERBOSE" == "yes" ]; then set -x; fi
-
-    NET_STRING="-net0 name=eth0,bridge=${BRG:-vmbr0}"
-
-    # MAC
-    if [[ -n "$MAC" ]]; then
-        case "$MAC" in
-        ,hwaddr=*) NET_STRING+="$MAC" ;;
-        *) NET_STRING+=",hwaddr=$MAC" ;;
-        esac
-    fi
-
-    # IP (immer zwingend, Standard dhcp)
-    NET_STRING+=",ip=${NET:-dhcp}"
-
-    # Gateway
-    if [[ -n "$GATE" ]]; then
-        case "$GATE" in
-        ,gw=*) NET_STRING+="$GATE" ;;
-        *) NET_STRING+=",gw=$GATE" ;;
-        esac
-    fi
-
-    # VLAN
-    if [[ -n "$VLAN" ]]; then
-        case "$VLAN" in
-        ,tag=*) NET_STRING+="$VLAN" ;;
-        *) NET_STRING+=",tag=$VLAN" ;;
-        esac
-    fi
-
-    # MTU
-    if [[ -n "$MTU" ]]; then
-        case "$MTU" in
-        ,mtu=*) NET_STRING+="$MTU" ;;
-        *) NET_STRING+=",mtu=$MTU" ;;
-        esac
-    fi
-
-    # IPv6 Handling
-    case "$IPV6_METHOD" in
-    auto) NET_STRING="$NET_STRING,ip6=auto" ;;
-    dhcp) NET_STRING="$NET_STRING,ip6=dhcp" ;;
-    static)
-        NET_STRING="$NET_STRING,ip6=$IPV6_ADDR"
-        [ -n "$IPV6_GATE" ] && NET_STRING="$NET_STRING,gw6=$IPV6_GATE"
-        ;;
-    none) ;;
-    esac
-
-    # Build FEATURES string (simple working version)
-    if [ "$CT_TYPE" == "1" ]; then
-        FEATURES="keyctl=1,nesting=1"
-    else
-        FEATURES="nesting=1"
-    fi
-
-    if [ "$ENABLE_FUSE" == "yes" ]; then
-        FEATURES="$FEATURES,fuse=1"
-    fi
-
-    # NEW IMPLEMENTATION (Fixed): Build PCT_OPTIONS properly
-    # Key insight: Bash cannot export arrays, so we build the options as a string
-
-    TEMP_DIR=$(mktemp -d)
-    pushd "$TEMP_DIR" >/dev/null
-    if [ "$var_os" == "alpine" ]; then
-        export FUNCTIONS_FILE_PATH="$(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/alpine-install.func)"
-    else
-        export FUNCTIONS_FILE_PATH="$(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/install.func)"
-    fi
-
-    # Core exports for install.func
-    export DIAGNOSTICS="$DIAGNOSTICS"
-    export RANDOM_UUID="$RANDOM_UUID"
-    export SESSION_ID="$SESSION_ID"
-    export CACHER="$APT_CACHER"
-    export CACHER_IP="$APT_CACHER_IP"
-    export tz="$timezone"
-    export APPLICATION="$APP"
-    export app="$NSAPP"
-    export PASSWORD="$PW"
-    export VERBOSE="$VERBOSE"
-    export SSH_ROOT="${SSH}"
-    export SSH_AUTHORIZED_KEY
-    export CTID="$CT_ID"
-    export CTTYPE="$CT_TYPE"
-    export ENABLE_FUSE="$ENABLE_FUSE"
-    export ENABLE_TUN="$ENABLE_TUN"
-    export PCT_OSTYPE="$var_os"
-    export PCT_OSVERSION="$var_version"
-    export PCT_DISK_SIZE="$DISK_SIZE"
-
-    # DEV_MODE exports (optional, for debugging)
-    export BUILD_LOG="$BUILD_LOG"
-    export INSTALL_LOG="/root/.install-${SESSION_ID}.log"
-    export dev_mode="${dev_mode:-}"
-    export DEV_MODE_MOTD="${DEV_MODE_MOTD:-false}"
-    export DEV_MODE_KEEP="${DEV_MODE_KEEP:-false}"
-    export DEV_MODE_TRACE="${DEV_MODE_TRACE:-false}"
-    export DEV_MODE_PAUSE="${DEV_MODE_PAUSE:-false}"
-    export DEV_MODE_BREAKPOINT="${DEV_MODE_BREAKPOINT:-false}"
-    export DEV_MODE_LOGS="${DEV_MODE_LOGS:-false}"
-    export DEV_MODE_DRYRUN="${DEV_MODE_DRYRUN:-false}"
-
-    # Build PCT_OPTIONS as multi-line string
-    PCT_OPTIONS_STRING="  -features $FEATURES
-  -hostname $HN
-  -tags $TAGS"
-
-    # Add storage if specified
-    if [ -n "$SD" ]; then
-        PCT_OPTIONS_STRING="$PCT_OPTIONS_STRING
-  $SD"
-    fi
-
-    # Add nameserver if specified
-    if [ -n "$NS" ]; then
-        PCT_OPTIONS_STRING="$PCT_OPTIONS_STRING
-  $NS"
-    fi
-
-    # Network configuration
-    PCT_OPTIONS_STRING="$PCT_OPTIONS_STRING
-  $NET_STRING
-  -onboot 1
-  -cores $CORE_COUNT
-  -memory $RAM_SIZE
-  -unprivileged $CT_TYPE"
-
-    # Protection flag (if var_protection was set)
-    if [ "${PROTECT_CT:-}" == "1" ] || [ "${PROTECT_CT:-}" == "yes" ]; then
-        PCT_OPTIONS_STRING="$PCT_OPTIONS_STRING
-  -protection 1"
-    fi
-
-    # Timezone flag (if var_timezone was set)
-    if [ -n "${CT_TIMEZONE:-}" ]; then
-        PCT_OPTIONS_STRING="$PCT_OPTIONS_STRING
-  -timezone $CT_TIMEZONE"
-    fi
-
-    # Password (already formatted)
-    if [ -n "$PW" ]; then
-        PCT_OPTIONS_STRING="$PCT_OPTIONS_STRING
-  $PW"
-    fi
-
-    # Export as string (this works, unlike arrays!)
-    export PCT_OPTIONS="$PCT_OPTIONS_STRING"
-    export TEMPLATE_STORAGE="${var_template_storage:-}"
-    export CONTAINER_STORAGE="${var_container_storage:-}"
-
-    # # DEBUG: Show final PCT_OPTIONS being exported
-    # echo "[DEBUG] PCT_OPTIONS to be exported:"
-    # echo "$PCT_OPTIONS" | sed 's/^/  /'
-    # echo "[DEBUG] Calling create_lxc_container..."
-
-    create_lxc_container || exit $?
-
-    LXC_CONFIG="/etc/pve/lxc/${CTID}.conf"
-
-    # ============================================================================
-    # GPU/USB PASSTHROUGH CONFIGURATION
-    # ============================================================================
-
-    # List of applications that benefit from GPU acceleration
-    GPU_APPS=(
-        "immich" "channels" "emby" "ersatztv" "frigate"
-        "jellyfin" "plex" "scrypted" "tdarr" "unmanic"
-        "ollama" "fileflows" "open-webui" "tunarr" "debian"
-        "handbrake" "sunshine" "moonlight" "kodi" "stremio"
-        "viseron"
-    )
-
-    # Check if app needs GPU
-    is_gpu_app() {
-        local app="${1,,}"
-        for gpu_app in "${GPU_APPS[@]}"; do
-            [[ "$app" == "${gpu_app,,}" ]] && return 0
-        done
-        return 1
-    }
-
-    # Detect all available GPU devices
-    detect_gpu_devices() {
-        INTEL_DEVICES=()
-        AMD_DEVICES=()
-        NVIDIA_DEVICES=()
-
-        # Store PCI info to avoid multiple calls
-        local pci_vga_info=$(lspci -nn 2>/dev/null | grep -E "VGA|Display|3D")
-
-        # Check for Intel GPU - look for Intel vendor ID [8086]
-        if echo "$pci_vga_info" | grep -q "\[8086:"; then
-            msg_custom "🎮" "${BL}" "Detected Intel GPU"
-            if [[ -d /dev/dri ]]; then
-                for d in /dev/dri/renderD* /dev/dri/card*; do
-                    [[ -e "$d" ]] && INTEL_DEVICES+=("$d")
-                done
-            fi
-        fi
-
-        # Check for AMD GPU - look for AMD vendor IDs [1002] (AMD/ATI) or [1022] (AMD)
-        if echo "$pci_vga_info" | grep -qE "\[1002:|\[1022:"; then
-            msg_custom "🎮" "${RD}" "Detected AMD GPU"
-            if [[ -d /dev/dri ]]; then
-                # Only add if not already claimed by Intel
-                if [[ ${#INTEL_DEVICES[@]} -eq 0 ]]; then
-                    for d in /dev/dri/renderD* /dev/dri/card*; do
-                        [[ -e "$d" ]] && AMD_DEVICES+=("$d")
-                    done
-                fi
-            fi
-        fi
-
-        # Check for NVIDIA GPU - look for NVIDIA vendor ID [10de]
-        if echo "$pci_vga_info" | grep -q "\[10de:"; then
-            msg_custom "🎮" "${GN}" "Detected NVIDIA GPU"
-
-            # Simple passthrough - just bind /dev/nvidia* devices if they exist
-            for d in /dev/nvidia* /dev/nvidiactl /dev/nvidia-modeset /dev/nvidia-uvm /dev/nvidia-uvm-tools; do
-                [[ -e "$d" ]] && NVIDIA_DEVICES+=("$d")
-            done
-
-            if [[ ${#NVIDIA_DEVICES[@]} -gt 0 ]]; then
-                msg_custom "🎮" "${GN}" "Found ${#NVIDIA_DEVICES[@]} NVIDIA device(s) for passthrough"
-            else
-                msg_warn "NVIDIA GPU detected via PCI but no /dev/nvidia* devices found"
-                msg_custom "ℹ️" "${YW}" "Skipping NVIDIA passthrough (host drivers may not be loaded)"
-            fi
-        fi
-
-        # Debug output
-        msg_debug "Intel devices: ${INTEL_DEVICES[*]}"
-        msg_debug "AMD devices: ${AMD_DEVICES[*]}"
-        msg_debug "NVIDIA devices: ${NVIDIA_DEVICES[*]}"
-    }
-
-    # Configure USB passthrough for privileged containers
-    configure_usb_passthrough() {
-        if [[ "$CT_TYPE" != "0" ]]; then
-            return 0
-        fi
-
-        msg_info "Configuring automatic USB passthrough (privileged container)"
-        cat <<EOF >>"$LXC_CONFIG"
-# Automatic USB passthrough (privileged container)
-lxc.cgroup2.devices.allow: a
-lxc.cap.drop:
-lxc.cgroup2.devices.allow: c 188:* rwm
-lxc.cgroup2.devices.allow: c 189:* rwm
-lxc.mount.entry: /dev/serial/by-id  dev/serial/by-id  none bind,optional,create=dir
-lxc.mount.entry: /dev/ttyUSB0       dev/ttyUSB0       none bind,optional,create=file
-lxc.mount.entry: /dev/ttyUSB1       dev/ttyUSB1       none bind,optional,create=file
-lxc.mount.entry: /dev/ttyACM0       dev/ttyACM0       none bind,optional,create=file
-lxc.mount.entry: /dev/ttyACM1       dev/ttyACM1       none bind,optional,create=file
-EOF
-        msg_ok "USB passthrough configured"
-    }
-
-    # Configure GPU passthrough
-    configure_gpu_passthrough() {
-        # Skip if not a GPU app and not privileged
-        if [[ "$CT_TYPE" != "0" ]] && ! is_gpu_app "$APP"; then
-            return 0
-        fi
-
-        detect_gpu_devices
-
-        # Count available GPU types
-        local gpu_count=0
-        local available_gpus=()
-
-        if [[ ${#INTEL_DEVICES[@]} -gt 0 ]]; then
-            available_gpus+=("INTEL")
-            gpu_count=$((gpu_count + 1))
-        fi
-
-        if [[ ${#AMD_DEVICES[@]} -gt 0 ]]; then
-            available_gpus+=("AMD")
-            gpu_count=$((gpu_count + 1))
-        fi
-
-        if [[ ${#NVIDIA_DEVICES[@]} -gt 0 ]]; then
-            available_gpus+=("NVIDIA")
-            gpu_count=$((gpu_count + 1))
-        fi
-
-        if [[ $gpu_count -eq 0 ]]; then
-            msg_custom "ℹ️" "${YW}" "No GPU devices found for passthrough"
-            return 0
-        fi
-
-        local selected_gpu=""
-
-        if [[ $gpu_count -eq 1 ]]; then
-            # Automatic selection for single GPU
-            selected_gpu="${available_gpus[0]}"
-            msg_ok "Automatically configuring ${selected_gpu} GPU passthrough"
-        else
-            # Multiple GPUs - ask user
-            echo -e "\n${INFO} Multiple GPU types detected:"
-            for gpu in "${available_gpus[@]}"; do
-                echo "  - $gpu"
-            done
-            read -rp "Which GPU type to passthrough? (${available_gpus[*]}): " selected_gpu
-            selected_gpu="${selected_gpu^^}"
-
-            # Validate selection
-            local valid=0
-            for gpu in "${available_gpus[@]}"; do
-                [[ "$selected_gpu" == "$gpu" ]] && valid=1
-            done
-
-            if [[ $valid -eq 0 ]]; then
-                msg_warn "Invalid selection. Skipping GPU passthrough."
-                return 0
-            fi
-        fi
-
-        # Apply passthrough configuration based on selection
-        local dev_idx=0
-
-        case "$selected_gpu" in
-        INTEL | AMD)
-            local devices=()
-            [[ "$selected_gpu" == "INTEL" ]] && devices=("${INTEL_DEVICES[@]}")
-            [[ "$selected_gpu" == "AMD" ]] && devices=("${AMD_DEVICES[@]}")
-
-            # Use pct set to add devices with proper dev0/dev1 format
-            # GIDs will be detected and set after container starts
-            local dev_index=0
-            for dev in "${devices[@]}"; do
-                # Add to config using pct set (will be visible in GUI)
-                echo "dev${dev_index}: ${dev},gid=44" >>"$LXC_CONFIG"
-                dev_index=$((dev_index + 1))
-            done
-
-            export GPU_TYPE="$selected_gpu"
-            msg_ok "${selected_gpu} GPU passthrough configured (${#devices[@]} devices)"
-            ;;
-
-        NVIDIA)
-            if [[ ${#NVIDIA_DEVICES[@]} -eq 0 ]]; then
-                msg_warn "No NVIDIA devices available for passthrough"
-                return 0
-            fi
-
-            # Use pct set for NVIDIA devices
-            local dev_index=0
-            for dev in "${NVIDIA_DEVICES[@]}"; do
-                echo "dev${dev_index}: ${dev},gid=44" >>"$LXC_CONFIG"
-                dev_index=$((dev_index + 1))
-            done
-
-            export GPU_TYPE="NVIDIA"
-            msg_ok "NVIDIA GPU passthrough configured (${#NVIDIA_DEVICES[@]} devices) - install drivers in container if needed"
-            ;;
-        esac
-    }
-
-    # Additional device passthrough
-    configure_additional_devices() {
-        # TUN device passthrough
-        if [ "$ENABLE_TUN" == "yes" ]; then
-            cat <<EOF >>"$LXC_CONFIG"
-lxc.cgroup2.devices.allow: c 10:200 rwm
-lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
-EOF
-        fi
-
-        # Coral TPU passthrough
-        if [[ -e /dev/apex_0 ]]; then
-            msg_custom "🔌" "${BL}" "Detected Coral TPU - configuring passthrough"
-            echo "lxc.mount.entry: /dev/apex_0 dev/apex_0 none bind,optional,create=file" >>"$LXC_CONFIG"
-        fi
-    }
-
-    # Execute pre-start configurations
-    configure_usb_passthrough
-    configure_gpu_passthrough
-    configure_additional_devices
-
-    # ============================================================================
-    # START CONTAINER AND INSTALL USERLAND
-    # ============================================================================
-
-    msg_info "Starting LXC Container"
-    pct start "$CTID"
-
-    # Wait for container to be running
-    for i in {1..10}; do
-        if pct status "$CTID" | grep -q "status: running"; then
-            msg_ok "Started LXC Container"
-            break
-        fi
-        sleep 1
-        if [ "$i" -eq 10 ]; then
-            msg_error "LXC Container did not reach running state"
-            exit 1
-        fi
-    done
-
-    # Wait for network (skip for Alpine initially)
-    if [ "$var_os" != "alpine" ]; then
-        msg_info "Waiting for network in LXC container"
-
-        # Wait for IP assignment (IPv4 or IPv6)
-        local ip_in_lxc=""
-        for i in {1..20}; do
-            # Try IPv4 first
-            ip_in_lxc=$(pct exec "$CTID" -- ip -4 addr show dev eth0 2>/dev/null | awk '/inet / {print $2}' | cut -d/ -f1)
-            # Fallback to IPv6 if IPv4 not available
-            if [ -z "$ip_in_lxc" ]; then
-                ip_in_lxc=$(pct exec "$CTID" -- ip -6 addr show dev eth0 scope global 2>/dev/null | awk '/inet6 / {print $2}' | cut -d/ -f1 | head -n1)
-            fi
-            [ -n "$ip_in_lxc" ] && break
-            sleep 1
-        done
-
-        if [ -z "$ip_in_lxc" ]; then
-            msg_error "No IP assigned to CT $CTID after 20s"
-            echo -e "${YW}Troubleshooting:${CL}"
-            echo "  • Verify bridge ${BRG} exists and has connectivity"
-            echo "  • Check if DHCP server is reachable (if using DHCP)"
-            echo "  • Verify static IP configuration (if using static IP)"
-            echo "  • Check Proxmox firewall rules"
-            echo "  • If using Tailscale: Disable MagicDNS temporarily"
-            exit 1
-        fi
-
-        # Verify basic connectivity (ping test)
-        local ping_success=false
-        for retry in {1..3}; do
-            if pct exec "$CTID" -- ping -c 1 -W 2 1.1.1.1 &>/dev/null ||
-                pct exec "$CTID" -- ping -c 1 -W 2 8.8.8.8 &>/dev/null ||
-                pct exec "$CTID" -- ping6 -c 1 -W 2 2606:4700:4700::1111 &>/dev/null; then
-                ping_success=true
-                break
-            fi
-            sleep 2
-        done
-
-        if [ "$ping_success" = false ]; then
-            msg_warn "Network configured (IP: $ip_in_lxc) but connectivity test failed"
-            echo -e "${YW}Container may have limited internet access. Installation will continue...${CL}"
-        else
-            msg_ok "Network in LXC is reachable (ping)"
-        fi
-    fi
-
-    # Function to get correct GID inside container
-    get_container_gid() {
-        local group="$1"
-        local gid=$(pct exec "$CTID" -- getent group "$group" 2>/dev/null | cut -d: -f3)
-        echo "${gid:-44}" # Default to 44 if not found
-    }
-
-    fix_gpu_gids
-
-    # Continue with standard container setup
-    msg_info "Customizing LXC Container"
-
-    # # Install GPU userland if configured
-    # if [[ "${ENABLE_VAAPI:-0}" == "1" ]]; then
-    #   install_gpu_userland "VAAPI"
-    # fi
-
-    # if [[ "${ENABLE_NVIDIA:-0}" == "1" ]]; then
-    #   install_gpu_userland "NVIDIA"
-    # fi
-
-    # Continue with standard container setup
-    if [ "$var_os" == "alpine" ]; then
-        sleep 3
-        pct exec "$CTID" -- /bin/sh -c 'cat <<EOF >/etc/apk/repositories
-http://dl-cdn.alpinelinux.org/alpine/latest-stable/main
-http://dl-cdn.alpinelinux.org/alpine/latest-stable/community
-EOF'
-        pct exec "$CTID" -- ash -c "apk add bash newt curl openssh nano mc ncurses jq >/dev/null"
-    else
-        sleep 3
-        pct exec "$CTID" -- bash -c "sed -i '/$LANG/ s/^# //' /etc/locale.gen"
-        pct exec "$CTID" -- bash -c "locale_line=\$(grep -v '^#' /etc/locale.gen | grep -E '^[a-zA-Z]' | awk '{print \$1}' | head -n 1) && \
-    echo LANG=\$locale_line >/etc/default/locale && \
-    locale-gen >/dev/null && \
-    export LANG=\$locale_line"
-
-        if [[ -z "${tz:-}" ]]; then
-            tz=$(timedatectl show --property=Timezone --value 2>/dev/null || echo "Etc/UTC")
-        fi
-
-        if pct exec "$CTID" -- test -e "/usr/share/zoneinfo/$tz"; then
-            # Set timezone using symlink (Debian 13+ compatible)
-            # Create /etc/timezone for backwards compatibility with older scripts
-            pct exec "$CTID" -- bash -c "tz='$tz'; ln -sf \"/usr/share/zoneinfo/\$tz\" /etc/localtime && echo \"\$tz\" >/etc/timezone || true"
-        else
-            msg_warn "Skipping timezone setup – zone '$tz' not found in container"
-        fi
-
-        pct exec "$CTID" -- bash -c "apt-get update >/dev/null && apt-get install -y sudo curl mc gnupg2 jq >/dev/null" || {
-            msg_error "apt-get base packages installation failed"
-            exit 1
-        }
-    fi
-
-    msg_ok "Customized LXC Container"
-
-    # Install SSH keys
-    install_ssh_keys_into_ct
-
-    # Run application installer
-    # NOTE: We disable error handling here because:
-    # 1. Container errors are caught by error_handler INSIDE container
-    # 2. Container creates flag file with exit code
-    # 3. We read flag file and handle cleanup manually below
-    # 4. We DON'T want host error_handler to fire for lxc-attach command itself
-
-    set +Eeuo pipefail # Disable ALL error handling temporarily
-    trap - ERR         # Remove ERR trap completely
-
-    lxc-attach -n "$CTID" -- bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/install/${var_install}.sh)"
-    local lxc_exit=$?
-
-    set -Eeuo pipefail       # Re-enable error handling
-    trap 'error_handler' ERR # Restore ERR trap
-
-    # Check for error flag file in container (more reliable than lxc-attach exit code)
-    local install_exit_code=0
-    if [[ -n "${SESSION_ID:-}" ]]; then
-        local error_flag="/root/.install-${SESSION_ID}.failed"
-        if pct exec "$CTID" -- test -f "$error_flag" 2>/dev/null; then
-            install_exit_code=$(pct exec "$CTID" -- cat "$error_flag" 2>/dev/null || echo "1")
-            pct exec "$CTID" -- rm -f "$error_flag" 2>/dev/null || true
-        fi
-    fi
-
-    # Fallback to lxc-attach exit code if no flag file
-    if [[ $install_exit_code -eq 0 && $lxc_exit -ne 0 ]]; then
-        install_exit_code=$lxc_exit
-    fi
-
-    # Installation failed?
-    if [[ $install_exit_code -ne 0 ]]; then
-        msg_error "Installation failed in container ${CTID} (exit code: ${install_exit_code})"
-
-        # Copy both logs from container before potential deletion
-        local build_log_copied=false
-        local install_log_copied=false
-
-        if [[ -n "$CTID" && -n "${SESSION_ID:-}" ]]; then
-            # Copy BUILD_LOG (creation log) if it exists
-            if [[ -f "${BUILD_LOG}" ]]; then
-                cp "${BUILD_LOG}" "/tmp/create-lxc-${CTID}-${SESSION_ID}.log" 2>/dev/null && build_log_copied=true
-            fi
-
-            # Copy INSTALL_LOG from container
-            if pct pull "$CTID" "/root/.install-${SESSION_ID}.log" "/tmp/install-lxc-${CTID}-${SESSION_ID}.log" 2>/dev/null; then
-                install_log_copied=true
-            fi
-
-            # Show available logs
-            echo ""
-            [[ "$build_log_copied" == true ]] && echo -e "${GN}✔${CL} Container creation log: ${BL}/tmp/create-lxc-${CTID}-${SESSION_ID}.log${CL}"
-            [[ "$install_log_copied" == true ]] && echo -e "${GN}✔${CL} Installation log: ${BL}/tmp/install-lxc-${CTID}-${SESSION_ID}.log${CL}"
-        fi
-
-        # Dev mode: Keep container or open breakpoint shell
-        if [[ "${DEV_MODE_KEEP:-false}" == "true" ]]; then
-            msg_dev "Keep mode active - container ${CTID} preserved"
-            return 0
-        elif [[ "${DEV_MODE_BREAKPOINT:-false}" == "true" ]]; then
-            msg_dev "Breakpoint mode - opening shell in container ${CTID}"
-            echo -e "${YW}Type 'exit' to return to host${CL}"
-            pct enter "$CTID"
-            echo ""
-            echo -en "${YW}Container ${CTID} still running. Remove now? (y/N): ${CL}"
-            if read -r response && [[ "$response" =~ ^[Yy]$ ]]; then
-                pct stop "$CTID" &>/dev/null || true
-                pct destroy "$CTID" &>/dev/null || true
-                msg_ok "Container ${CTID} removed"
-            else
-                msg_dev "Container ${CTID} kept for debugging"
-            fi
-            exit $install_exit_code
-        fi
-
-        # Prompt user for cleanup with 60s timeout (plain echo - no msg_info to avoid spinner)
-        echo ""
-        echo -en "${YW}Remove broken container ${CTID}? (Y/n) [auto-remove in 60s]: ${CL}"
-
-        if read -t 60 -r response; then
-            if [[ -z "$response" || "$response" =~ ^[Yy]$ ]]; then
-                # Remove container
-                echo -e "\n${TAB}${HOLD}${YW}Removing container ${CTID}${CL}"
-                pct stop "$CTID" &>/dev/null || true
-                pct destroy "$CTID" &>/dev/null || true
-                echo -e "${BFR}${CM}${GN}Container ${CTID} removed${CL}"
-            elif [[ "$response" =~ ^[Nn]$ ]]; then
-                echo -e "\n${TAB}${YW}Container ${CTID} kept for debugging${CL}"
-
-                # Dev mode: Setup MOTD/SSH for debugging access to broken container
-                if [[ "${DEV_MODE_MOTD:-false}" == "true" ]]; then
-                    echo -e "${TAB}${HOLD}${DGN}Setting up MOTD and SSH for debugging...${CL}"
-                    if pct exec "$CTID" -- bash -c "
-            source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/misc/install.func)
-            declare -f motd_ssh >/dev/null 2>&1 && motd_ssh || true
-          " >/dev/null 2>&1; then
-                        local ct_ip=$(pct exec "$CTID" ip a s dev eth0 2>/dev/null | awk '/inet / {print $2}' | cut -d/ -f1)
-                        echo -e "${BFR}${CM}${GN}MOTD/SSH ready - SSH into container: ssh root@${ct_ip}${CL}"
-                    fi
-                fi
-            fi
-        else
-            # Timeout - auto-remove
-            echo -e "\n${YW}No response - auto-removing container${CL}"
-            echo -e "${TAB}${HOLD}${YW}Removing container ${CTID}${CL}"
-            pct stop "$CTID" &>/dev/null || true
-            pct destroy "$CTID" &>/dev/null || true
-            echo -e "${BFR}${CM}${GN}Container ${CTID} removed${CL}"
-        fi
-
-        exit $install_exit_code
-    fi
-}
-
-destroy_lxc() {
-    if [[ -z "$CT_ID" ]]; then
-        msg_error "No CT_ID found. Nothing to remove."
-        return 1
-    fi
-
-    # Abbruch bei Ctrl-C / Ctrl-D / ESC
-    trap 'echo; msg_error "Aborted by user (SIGINT/SIGQUIT)"; return 130' INT QUIT
-
-    local prompt
-    if ! read -rp "Remove this Container? <y/N> " prompt; then
-        # read gibt != 0 zurück bei Ctrl-D/ESC
-        msg_error "Aborted input (Ctrl-D/ESC)"
-        return 130
-    fi
-
-    case "${prompt,,}" in
-    y | yes)
-        if pct stop "$CT_ID" &>/dev/null && pct destroy "$CT_ID" &>/dev/null; then
-            msg_ok "Removed Container $CT_ID"
-        else
-            msg_error "Failed to remove Container $CT_ID"
-            return 1
-        fi
-        ;;
-    "" | n | no)
-        msg_custom "ℹ️" "${BL}" "Container was not removed."
-        ;;
-    *)
-        msg_warn "Invalid response. Container was not removed."
-        ;;
-    esac
-}
-
-# ------------------------------------------------------------------------------
-# Storage discovery / selection helpers
-# ------------------------------------------------------------------------------
-# ===== Storage discovery / selection helpers (ported from create_lxc.sh) =====
-resolve_storage_preselect() {
-    local class="$1" preselect="$2" required_content=""
-    case "$class" in
-    template) required_content="vztmpl" ;;
-    container) required_content="rootdir" ;;
-    *) return 1 ;;
-    esac
-    [[ -z "$preselect" ]] && return 1
-    if ! pvesm status -content "$required_content" | awk 'NR>1{print $1}' | grep -qx -- "$preselect"; then
-        msg_warn "Preselected storage '${preselect}' does not support content '${required_content}' (or not found)"
-        return 1
-    fi
-
-    local line total used free
-    line="$(pvesm status | awk -v s="$preselect" 'NR>1 && $1==s {print $0}')"
-    if [[ -z "$line" ]]; then
-        STORAGE_INFO="n/a"
-    else
-        total="$(awk '{print $4}' <<<"$line")"
-        used="$(awk '{print $5}' <<<"$line")"
-        free="$(awk '{print $6}' <<<"$line")"
-        local total_h used_h free_h
-        if command -v numfmt >/dev/null 2>&1; then
-            total_h="$(numfmt --to=iec --suffix=B --format %.1f "$total" 2>/dev/null || echo "$total")"
-            used_h="$(numfmt --to=iec --suffix=B --format %.1f "$used" 2>/dev/null || echo "$used")"
-            free_h="$(numfmt --to=iec --suffix=B --format %.1f "$free" 2>/dev/null || echo "$free")"
-            STORAGE_INFO="Free: ${free_h}  Used: ${used_h}"
-        else
-            STORAGE_INFO="Free: ${free}  Used: ${used}"
-        fi
-    fi
-    STORAGE_RESULT="$preselect"
-    return 0
-}
-
-fix_gpu_gids() {
-    if [[ -z "${GPU_TYPE:-}" ]]; then
-        return 0
-    fi
-
-    msg_info "Detecting and setting correct GPU group IDs"
-
-    # Get actual GIDs from container
-    local video_gid=$(pct exec "$CTID" -- sh -c "getent group video 2>/dev/null | cut -d: -f3")
-    local render_gid=$(pct exec "$CTID" -- sh -c "getent group render 2>/dev/null | cut -d: -f3")
-
-    # Create groups if they don't exist
-    if [[ -z "$video_gid" ]]; then
-        pct exec "$CTID" -- sh -c "groupadd -r video 2>/dev/null || true" >/dev/null 2>&1
-        video_gid=$(pct exec "$CTID" -- sh -c "getent group video 2>/dev/null | cut -d: -f3")
-        [[ -z "$video_gid" ]] && video_gid="44"
-    fi
-
-    if [[ -z "$render_gid" ]]; then
-        pct exec "$CTID" -- sh -c "groupadd -r render 2>/dev/null || true" >/dev/null 2>&1
-        render_gid=$(pct exec "$CTID" -- sh -c "getent group render 2>/dev/null | cut -d: -f3")
-        [[ -z "$render_gid" ]] && render_gid="104"
-    fi
-
-    # Stop container to update config
-    pct stop "$CTID" >/dev/null 2>&1
-    sleep 1
-
-    # Update dev entries with correct GIDs
-    sed -i.bak -E "s|(dev[0-9]+: /dev/dri/renderD[0-9]+),gid=[0-9]+|\1,gid=${render_gid}|g" "$LXC_CONFIG"
-    sed -i -E "s|(dev[0-9]+: /dev/dri/card[0-9]+),gid=[0-9]+|\1,gid=${video_gid}|g" "$LXC_CONFIG"
-
-    # Restart container
-    pct start "$CTID" >/dev/null 2>&1
-    sleep 2
-
-    msg_ok "GPU passthrough configured (video:${video_gid}, render:${render_gid})"
-
-    # For privileged containers: also fix permissions inside container
-    if [[ "$CT_TYPE" == "0" ]]; then
-        pct exec "$CTID" -- bash -c "
-      if [ -d /dev/dri ]; then
-        for dev in /dev/dri/*; do
-          if [ -e \"\$dev\" ]; then
-            if [[ \"\$dev\" =~ renderD ]]; then
-              chgrp ${render_gid} \"\$dev\" 2>/dev/null || true
-            else
-              chgrp ${video_gid} \"\$dev\" 2>/dev/null || true
-            fi
-            chmod 660 \"\$dev\" 2>/dev/null || true
-          fi
-        done
-      fi
-    " >/dev/null 2>&1
-    fi
-}
-
-check_storage_support() {
-    local CONTENT="$1" VALID=0
-    while IFS= read -r line; do
-        local STORAGE_NAME
-        STORAGE_NAME=$(awk '{print $1}' <<<"$line")
-        [[ -n "$STORAGE_NAME" ]] && VALID=1
-    done < <(pvesm status -content "$CONTENT" 2>/dev/null | awk 'NR>1')
-    [[ $VALID -eq 1 ]]
-}
-
-select_storage() {
-    local CLASS=$1 CONTENT CONTENT_LABEL
-    case $CLASS in
-    container)
-        CONTENT='rootdir'
-        CONTENT_LABEL='Container'
-        ;;
-    template)
-        CONTENT='vztmpl'
-        CONTENT_LABEL='Container template'
-        ;;
-    iso)
-        CONTENT='iso'
-        CONTENT_LABEL='ISO image'
-        ;;
-    images)
-        CONTENT='images'
-        CONTENT_LABEL='VM Disk image'
-        ;;
-    backup)
-        CONTENT='backup'
-        CONTENT_LABEL='Backup'
-        ;;
-    snippets)
-        CONTENT='snippets'
-        CONTENT_LABEL='Snippets'
-        ;;
-    *)
-        msg_error "Invalid storage class '$CLASS'"
-        return 1
-        ;;
-    esac
-
-    declare -A STORAGE_MAP
-    local -a MENU=()
-    local COL_WIDTH=0
-
-    while read -r TAG TYPE _ TOTAL USED FREE _; do
-        [[ -n "$TAG" && -n "$TYPE" ]] || continue
-        local DISPLAY="${TAG} (${TYPE})"
-        local USED_FMT=$(numfmt --to=iec --from-unit=K --format %.1f <<<"$USED")
-        local FREE_FMT=$(numfmt --to=iec --from-unit=K --format %.1f <<<"$FREE")
-        local INFO="Free: ${FREE_FMT}B  Used: ${USED_FMT}B"
-        STORAGE_MAP["$DISPLAY"]="$TAG"
-        MENU+=("$DISPLAY" "$INFO" "OFF")
-        ((${#DISPLAY} > COL_WIDTH)) && COL_WIDTH=${#DISPLAY}
-    done < <(pvesm status -content "$CONTENT" | awk 'NR>1')
-
-    if [[ ${#MENU[@]} -eq 0 ]]; then
-        msg_error "No storage found for content type '$CONTENT'."
-        return 2
-    fi
-
-    if [[ $((${#MENU[@]} / 3)) -eq 1 ]]; then
-        STORAGE_RESULT="${STORAGE_MAP[${MENU[0]}]}"
-        STORAGE_INFO="${MENU[1]}"
-        return 0
-    fi
-
-    local WIDTH=$((COL_WIDTH + 42))
-    while true; do
-        local DISPLAY_SELECTED
-        DISPLAY_SELECTED=$(whiptail --backtitle "[dev] Proxmox VE Helper Scripts" \
-            --title "Storage Pools" \
-            --radiolist "Which storage pool for ${CONTENT_LABEL,,}?\n(Spacebar to select)" \
-            16 "$WIDTH" 6 "${MENU[@]}" 3>&1 1>&2 2>&3) || { exit_script; }
-
-        DISPLAY_SELECTED=$(sed 's/[[:space:]]*$//' <<<"$DISPLAY_SELECTED")
-        if [[ -z "$DISPLAY_SELECTED" || -z "${STORAGE_MAP[$DISPLAY_SELECTED]+_}" ]]; then
-            whiptail --msgbox "No valid storage selected. Please try again." 8 58
-            continue
-        fi
-        STORAGE_RESULT="${STORAGE_MAP[$DISPLAY_SELECTED]}"
-        for ((i = 0; i < ${#MENU[@]}; i += 3)); do
-            if [[ "${MENU[$i]}" == "$DISPLAY_SELECTED" ]]; then
-                STORAGE_INFO="${MENU[$i + 1]}"
-                break
-            fi
-        done
-        return 0
-    done
-}
-
-create_lxc_container() {
-    # ------------------------------------------------------------------------------
-    # Optional verbose mode (debug tracing)
-    # ------------------------------------------------------------------------------
-    if [[ "${CREATE_LXC_VERBOSE:-no}" == "yes" ]]; then set -x; fi
-
-    # ------------------------------------------------------------------------------
-    # Helpers (dynamic versioning / template parsing)
-    # ------------------------------------------------------------------------------
-    pkg_ver() { dpkg-query -W -f='${Version}\n' "$1" 2>/dev/null || echo ""; }
-    pkg_cand() { apt-cache policy "$1" 2>/dev/null | awk '/Candidate:/ {print $2}'; }
-
-    ver_ge() { dpkg --compare-versions "$1" ge "$2"; }
-    ver_gt() { dpkg --compare-versions "$1" gt "$2"; }
-    ver_lt() { dpkg --compare-versions "$1" lt "$2"; }
-
-    # Extract Debian OS minor from template name: debian-13-standard_13.1-1_amd64.tar.zst => "13.1"
-    parse_template_osver() { sed -n 's/.*_\([0-9][0-9]*\(\.[0-9]\+\)\?\)-.*/\1/p' <<<"$1"; }
-
-    # Offer upgrade for pve-container/lxc-pve if candidate > installed; optional auto-retry pct create
-    # Returns:
-    #   0 = no upgrade needed
-    #   1 = upgraded (and if do_retry=yes and retry succeeded, creation done)
-    #   2 = user declined
-    #   3 = upgrade attempted but failed OR retry failed
-    offer_lxc_stack_upgrade_and_maybe_retry() {
-        local do_retry="${1:-no}" # yes|no
-        local _pvec_i _pvec_c _lxcp_i _lxcp_c need=0
-
-        _pvec_i="$(pkg_ver pve-container)"
-        _lxcp_i="$(pkg_ver lxc-pve)"
-        _pvec_c="$(pkg_cand pve-container)"
-        _lxcp_c="$(pkg_cand lxc-pve)"
-
-        if [[ -n "$_pvec_c" && "$_pvec_c" != "none" ]]; then
-            ver_gt "$_pvec_c" "${_pvec_i:-0}" && need=1
-        fi
-        if [[ -n "$_lxcp_c" && "$_lxcp_c" != "none" ]]; then
-            ver_gt "$_lxcp_c" "${_lxcp_i:-0}" && need=1
-        fi
-        if [[ $need -eq 0 ]]; then
-            msg_debug "No newer candidate for pve-container/lxc-pve (installed=$_pvec_i/$_lxcp_i, cand=$_pvec_c/$_lxcp_c)"
-            return 0
-        fi
-
-        echo
-        echo "An update for the Proxmox LXC stack is available:"
-        echo "  pve-container: installed=${_pvec_i:-n/a}  candidate=${_pvec_c:-n/a}"
-        echo "  lxc-pve     : installed=${_lxcp_i:-n/a}  candidate=${_lxcp_c:-n/a}"
-        echo
-        read -rp "Do you want to upgrade now? [y/N] " _ans
-        case "${_ans,,}" in
-        y | yes)
-            msg_info "Upgrading Proxmox LXC stack (pve-container, lxc-pve)"
-            if $STD apt-get update && $STD apt-get install -y --only-upgrade pve-container lxc-pve; then
-                msg_ok "LXC stack upgraded."
-                if [[ "$do_retry" == "yes" ]]; then
-                    msg_info "Retrying container creation after upgrade"
-                    if pct create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" $PCT_OPTIONS >>"$LOGFILE" 2>&1; then
-                        msg_ok "Container created successfully after upgrade."
-                        return 0
-                    else
-                        msg_error "pct create still failed after upgrade. See $LOGFILE"
-                        return 3
-                    fi
-                fi
-                return 1
-            else
-                msg_error "Upgrade failed. Please check APT output."
-                return 3
-            fi
-            ;;
-        *) return 2 ;;
-        esac
-    }
-
-    # ------------------------------------------------------------------------------
-    # Required input variables
-    # ------------------------------------------------------------------------------
-    [[ "${CTID:-}" ]] || {
-        msg_error "You need to set 'CTID' variable."
-        exit 203
-    }
-    [[ "${PCT_OSTYPE:-}" ]] || {
-        msg_error "You need to set 'PCT_OSTYPE' variable."
-        exit 204
-    }
-
-    msg_debug "CTID=$CTID"
-    msg_debug "PCT_OSTYPE=$PCT_OSTYPE"
-    msg_debug "PCT_OSVERSION=${PCT_OSVERSION:-default}"
-
-    # ID checks
-    [[ "$CTID" -ge 100 ]] || {
-        msg_error "ID cannot be less than 100."
-        exit 205
-    }
-    if qm status "$CTID" &>/dev/null || pct status "$CTID" &>/dev/null; then
-        echo -e "ID '$CTID' is already in use."
-        unset CTID
-        msg_error "Cannot use ID that is already in use."
-        exit 206
-    fi
-
-    # Storage capability check
-    check_storage_support "rootdir" || {
-        msg_error "No valid storage found for 'rootdir' [Container]"
-        exit 1
-    }
-    check_storage_support "vztmpl" || {
-        msg_error "No valid storage found for 'vztmpl' [Template]"
-        exit 1
-    }
-
-    # Template storage selection
-    if resolve_storage_preselect template "${TEMPLATE_STORAGE:-}"; then
-        TEMPLATE_STORAGE="$STORAGE_RESULT"
-        TEMPLATE_STORAGE_INFO="$STORAGE_INFO"
-        msg_ok "Storage ${BL}${TEMPLATE_STORAGE}${CL} (${TEMPLATE_STORAGE_INFO}) [Template]"
-    else
-        while true; do
-            if [[ -z "${var_template_storage:-}" ]]; then
-                if select_storage template; then
-                    TEMPLATE_STORAGE="$STORAGE_RESULT"
-                    TEMPLATE_STORAGE_INFO="$STORAGE_INFO"
-                    msg_ok "Storage ${BL}${TEMPLATE_STORAGE}${CL} (${TEMPLATE_STORAGE_INFO}) [Template]"
-                    break
-                fi
-            fi
-        done
-    fi
-
-    # Container storage selection
-    if resolve_storage_preselect container "${CONTAINER_STORAGE:-}"; then
-        CONTAINER_STORAGE="$STORAGE_RESULT"
-        CONTAINER_STORAGE_INFO="$STORAGE_INFO"
-        msg_ok "Storage ${BL}${CONTAINER_STORAGE}${CL} (${CONTAINER_STORAGE_INFO}) [Container]"
-    else
-        if [[ -z "${var_container_storage:-}" ]]; then
-            if select_storage container; then
-                CONTAINER_STORAGE="$STORAGE_RESULT"
-                CONTAINER_STORAGE_INFO="$STORAGE_INFO"
-                msg_ok "Storage ${BL}${CONTAINER_STORAGE}${CL} (${CONTAINER_STORAGE_INFO}) [Container]"
-            fi
-        fi
-    fi
-
-    msg_info "Validating storage '$CONTAINER_STORAGE'"
-    STORAGE_TYPE=$(grep -E "^[^:]+: $CONTAINER_STORAGE$" /etc/pve/storage.cfg | cut -d: -f1 | head -1)
-
-    case "$STORAGE_TYPE" in
-    iscsidirect) exit 212 ;;
-    iscsi | zfs) exit 213 ;;
-    cephfs) exit 219 ;;
-    pbs) exit 224 ;;
-    linstor | rbd | nfs | cifs)
-        pvesm status -storage "$CONTAINER_STORAGE" &>/dev/null || exit 217
-        ;;
-    esac
-
-    pvesm status -content rootdir 2>/dev/null | awk 'NR>1{print $1}' | grep -qx "$CONTAINER_STORAGE" || exit 213
-    msg_ok "Storage '$CONTAINER_STORAGE' ($STORAGE_TYPE) validated"
-
-    msg_info "Validating template storage '$TEMPLATE_STORAGE'"
-    TEMPLATE_TYPE=$(grep -E "^[^:]+: $TEMPLATE_STORAGE$" /etc/pve/storage.cfg | cut -d: -f1)
-
-    if ! pvesm status -content vztmpl 2>/dev/null | awk 'NR>1{print $1}' | grep -qx "$TEMPLATE_STORAGE"; then
-        msg_warn "Template storage '$TEMPLATE_STORAGE' may not support 'vztmpl'"
-    fi
-    msg_ok "Template storage '$TEMPLATE_STORAGE' validated"
-
-    # Free space check
-    STORAGE_FREE=$(pvesm status | awk -v s="$CONTAINER_STORAGE" '$1 == s { print $6 }')
-    REQUIRED_KB=$((${PCT_DISK_SIZE:-8} * 1024 * 1024))
-    [[ "$STORAGE_FREE" -ge "$REQUIRED_KB" ]] || {
-        msg_error "Not enough space on '$CONTAINER_STORAGE'. Needed: ${PCT_DISK_SIZE:-8}G."
-        exit 214
-    }
-
-    # Cluster quorum (if cluster)
-    if [[ -f /etc/pve/corosync.conf ]]; then
-        msg_info "Checking cluster quorum"
-        if ! pvecm status | awk -F':' '/^Quorate/ { exit ($2 ~ /Yes/) ? 0 : 1 }'; then
-            msg_error "Cluster is not quorate. Start all nodes or configure quorum device (QDevice)."
-            exit 210
-        fi
-        msg_ok "Cluster is quorate"
-    fi
-
-    # ------------------------------------------------------------------------------
-    # Template discovery & validation
-    # Supported OS types (PVE 9.x): alpine, archlinux, centos, debian, devuan,
-    #                               fedora, gentoo, nixos, opensuse, ubuntu, unmanaged
-    # ------------------------------------------------------------------------------
-    TEMPLATE_SEARCH="${PCT_OSTYPE}-${PCT_OSVERSION:-}"
-    case "$PCT_OSTYPE" in
-    debian | ubuntu | devuan) TEMPLATE_PATTERN="-standard_" ;;
-    alpine | fedora | rocky | centos | almalinux) TEMPLATE_PATTERN="-default_" ;;
-    archlinux) TEMPLATE_PATTERN="-base_" ;;
-    gentoo) TEMPLATE_PATTERN="-current_" ;;
-    opensuse) TEMPLATE_PATTERN="-default_" ;;
-    nixos) TEMPLATE_PATTERN="-" ;;
-    *) TEMPLATE_PATTERN="" ;;
-    esac
-
-    msg_info "Searching for template '$TEMPLATE_SEARCH'"
-
-    # Build regex patterns outside awk/grep for clarity
-    SEARCH_PATTERN="^${TEMPLATE_SEARCH}"
-
-    #echo "[DEBUG] TEMPLATE_SEARCH='$TEMPLATE_SEARCH'"
-    #echo "[DEBUG] SEARCH_PATTERN='$SEARCH_PATTERN'"
-    #echo "[DEBUG] TEMPLATE_PATTERN='$TEMPLATE_PATTERN'"
-
-    mapfile -t LOCAL_TEMPLATES < <(
-        pveam list "$TEMPLATE_STORAGE" 2>/dev/null |
-            awk -v search="${SEARCH_PATTERN}" -v pattern="${TEMPLATE_PATTERN}" '$1 ~ search && $1 ~ pattern {print $1}' |
-            sed 's|.*/||' | sort -t - -k 2 -V
-    )
-
-    pveam update >/dev/null 2>&1 || msg_warn "Could not update template catalog (pveam update failed)."
-
-    msg_ok "Template search completed"
-
-    #echo "[DEBUG] pveam available output (first 5 lines with .tar files):"
-    #pveam available -section system 2>/dev/null | grep -E '\.(tar\.zst|tar\.xz|tar\.gz)$' | head -5 | sed 's/^/  /'
-
-    set +u
-    mapfile -t ONLINE_TEMPLATES < <(pveam available -section system 2>/dev/null | grep -E '\.(tar\.zst|tar\.xz|tar\.gz)$' | awk '{print $2}' | grep -E "${SEARCH_PATTERN}.*${TEMPLATE_PATTERN}" | sort -t - -k 2 -V 2>/dev/null || true)
-    #echo "[DEBUG] After filtering: ${#ONLINE_TEMPLATES[@]} online templates found"
-    set -u
-
-    ONLINE_TEMPLATE=""
-    [[ ${#ONLINE_TEMPLATES[@]} -gt 0 ]] && ONLINE_TEMPLATE="${ONLINE_TEMPLATES[-1]}"
-
-    #msg_debug "SEARCH_PATTERN='${SEARCH_PATTERN}' TEMPLATE_PATTERN='${TEMPLATE_PATTERN}'"
-    #msg_debug "Found ${#LOCAL_TEMPLATES[@]} local templates, ${#ONLINE_TEMPLATES[@]} online templates"
-    if [[ ${#ONLINE_TEMPLATES[@]} -gt 0 ]]; then
-        #msg_debug "First 3 online templates:"
-        count=0
-        for idx in "${!ONLINE_TEMPLATES[@]}"; do
-            #msg_debug "  [$idx]: ${ONLINE_TEMPLATES[$idx]}"
-            ((count++))
-            [[ $count -ge 3 ]] && break
-        done
-    fi
-    #msg_debug "ONLINE_TEMPLATE='$ONLINE_TEMPLATE'"
-
-    if [[ ${#LOCAL_TEMPLATES[@]} -gt 0 ]]; then
-        TEMPLATE="${LOCAL_TEMPLATES[-1]}"
-        TEMPLATE_SOURCE="local"
-    else
-        TEMPLATE="$ONLINE_TEMPLATE"
-        TEMPLATE_SOURCE="online"
-    fi
-
-    # If still no template, try to find alternatives
-    if [[ -z "$TEMPLATE" ]]; then
-        echo ""
-        echo "[DEBUG] No template found for ${PCT_OSTYPE} ${PCT_OSVERSION}, searching for alternatives..."
-
-        # Get all available versions for this OS type
-        mapfile -t AVAILABLE_VERSIONS < <(
-            pveam available -section system 2>/dev/null |
-                grep -E '\.(tar\.zst|tar\.xz|tar\.gz)$' |
-                awk -F'\t' '{print $1}' |
-                grep "^${PCT_OSTYPE}-" |
-                sed -E "s/.*${PCT_OSTYPE}-([0-9]+(\.[0-9]+)?).*/\1/" |
-                sort -u -V 2>/dev/null
-        )
-
-        if [[ ${#AVAILABLE_VERSIONS[@]} -gt 0 ]]; then
-            echo ""
-            echo "${BL}Available ${PCT_OSTYPE} versions:${CL}"
-            for i in "${!AVAILABLE_VERSIONS[@]}"; do
-                echo "  [$((i + 1))] ${AVAILABLE_VERSIONS[$i]}"
-            done
-            echo ""
-            read -p "Select version [1-${#AVAILABLE_VERSIONS[@]}] or press Enter to cancel: " choice
-
-            if [[ "$choice" =~ ^[0-9]+$ ]] && [[ "$choice" -ge 1 ]] && [[ "$choice" -le ${#AVAILABLE_VERSIONS[@]} ]]; then
-                PCT_OSVERSION="${AVAILABLE_VERSIONS[$((choice - 1))]}"
-                TEMPLATE_SEARCH="${PCT_OSTYPE}-${PCT_OSVERSION}"
-                SEARCH_PATTERN="^${TEMPLATE_SEARCH}-"
-
-                #echo "[DEBUG] Retrying with version: $PCT_OSVERSION"
-
-                mapfile -t ONLINE_TEMPLATES < <(
-                    pveam available -section system 2>/dev/null |
-                        grep -E '\.(tar\.zst|tar\.xz|tar\.gz)$' |
-                        awk -F'\t' '{print $1}' |
-                        grep -E "${SEARCH_PATTERN}.*${TEMPLATE_PATTERN}" |
-                        sort -t - -k 2 -V 2>/dev/null || true
-                )
-
-                if [[ ${#ONLINE_TEMPLATES[@]} -gt 0 ]]; then
-                    TEMPLATE="${ONLINE_TEMPLATES[-1]}"
-                    TEMPLATE_SOURCE="online"
-                    #echo "[DEBUG] Found alternative: $TEMPLATE"
-                else
-                    msg_error "No templates available for ${PCT_OSTYPE} ${PCT_OSVERSION}"
-                    exit 225
-                fi
-            else
-                msg_custom "🚫" "${YW}" "Installation cancelled"
-                exit 0
-            fi
-        else
-            msg_error "No ${PCT_OSTYPE} templates available at all"
-            exit 225
-        fi
-    fi
-
-    #echo "[DEBUG] Selected TEMPLATE='$TEMPLATE' SOURCE='$TEMPLATE_SOURCE'"
-    #msg_debug "Selected TEMPLATE='$TEMPLATE' SOURCE='$TEMPLATE_SOURCE'"
-
-    TEMPLATE_PATH="$(pvesm path $TEMPLATE_STORAGE:vztmpl/$TEMPLATE 2>/dev/null || true)"
-    if [[ -z "$TEMPLATE_PATH" ]]; then
-        TEMPLATE_BASE=$(awk -v s="$TEMPLATE_STORAGE" '$1==s {f=1} f && /path/ {print $2; exit}' /etc/pve/storage.cfg)
-        [[ -n "$TEMPLATE_BASE" ]] && TEMPLATE_PATH="$TEMPLATE_BASE/template/cache/$TEMPLATE"
-    fi
-
-    # If we still don't have a path but have a valid template name, construct it
-    if [[ -z "$TEMPLATE_PATH" && -n "$TEMPLATE" ]]; then
-        TEMPLATE_PATH="/var/lib/vz/template/cache/$TEMPLATE"
-    fi
-
-    [[ -n "$TEMPLATE_PATH" ]] || {
-        if [[ -z "$TEMPLATE" ]]; then
-            msg_error "Template ${PCT_OSTYPE} ${PCT_OSVERSION} not available"
-
-            # Get available versions
-            mapfile -t AVAILABLE_VERSIONS < <(
-                pveam available -section system 2>/dev/null |
-                    grep "^${PCT_OSTYPE}-" |
-                    sed -E 's/.*'"${PCT_OSTYPE}"'-([0-9]+\.[0-9]+).*/\1/' |
-                    grep -E '^[0-9]+\.[0-9]+$' |
-                    sort -u -V 2>/dev/null || sort -u
-            )
-
-            if [[ ${#AVAILABLE_VERSIONS[@]} -gt 0 ]]; then
-                echo -e "\n${BL}Available versions:${CL}"
-                for i in "${!AVAILABLE_VERSIONS[@]}"; do
-                    echo "  [$((i + 1))] ${AVAILABLE_VERSIONS[$i]}"
-                done
-
-                echo ""
-                read -p "Select version [1-${#AVAILABLE_VERSIONS[@]}] or Enter to exit: " choice
-
-                if [[ "$choice" =~ ^[0-9]+$ ]] && [[ "$choice" -ge 1 ]] && [[ "$choice" -le ${#AVAILABLE_VERSIONS[@]} ]]; then
-                    export var_version="${AVAILABLE_VERSIONS[$((choice - 1))]}"
-                    export PCT_OSVERSION="$var_version"
-                    msg_ok "Switched to ${PCT_OSTYPE} ${var_version}"
-
-                    # Retry template search with new version
-                    TEMPLATE_SEARCH="${PCT_OSTYPE}-${PCT_OSVERSION:-}"
-                    SEARCH_PATTERN="^${TEMPLATE_SEARCH}-"
-
-                    mapfile -t LOCAL_TEMPLATES < <(
-                        pveam list "$TEMPLATE_STORAGE" 2>/dev/null |
-                            awk -v search="${SEARCH_PATTERN}" -v pattern="${TEMPLATE_PATTERN}" '$1 ~ search && $1 ~ pattern {print $1}' |
-                            sed 's|.*/||' | sort -t - -k 2 -V
-                    )
-                    mapfile -t ONLINE_TEMPLATES < <(
-                        pveam available -section system 2>/dev/null |
-                            grep -E '\.(tar\.zst|tar\.xz|tar\.gz)$' |
-                            awk -F'\t' '{print $1}' |
-                            grep -E "${SEARCH_PATTERN}.*${TEMPLATE_PATTERN}" |
-                            sort -t - -k 2 -V 2>/dev/null || true
-                    )
-                    ONLINE_TEMPLATE=""
-                    [[ ${#ONLINE_TEMPLATES[@]} -gt 0 ]] && ONLINE_TEMPLATE="${ONLINE_TEMPLATES[-1]}"
-
-                    if [[ ${#LOCAL_TEMPLATES[@]} -gt 0 ]]; then
-                        TEMPLATE="${LOCAL_TEMPLATES[-1]}"
-                        TEMPLATE_SOURCE="local"
-                    else
-                        TEMPLATE="$ONLINE_TEMPLATE"
-                        TEMPLATE_SOURCE="online"
-                    fi
-
-                    TEMPLATE_PATH="$(pvesm path $TEMPLATE_STORAGE:vztmpl/$TEMPLATE 2>/dev/null || true)"
-                    if [[ -z "$TEMPLATE_PATH" ]]; then
-                        TEMPLATE_BASE=$(awk -v s="$TEMPLATE_STORAGE" '$1==s {f=1} f && /path/ {print $2; exit}' /etc/pve/storage.cfg)
-                        [[ -n "$TEMPLATE_BASE" ]] && TEMPLATE_PATH="$TEMPLATE_BASE/template/cache/$TEMPLATE"
-                    fi
-
-                    # If we still don't have a path but have a valid template name, construct it
-                    if [[ -z "$TEMPLATE_PATH" && -n "$TEMPLATE" ]]; then
-                        TEMPLATE_PATH="/var/lib/vz/template/cache/$TEMPLATE"
-                    fi
-
-                    [[ -n "$TEMPLATE_PATH" ]] || {
-                        msg_error "Template still not found after version change"
-                        exit 220
-                    }
-                else
-                    msg_custom "🚫" "${YW}" "Installation cancelled"
-                    exit 1
-                fi
-            else
-                msg_error "No ${PCT_OSTYPE} templates available"
-                exit 220
-            fi
-        fi
-    }
-
-    # Validate that we found a template
-    if [[ -z "$TEMPLATE" ]]; then
-        msg_error "No template found for ${PCT_OSTYPE} ${PCT_OSVERSION}"
-        msg_custom "ℹ️" "${YW}" "Please check:"
-        msg_custom "  •" "${YW}" "Is pveam catalog available? (run: pveam available -section system)"
-        msg_custom "  •" "${YW}" "Does the template exist for your OS version?"
-        exit 225
-    fi
-
-    msg_ok "Template ${BL}$TEMPLATE${CL} [$TEMPLATE_SOURCE]"
-    msg_debug "Resolved TEMPLATE_PATH=$TEMPLATE_PATH"
-
-    NEED_DOWNLOAD=0
-    if [[ ! -f "$TEMPLATE_PATH" ]]; then
-        msg_info "Template not present locally – will download."
-        NEED_DOWNLOAD=1
-    elif [[ ! -r "$TEMPLATE_PATH" ]]; then
-        msg_error "Template file exists but is not readable – check permissions."
-        exit 221
-    elif [[ "$(stat -c%s "$TEMPLATE_PATH")" -lt 1000000 ]]; then
-        if [[ -n "$ONLINE_TEMPLATE" ]]; then
-            msg_warn "Template file too small (<1MB) – re-downloading."
-            NEED_DOWNLOAD=1
-        else
-            msg_warn "Template looks too small, but no online version exists. Keeping local file."
-        fi
-    elif ! tar -tf "$TEMPLATE_PATH" &>/dev/null; then
-        if [[ -n "$ONLINE_TEMPLATE" ]]; then
-            msg_warn "Template appears corrupted – re-downloading."
-            NEED_DOWNLOAD=1
-        else
-            msg_warn "Template appears corrupted, but no online version exists. Keeping local file."
-        fi
-    else
-        $STD msg_ok "Template $TEMPLATE is present and valid."
-    fi
-
-    if [[ "$TEMPLATE_SOURCE" == "local" && -n "$ONLINE_TEMPLATE" && "$TEMPLATE" != "$ONLINE_TEMPLATE" ]]; then
-        msg_warn "Local template is outdated: $TEMPLATE (latest available: $ONLINE_TEMPLATE)"
-        if whiptail --yesno "A newer template is available:\n$ONLINE_TEMPLATE\n\nDo you want to download and use it instead?" 12 70; then
-            TEMPLATE="$ONLINE_TEMPLATE"
-            NEED_DOWNLOAD=1
-        else
-            msg_custom "ℹ️" "${BL}" "Continuing with local template $TEMPLATE"
-        fi
-    fi
-
-    if [[ "$NEED_DOWNLOAD" -eq 1 ]]; then
-        [[ -f "$TEMPLATE_PATH" ]] && rm -f "$TEMPLATE_PATH"
-        for attempt in {1..3}; do
-            msg_info "Attempt $attempt: Downloading template $TEMPLATE to $TEMPLATE_STORAGE"
-            if pveam download "$TEMPLATE_STORAGE" "$TEMPLATE" >/dev/null 2>&1; then
-                msg_ok "Template download successful."
-                break
-            fi
-            if [[ $attempt -eq 3 ]]; then
-                msg_error "Failed after 3 attempts. Please check network access, permissions, or manually run:\n  pveam download $TEMPLATE_STORAGE $TEMPLATE"
-                exit 222
-            fi
-            sleep $((attempt * 5))
-        done
-    fi
-
-    if ! pveam list "$TEMPLATE_STORAGE" 2>/dev/null | grep -q "$TEMPLATE"; then
-        msg_error "Template $TEMPLATE not available in storage $TEMPLATE_STORAGE after download."
-        exit 223
-    fi
-
-    # ------------------------------------------------------------------------------
-    # Dynamic preflight for Debian 13.x: offer upgrade if available (no hard mins)
-    # ------------------------------------------------------------------------------
-    if [[ "$PCT_OSTYPE" == "debian" ]]; then
-        OSVER="$(parse_template_osver "$TEMPLATE")"
-        if [[ -n "$OSVER" ]]; then
-            # Proactive, aber ohne Abbruch – nur Angebot
-            offer_lxc_stack_upgrade_and_maybe_retry "no" || true
-        fi
-    fi
-
-    # ------------------------------------------------------------------------------
-    # Create LXC Container
-    # ------------------------------------------------------------------------------
-    msg_info "Creating LXC container"
-
-    # Ensure subuid/subgid entries exist
-    grep -q "root:100000:65536" /etc/subuid || echo "root:100000:65536" >>/etc/subuid
-    grep -q "root:100000:65536" /etc/subgid || echo "root:100000:65536" >>/etc/subgid
-
-    # PCT_OPTIONS is now a string (exported from build_container)
-    # Add rootfs if not already specified
-    if [[ ! "$PCT_OPTIONS" =~ "-rootfs" ]]; then
-        PCT_OPTIONS="$PCT_OPTIONS
-  -rootfs $CONTAINER_STORAGE:${PCT_DISK_SIZE:-8}"
-    fi
-
-    # Lock by template file (avoid concurrent downloads/creates)
-    lockfile="/tmp/template.${TEMPLATE}.lock"
-    exec 9>"$lockfile" || {
-        msg_error "Failed to create lock file '$lockfile'."
-        exit 200
-    }
-    flock -w 60 9 || {
-        msg_error "Timeout while waiting for template lock."
-        exit 211
-    }
-
-    LOGFILE="/tmp/pct_create_${CTID}_$(date +%Y%m%d_%H%M%S)_${SESSION_ID}.log"
-
-    # # DEBUG: Show the actual command that will be executed
-    # echo "[DEBUG] ===== PCT CREATE COMMAND DETAILS ====="
-    # echo "[DEBUG] CTID: $CTID"
-    # echo "[DEBUG] Template: ${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}"
-    # echo "[DEBUG] PCT_OPTIONS (will be word-split):"
-    # echo "$PCT_OPTIONS" | sed 's/^/  /'
-    # echo "[DEBUG] Full command line:"
-    # echo "  pct create $CTID ${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE} $PCT_OPTIONS"
-    # echo "[DEBUG] ========================================"
-
-    msg_debug "pct create command: pct create $CTID ${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE} $PCT_OPTIONS"
-    msg_debug "Logfile: $LOGFILE"
-
-    # First attempt (PCT_OPTIONS is a multi-line string, use it directly)
-    if ! pct create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" $PCT_OPTIONS >"$LOGFILE" 2>&1; then
-        msg_debug "Container creation failed on ${TEMPLATE_STORAGE}. Validating template..."
-
-        # Validate template file
-        if [[ ! -s "$TEMPLATE_PATH" || "$(stat -c%s "$TEMPLATE_PATH")" -lt 1000000 ]]; then
-            msg_warn "Template file too small or missing – re-downloading."
-            rm -f "$TEMPLATE_PATH"
-            pveam download "$TEMPLATE_STORAGE" "$TEMPLATE"
-        elif ! tar -tf "$TEMPLATE_PATH" &>/dev/null; then
-            if [[ -n "$ONLINE_TEMPLATE" ]]; then
-                msg_warn "Template appears corrupted – re-downloading."
-                rm -f "$TEMPLATE_PATH"
-                pveam download "$TEMPLATE_STORAGE" "$TEMPLATE"
-            else
-                msg_warn "Template appears corrupted, but no online version exists. Skipping re-download."
-            fi
-        fi
-
-        # Retry after repair
-        if ! pct create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" $PCT_OPTIONS >>"$LOGFILE" 2>&1; then
-            # Fallback to local storage if not already on local
-            if [[ "$TEMPLATE_STORAGE" != "local" ]]; then
-                msg_info "Retrying container creation with fallback to local storage..."
-                LOCAL_TEMPLATE_PATH="/var/lib/vz/template/cache/$TEMPLATE"
-                if [[ ! -f "$LOCAL_TEMPLATE_PATH" ]]; then
-                    msg_info "Downloading template to local..."
-                    pveam download local "$TEMPLATE" >/dev/null 2>&1
-                fi
-                if ! pct create "$CTID" "local:vztmpl/${TEMPLATE}" $PCT_OPTIONS >>"$LOGFILE" 2>&1; then
-                    # Local fallback also failed - check for LXC stack version issue
-                    if grep -qiE 'unsupported .* version' "$LOGFILE"; then
-                        echo
-                        echo "pct reported 'unsupported ... version' – your LXC stack might be too old for this template."
-                        echo "We can try to upgrade 'pve-container' and 'lxc-pve' now and retry automatically."
-                        offer_lxc_stack_upgrade_and_maybe_retry "yes"
-                        rc=$?
-                        case $rc in
-                        0) : ;; # success - container created, continue
-                        2)
-                            echo "Upgrade was declined. Please update and re-run:
-  apt update && apt install --only-upgrade pve-container lxc-pve"
-                            exit 231
-                            ;;
-                        3)
-                            echo "Upgrade and/or retry failed. Please inspect: $LOGFILE"
-                            exit 231
-                            ;;
-                        esac
-                    else
-                        msg_error "Container creation failed. See $LOGFILE"
-                        if whiptail --yesno "pct create failed.\nDo you want to enable verbose debug mode and view detailed logs?" 12 70; then
-                            set -x
-                            pct create "$CTID" "local:vztmpl/${TEMPLATE}" $PCT_OPTIONS 2>&1 | tee -a "$LOGFILE"
-                            set +x
-                        fi
-                        exit 209
-                    fi
-                else
-                    msg_ok "Container successfully created using local fallback."
-                fi
-            else
-                # Already on local storage and still failed - check LXC stack version
-                if grep -qiE 'unsupported .* version' "$LOGFILE"; then
-                    echo
-                    echo "pct reported 'unsupported ... version' – your LXC stack might be too old for this template."
-                    echo "We can try to upgrade 'pve-container' and 'lxc-pve' now and retry automatically."
-                    offer_lxc_stack_upgrade_and_maybe_retry "yes"
-                    rc=$?
-                    case $rc in
-                    0) : ;; # success - container created, continue
-                    2)
-                        echo "Upgrade was declined. Please update and re-run:
-  apt update && apt install --only-upgrade pve-container lxc-pve"
-                        exit 231
-                        ;;
-                    3)
-                        echo "Upgrade and/or retry failed. Please inspect: $LOGFILE"
-                        exit 231
-                        ;;
-                    esac
-                else
-                    msg_error "Container creation failed. See $LOGFILE"
-                    if whiptail --yesno "pct create failed.\nDo you want to enable verbose debug mode and view detailed logs?" 12 70; then
-                        set -x
-                        pct create "$CTID" "local:vztmpl/${TEMPLATE}" $PCT_OPTIONS 2>&1 | tee -a "$LOGFILE"
-                        set +x
-                    fi
-                    exit 209
-                fi
-            fi
-        else
-            msg_ok "Container successfully created after template repair."
-        fi
-    fi
-
-    # Verify container exists
-    pct list | awk '{print $1}' | grep -qx "$CTID" || {
-        msg_error "Container ID $CTID not listed in 'pct list'. See $LOGFILE"
-        exit 215
-    }
-
-    # Verify config rootfs
-    grep -q '^rootfs:' "/etc/pve/lxc/$CTID.conf" || {
-        msg_error "RootFS entry missing in container config. See $LOGFILE"
-        exit 216
-    }
-
-    msg_ok "LXC Container ${BL}$CTID${CL} ${GN}was successfully created."
-
-    # Report container creation to API
-    post_to_api
-}
-
-# ==============================================================================
-# SECTION 9: POST-INSTALLATION & FINALIZATION
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# description()
-#
-# - Sets container description with formatted HTML content
-# - Includes:
-#   * Community-Scripts logo
-#   * Application name
-#   * Links to GitHub, Discussions, Issues
-#   * Ko-fi donation badge
-# - Restarts ping-instances.service if present (monitoring)
-# - Posts final "done" status to API telemetry
-# ------------------------------------------------------------------------------
-description() {
-    IP=$(pct exec "$CTID" ip a s dev eth0 | awk '/inet / {print $2}' | cut -d/ -f1)
-
-    # Generate LXC Description
-    DESCRIPTION=$(
-        cat <<EOF
-<div align='center'>
-  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
-    <img src='https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
-  </a>
-
-  <h2 style='font-size: 24px; margin: 20px 0;'>${APP} LXC</h2>
-
-  <p style='margin: 16px 0;'>
-    <a href='https://ko-fi.com/community_scripts' target='_blank' rel='noopener noreferrer'>
-      <img src='https://img.shields.io/badge/&#x2615;-Buy us a coffee-blue' alt='spend Coffee' />
-    </a>
-  </p>
-
-  <span style='margin: 0 10px;'>
-    <i class="fa fa-github fa-fw" style="color: #f5f5f5;"></i>
-    <a href='https://github.com/community-scripts/ProxmoxVED' target='_blank' rel='noopener noreferrer' style='text-decoration: none; color: #00617f;'>GitHub</a>
-  </span>
-  <span style='margin: 0 10px;'>
-    <i class="fa fa-comments fa-fw" style="color: #f5f5f5;"></i>
-    <a href='https://github.com/community-scripts/ProxmoxVED/discussions' target='_blank' rel='noopener noreferrer' style='text-decoration: none; color: #00617f;'>Discussions</a>
-  </span>
-  <span style='margin: 0 10px;'>
-    <i class="fa fa-exclamation-circle fa-fw" style="color: #f5f5f5;"></i>
-    <a href='https://github.com/community-scripts/ProxmoxVED/issues' target='_blank' rel='noopener noreferrer' style='text-decoration: none; color: #00617f;'>Issues</a>
-  </span>
-</div>
-EOF
-    )
-    pct set "$CTID" -description "$DESCRIPTION"
-
-    if [[ -f /etc/systemd/system/ping-instances.service ]]; then
-        systemctl start ping-instances.service
-    fi
-
-    post_update_to_api "done" "none"
-}
-
-# ==============================================================================
-# SECTION 10: ERROR HANDLING & EXIT TRAPS
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# api_exit_script()
-#
-# - Exit trap handler for reporting to API telemetry
-# - Captures exit code and reports to API using centralized error descriptions
-# - Uses explain_exit_code() from error_handler.func for consistent error messages
-# - Posts failure status with exit code to API (error description added automatically)
-# - Only executes on non-zero exit codes
-# ------------------------------------------------------------------------------
-api_exit_script() {
-    exit_code=$?
-    if [ $exit_code -ne 0 ]; then
-        post_update_to_api "failed" "$exit_code"
-    fi
-}
-
-if command -v pveversion >/dev/null 2>&1; then
-    trap 'api_exit_script' EXIT
-fi
-trap 'post_update_to_api "failed" "$BASH_COMMAND"' ERR
-trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
-trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
diff --git a/misc/bak_december/install copy.func b/misc/bak_december/install copy.func
deleted file mode 100644
index 2abfccdf..00000000
--- a/misc/bak_december/install copy.func	
+++ /dev/null
@@ -1,277 +0,0 @@
-# Copyright (c) 2021-2026 tteck
-# Author: tteck (tteckster)
-# Co-Author: MickLesk
-# Co-Author: michelroegl-brunner
-# License: MIT | https://github.com/community-scripts/ProxmoxVED/raw/main/LICENSE
-
-# ==============================================================================
-# INSTALL.FUNC - CONTAINER INSTALLATION & SETUP
-# ==============================================================================
-#
-# This file provides installation functions executed inside LXC containers
-# after creation. Handles:
-#
-#   - Network connectivity verification (IPv4/IPv6)
-#   - OS updates and package installation
-#   - DNS resolution checks
-#   - MOTD and SSH configuration
-#   - Container customization and auto-login
-#
-# Usage:
-#   - Sourced by <app>-install.sh scripts
-#   - Executes via pct exec inside container
-#   - Requires internet connectivity
-#
-# ==============================================================================
-
-# ==============================================================================
-# SECTION 1: INITIALIZATION
-# ==============================================================================
-
-if ! command -v curl >/dev/null 2>&1; then
-  printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
-  apt-get update >/dev/null 2>&1
-  apt-get install -y curl >/dev/null 2>&1
-fi
-source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/core.func)
-source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/error_handler.func)
-load_functions
-catch_errors
-
-# ==============================================================================
-# SECTION 2: NETWORK & CONNECTIVITY
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# verb_ip6()
-#
-# - Configures IPv6 based on DISABLEIPV6 variable
-# - If DISABLEIPV6=yes: disables IPv6 via sysctl
-# - Sets verbose mode via set_std_mode()
-# ------------------------------------------------------------------------------
-verb_ip6() {
-  set_std_mode # Set STD mode based on VERBOSE
-
-  if [ "$DISABLEIPV6" == "yes" ]; then
-    echo "net.ipv6.conf.all.disable_ipv6 = 1" >>/etc/sysctl.conf
-    $STD sysctl -p
-  fi
-}
-
-# ------------------------------------------------------------------------------
-# setting_up_container()
-#
-# - Verifies network connectivity via hostname -I
-# - Retries up to RETRY_NUM times with RETRY_EVERY seconds delay
-# - Removes Python EXTERNALLY-MANAGED restrictions
-# - Disables systemd-networkd-wait-online.service for faster boot
-# - Exits with error if network unavailable after retries
-# ------------------------------------------------------------------------------
-setting_up_container() {
-  msg_info "Setting up Container OS"
-  for ((i = RETRY_NUM; i > 0; i--)); do
-    if [ "$(hostname -I)" != "" ]; then
-      break
-    fi
-    echo 1>&2 -en "${CROSS}${RD} No Network! "
-    sleep $RETRY_EVERY
-  done
-  if [ "$(hostname -I)" = "" ]; then
-    echo 1>&2 -e "\n${CROSS}${RD} No Network After $RETRY_NUM Tries${CL}"
-    echo -e "${NETWORK}Check Network Settings"
-    exit 1
-  fi
-  rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED
-  systemctl disable -q --now systemd-networkd-wait-online.service
-  msg_ok "Set up Container OS"
-  #msg_custom "${CM}" "${GN}" "Network Connected: ${BL}$(hostname -I)"
-  msg_ok "Network Connected: ${BL}$(hostname -I)"
-}
-
-# ------------------------------------------------------------------------------
-# network_check()
-#
-# - Comprehensive network connectivity check for IPv4 and IPv6
-# - Tests connectivity to multiple DNS servers:
-#   * IPv4: 1.1.1.1 (Cloudflare), 8.8.8.8 (Google), 9.9.9.9 (Quad9)
-#   * IPv6: 2606:4700:4700::1111, 2001:4860:4860::8888, 2620:fe::fe
-# - Verifies DNS resolution for GitHub and Community-Scripts domains
-# - Prompts user to continue if no internet detected
-# - Uses fatal() on DNS resolution failure for critical hosts
-# ------------------------------------------------------------------------------
-network_check() {
-  set +e
-  trap - ERR
-  ipv4_connected=false
-  ipv6_connected=false
-  sleep 1
-
-  # Check IPv4 connectivity to Google, Cloudflare & Quad9 DNS servers.
-  if ping -c 1 -W 1 1.1.1.1 &>/dev/null || ping -c 1 -W 1 8.8.8.8 &>/dev/null || ping -c 1 -W 1 9.9.9.9 &>/dev/null; then
-    msg_ok "IPv4 Internet Connected"
-    ipv4_connected=true
-  else
-    msg_error "IPv4 Internet Not Connected"
-  fi
-
-  # Check IPv6 connectivity to Google, Cloudflare & Quad9 DNS servers.
-  if ping6 -c 1 -W 1 2606:4700:4700::1111 &>/dev/null || ping6 -c 1 -W 1 2001:4860:4860::8888 &>/dev/null || ping6 -c 1 -W 1 2620:fe::fe &>/dev/null; then
-    msg_ok "IPv6 Internet Connected"
-    ipv6_connected=true
-  else
-    msg_error "IPv6 Internet Not Connected"
-  fi
-
-  # If both IPv4 and IPv6 checks fail, prompt the user
-  if [[ $ipv4_connected == false && $ipv6_connected == false ]]; then
-    read -r -p "No Internet detected, would you like to continue anyway? <y/N> " prompt
-    if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
-      echo -e "${INFO}${RD}Expect Issues Without Internet${CL}"
-    else
-      echo -e "${NETWORK}Check Network Settings"
-      exit 1
-    fi
-  fi
-
-  # DNS resolution checks for GitHub-related domains (IPv4 and/or IPv6)
-  GIT_HOSTS=("github.com" "raw.githubusercontent.com" "api.github.com" "git.community-scripts.org")
-  GIT_STATUS="Git DNS:"
-  DNS_FAILED=false
-
-  for HOST in "${GIT_HOSTS[@]}"; do
-    RESOLVEDIP=$(getent hosts "$HOST" | awk '{ print $1 }' | grep -E '(^([0-9]{1,3}\.){3}[0-9]{1,3}$)|(^[a-fA-F0-9:]+$)' | head -n1)
-    if [[ -z "$RESOLVEDIP" ]]; then
-      GIT_STATUS+="$HOST:($DNSFAIL)"
-      DNS_FAILED=true
-    else
-      GIT_STATUS+=" $HOST:($DNSOK)"
-    fi
-  done
-
-  if [[ "$DNS_FAILED" == true ]]; then
-    fatal "$GIT_STATUS"
-  else
-    msg_ok "$GIT_STATUS"
-  fi
-
-  set -e
-  trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
-}
-
-# ==============================================================================
-# SECTION 3: OS UPDATE & PACKAGE MANAGEMENT
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# update_os()
-#
-# - Updates container OS via apt-get update and dist-upgrade
-# - Configures APT cacher proxy if CACHER=yes (accelerates package downloads)
-# - Removes Python EXTERNALLY-MANAGED restrictions for pip
-# - Sources tools.func for additional setup functions after update
-# - Uses $STD wrapper to suppress output unless VERBOSE=yes
-# ------------------------------------------------------------------------------
-update_os() {
-  msg_info "Updating Container OS"
-  if [[ "$CACHER" == "yes" ]]; then
-    echo "Acquire::http::Proxy-Auto-Detect \"/usr/local/bin/apt-proxy-detect.sh\";" >/etc/apt/apt.conf.d/00aptproxy
-    cat <<'EOF' >/usr/local/bin/apt-proxy-detect.sh
-#!/bin/bash
-if nc -w1 -z "${CACHER_IP}" 3142; then
-  echo -n "http://${CACHER_IP}:3142"
-else
-  echo -n "DIRECT"
-fi
-EOF
-    chmod +x /usr/local/bin/apt-proxy-detect.sh
-  fi
-  $STD apt-get update
-  $STD apt-get -o Dpkg::Options::="--force-confold" -y dist-upgrade
-  rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED
-  msg_ok "Updated Container OS"
-  source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/tools.func)
-}
-
-# ==============================================================================
-# SECTION 4: MOTD & SSH CONFIGURATION
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# motd_ssh()
-#
-# - Configures Message of the Day (MOTD) with container information
-# - Creates /etc/profile.d/00_lxc-details.sh with:
-#   * Application name
-#   * Warning banner (DEV repository)
-#   * OS name and version
-#   * Hostname and IP address
-#   * GitHub repository link
-# - Disables executable flag on /etc/update-motd.d/* scripts
-# - Enables root SSH access if SSH_ROOT=yes
-# - Configures TERM environment variable for better terminal support
-# ------------------------------------------------------------------------------
-motd_ssh() {
-  grep -qxF "export TERM='xterm-256color'" /root/.bashrc || echo "export TERM='xterm-256color'" >>/root/.bashrc
-
-  if [ -f "/etc/os-release" ]; then
-    OS_NAME=$(grep ^NAME /etc/os-release | cut -d= -f2 | tr -d '"')
-    OS_VERSION=$(grep ^VERSION_ID /etc/os-release | cut -d= -f2 | tr -d '"')
-  elif [ -f "/etc/debian_version" ]; then
-    OS_NAME="Debian"
-    OS_VERSION=$(cat /etc/debian_version)
-  fi
-
-  PROFILE_FILE="/etc/profile.d/00_lxc-details.sh"
-  echo "echo -e \"\"" >"$PROFILE_FILE"
-  echo -e "echo -e \"${BOLD}${YW}${APPLICATION} LXC Container - DEV Repository${CL}\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${RD}WARNING: This is a DEVELOPMENT version (ProxmoxVED). Do NOT use in production!${CL}\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${YW} OS: ${GN}${OS_NAME} - Version: ${OS_VERSION}${CL}\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${YW} Hostname: ${GN}\$(hostname)${CL}\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${YW} IP Address: ${GN}\$(hostname -I | awk '{print \$1}')${CL}\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${YW} Repository: ${GN}https://github.com/community-scripts/ProxmoxVED${CL}\"" >>"$PROFILE_FILE"
-  echo "echo \"\"" >>"$PROFILE_FILE"
-
-  chmod -x /etc/update-motd.d/*
-
-  if [[ "${SSH_ROOT}" == "yes" ]]; then
-    sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" /etc/ssh/sshd_config
-    systemctl restart sshd
-  fi
-}
-
-# ==============================================================================
-# SECTION 5: CONTAINER CUSTOMIZATION
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# customize()
-#
-# - Customizes container for passwordless root login if PASSWORD is empty
-# - Configures getty for auto-login via /etc/systemd/system/container-getty@1.service.d/override.conf
-# - Creates /usr/bin/update script for easy application updates
-# - Injects SSH authorized keys if SSH_AUTHORIZED_KEY variable is set
-# - Sets proper permissions on SSH directories and key files
-# ------------------------------------------------------------------------------
-customize() {
-  if [[ "$PASSWORD" == "" ]]; then
-    msg_info "Customizing Container"
-    GETTY_OVERRIDE="/etc/systemd/system/container-getty@1.service.d/override.conf"
-    mkdir -p $(dirname $GETTY_OVERRIDE)
-    cat <<EOF >$GETTY_OVERRIDE
-  [Service]
-  ExecStart=
-  ExecStart=-/sbin/agetty --autologin root --noclear --keep-baud tty%I 115200,38400,9600 \$TERM
-EOF
-    systemctl daemon-reload
-    systemctl restart $(basename $(dirname $GETTY_OVERRIDE) | sed 's/\.d//')
-    msg_ok "Customized Container"
-  fi
-  echo "bash -c \"\$(curl -fsSL https://github.com/community-scripts/ProxmoxVED/raw/main/ct/${app}.sh)\"" >/usr/bin/update
-  chmod +x /usr/bin/update
-  if [[ -n "${SSH_AUTHORIZED_KEY}" ]]; then
-    mkdir -p /root/.ssh
-    echo "${SSH_AUTHORIZED_KEY}" >/root/.ssh/authorized_keys
-    chmod 700 /root/.ssh
-    chmod 600 /root/.ssh/authorized_keys
-  fi
-}
diff --git a/misc/bak_december/install.func.bak b/misc/bak_december/install.func.bak
deleted file mode 100644
index 5d624455..00000000
--- a/misc/bak_december/install.func.bak
+++ /dev/null
@@ -1,287 +0,0 @@
-# Copyright (c) 2021-2026 tteck
-# Author: tteck (tteckster)
-# Co-Author: MickLesk
-# Co-Author: michelroegl-brunner
-# License: MIT | https://github.com/community-scripts/ProxmoxVED/raw/main/LICENSE
-
-# ==============================================================================
-# INSTALL.FUNC - CONTAINER INSTALLATION & SETUP
-# ==============================================================================
-#
-# This file provides installation functions executed inside LXC containers
-# after creation. Handles:
-#
-#   - Network connectivity verification (IPv4/IPv6)
-#   - OS updates and package installation
-#   - DNS resolution checks
-#   - MOTD and SSH configuration
-#   - Container customization and auto-login
-#
-# Usage:
-#   - Sourced by <app>-install.sh scripts
-#   - Executes via pct exec inside container
-#   - Requires internet connectivity
-#
-# ==============================================================================
-
-# ==============================================================================
-# SECTION 1: INITIALIZATION
-# ==============================================================================
-
-if ! command -v curl >/dev/null 2>&1; then
-  printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
-  apt-get update >/dev/null 2>&1
-  apt-get install -y curl >/dev/null 2>&1
-fi
-source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/core.func)
-source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/error_handler.func)
-load_functions
-catch_errors
-
-# ==============================================================================
-# SECTION 2: NETWORK & CONNECTIVITY
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# verb_ip6()
-#
-# - Configures IPv6 based on IPV6_METHOD variable
-# - If IPV6_METHOD=disable: disables IPv6 via sysctl
-# - Sets verbose mode via set_std_mode()
-# ------------------------------------------------------------------------------
-verb_ip6() {
-  set_std_mode # Set STD mode based on VERBOSE
-
-  if [ "${IPV6_METHOD:-}" = "disable" ]; then
-    msg_info "Disabling IPv6 (this may affect some services)"
-    mkdir -p /etc/sysctl.d
-    $STD tee /etc/sysctl.d/99-disable-ipv6.conf >/dev/null <<EOF
-# Disable IPv6 (set by community-scripts)
-net.ipv6.conf.all.disable_ipv6 = 1
-net.ipv6.conf.default.disable_ipv6 = 1
-net.ipv6.conf.lo.disable_ipv6 = 1
-EOF
-    $STD sysctl -p /etc/sysctl.d/99-disable-ipv6.conf
-    msg_ok "Disabled IPv6"
-  fi
-}
-
-# ------------------------------------------------------------------------------
-# setting_up_container()
-#
-# - Verifies network connectivity via hostname -I
-# - Retries up to RETRY_NUM times with RETRY_EVERY seconds delay
-# - Removes Python EXTERNALLY-MANAGED restrictions
-# - Disables systemd-networkd-wait-online.service for faster boot
-# - Exits with error if network unavailable after retries
-# ------------------------------------------------------------------------------
-setting_up_container() {
-  msg_info "Setting up Container OS"
-  for ((i = RETRY_NUM; i > 0; i--)); do
-    if [ "$(hostname -I)" != "" ]; then
-      break
-    fi
-    echo 1>&2 -en "${CROSS}${RD} No Network! "
-    sleep $RETRY_EVERY
-  done
-  if [ "$(hostname -I)" = "" ]; then
-    echo 1>&2 -e "\n${CROSS}${RD} No Network After $RETRY_NUM Tries${CL}"
-    echo -e "${NETWORK}Check Network Settings"
-    exit 1
-  fi
-  rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED
-  systemctl disable -q --now systemd-networkd-wait-online.service
-  msg_ok "Set up Container OS"
-  #msg_custom "${CM}" "${GN}" "Network Connected: ${BL}$(hostname -I)"
-  msg_ok "Network Connected: ${BL}$(hostname -I)"
-}
-
-# ------------------------------------------------------------------------------
-# network_check()
-#
-# - Comprehensive network connectivity check for IPv4 and IPv6
-# - Tests connectivity to multiple DNS servers:
-#   * IPv4: 1.1.1.1 (Cloudflare), 8.8.8.8 (Google), 9.9.9.9 (Quad9)
-#   * IPv6: 2606:4700:4700::1111, 2001:4860:4860::8888, 2620:fe::fe
-# - Verifies DNS resolution for GitHub and Community-Scripts domains
-# - Prompts user to continue if no internet detected
-# - Uses fatal() on DNS resolution failure for critical hosts
-# ------------------------------------------------------------------------------
-network_check() {
-  set +e
-  trap - ERR
-  ipv4_connected=false
-  ipv6_connected=false
-  sleep 1
-
-  # Check IPv4 connectivity to Google, Cloudflare & Quad9 DNS servers.
-  if ping -c 1 -W 1 1.1.1.1 &>/dev/null || ping -c 1 -W 1 8.8.8.8 &>/dev/null || ping -c 1 -W 1 9.9.9.9 &>/dev/null; then
-    msg_ok "IPv4 Internet Connected"
-    ipv4_connected=true
-  else
-    msg_error "IPv4 Internet Not Connected"
-  fi
-
-  # Check IPv6 connectivity to Google, Cloudflare & Quad9 DNS servers.
-  if ping6 -c 1 -W 1 2606:4700:4700::1111 &>/dev/null || ping6 -c 1 -W 1 2001:4860:4860::8888 &>/dev/null || ping6 -c 1 -W 1 2620:fe::fe &>/dev/null; then
-    msg_ok "IPv6 Internet Connected"
-    ipv6_connected=true
-  else
-    msg_error "IPv6 Internet Not Connected"
-  fi
-
-  # If both IPv4 and IPv6 checks fail, prompt the user
-  if [[ $ipv4_connected == false && $ipv6_connected == false ]]; then
-    read -r -p "No Internet detected, would you like to continue anyway? <y/N> " prompt
-    if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
-      echo -e "${INFO}${RD}Expect Issues Without Internet${CL}"
-    else
-      echo -e "${NETWORK}Check Network Settings"
-      exit 1
-    fi
-  fi
-
-  # DNS resolution checks for GitHub-related domains (IPv4 and/or IPv6)
-  GIT_HOSTS=("github.com" "raw.githubusercontent.com" "api.github.com" "git.community-scripts.org")
-  GIT_STATUS="Git DNS:"
-  DNS_FAILED=false
-
-  for HOST in "${GIT_HOSTS[@]}"; do
-    RESOLVEDIP=$(getent hosts "$HOST" | awk '{ print $1 }' | grep -E '(^([0-9]{1,3}\.){3}[0-9]{1,3}$)|(^[a-fA-F0-9:]+$)' | head -n1)
-    if [[ -z "$RESOLVEDIP" ]]; then
-      GIT_STATUS+="$HOST:($DNSFAIL)"
-      DNS_FAILED=true
-    else
-      GIT_STATUS+=" $HOST:($DNSOK)"
-    fi
-  done
-
-  if [[ "$DNS_FAILED" == true ]]; then
-    fatal "$GIT_STATUS"
-  else
-    msg_ok "$GIT_STATUS"
-  fi
-
-  set -e
-  trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
-}
-
-# ==============================================================================
-# SECTION 3: OS UPDATE & PACKAGE MANAGEMENT
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# update_os()
-#
-# - Updates container OS via apt-get update and dist-upgrade
-# - Configures APT cacher proxy if CACHER=yes (accelerates package downloads)
-# - Removes Python EXTERNALLY-MANAGED restrictions for pip
-# - Sources tools.func for additional setup functions after update
-# - Uses $STD wrapper to suppress output unless VERBOSE=yes
-# ------------------------------------------------------------------------------
-update_os() {
-  msg_info "Updating Container OS"
-  if [[ "$CACHER" == "yes" ]]; then
-    echo 'Acquire::http::Proxy-Auto-Detect "/usr/local/bin/apt-proxy-detect.sh";' >/etc/apt/apt.conf.d/00aptproxy
-    cat <<EOF >/usr/local/bin/apt-proxy-detect.sh
-#!/bin/bash
-if nc -w1 -z "${CACHER_IP}" 3142; then
-  echo -n "http://${CACHER_IP}:3142"
-else
-  echo -n "DIRECT"
-fi
-EOF
-    chmod +x /usr/local/bin/apt-proxy-detect.sh
-  fi
-  $STD apt-get update
-  $STD apt-get -o Dpkg::Options::="--force-confold" -y dist-upgrade
-  rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED
-  msg_ok "Updated Container OS"
-  source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/tools.func)
-}
-
-# ==============================================================================
-# SECTION 4: MOTD & SSH CONFIGURATION
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# motd_ssh()
-#
-# - Configures Message of the Day (MOTD) with container information
-# - Creates /etc/profile.d/00_lxc-details.sh with:
-#   * Application name
-#   * Warning banner (DEV repository)
-#   * OS name and version
-#   * Hostname and IP address
-#   * GitHub repository link
-# - Disables executable flag on /etc/update-motd.d/* scripts
-# - Enables root SSH access if SSH_ROOT=yes
-# - Configures TERM environment variable for better terminal support
-# ------------------------------------------------------------------------------
-motd_ssh() {
-  # Set terminal to 256-color mode
-  grep -qxF "export TERM='xterm-256color'" /root/.bashrc || echo "export TERM='xterm-256color'" >>/root/.bashrc
-
-  # Get OS information (Debian / Ubuntu)
-  if [ -f "/etc/os-release" ]; then
-    OS_NAME=$(grep ^NAME /etc/os-release | cut -d= -f2 | tr -d '"')
-    OS_VERSION=$(grep ^VERSION_ID /etc/os-release | cut -d= -f2 | tr -d '"')
-  elif [ -f "/etc/debian_version" ]; then
-    OS_NAME="Debian"
-    OS_VERSION=$(cat /etc/debian_version)
-  fi
-
-  PROFILE_FILE="/etc/profile.d/00_lxc-details.sh"
-  echo "echo -e \"\"" >"$PROFILE_FILE"
-  echo -e "echo -e \"${BOLD}${YW}${APPLICATION} LXC Container - DEV Repository${CL}\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${RD}WARNING: This is a DEVELOPMENT version (ProxmoxVED). Do NOT use in production!${CL}\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${YW} OS: ${GN}${OS_NAME} - Version: ${OS_VERSION}${CL}\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${YW} Hostname: ${GN}\$(hostname)${CL}\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${YW} IP Address: ${GN}\$(hostname -I | awk '{print \$1}')${CL}\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${YW} Repository: ${GN}https://github.com/community-scripts/ProxmoxVED${CL}\"" >>"$PROFILE_FILE"
-  echo "echo \"\"" >>"$PROFILE_FILE"
-
-  chmod -x /etc/update-motd.d/*
-
-  if [[ "${SSH_ROOT}" == "yes" ]]; then
-    sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" /etc/ssh/sshd_config
-    systemctl restart sshd
-  fi
-}
-
-# ==============================================================================
-# SECTION 5: CONTAINER CUSTOMIZATION
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# customize()
-#
-# - Customizes container for passwordless root login if PASSWORD is empty
-# - Configures getty for auto-login via /etc/systemd/system/container-getty@1.service.d/override.conf
-# - Creates /usr/bin/update script for easy application updates
-# - Injects SSH authorized keys if SSH_AUTHORIZED_KEY variable is set
-# - Sets proper permissions on SSH directories and key files
-# ------------------------------------------------------------------------------
-customize() {
-  if [[ "$PASSWORD" == "" ]]; then
-    msg_info "Customizing Container"
-    GETTY_OVERRIDE="/etc/systemd/system/container-getty@1.service.d/override.conf"
-    mkdir -p $(dirname $GETTY_OVERRIDE)
-    cat <<EOF >$GETTY_OVERRIDE
-  [Service]
-  ExecStart=
-  ExecStart=-/sbin/agetty --autologin root --noclear --keep-baud tty%I 115200,38400,9600 \$TERM
-EOF
-    systemctl daemon-reload
-    systemctl restart $(basename $(dirname $GETTY_OVERRIDE) | sed 's/\.d//')
-    msg_ok "Customized Container"
-  fi
-  echo "bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/ct/${app}.sh)\"" >/usr/bin/update
-  chmod +x /usr/bin/update
-  if [[ -n "${SSH_AUTHORIZED_KEY}" ]]; then
-    mkdir -p /root/.ssh
-    echo "${SSH_AUTHORIZED_KEY}" >/root/.ssh/authorized_keys
-    chmod 700 /root/.ssh
-    chmod 600 /root/.ssh/authorized_keys
-  fi
-}
diff --git a/misc/bak_december/install.func.unified b/misc/bak_december/install.func.unified
deleted file mode 100644
index c222061a..00000000
--- a/misc/bak_december/install.func.unified
+++ /dev/null
@@ -1,992 +0,0 @@
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: tteck (tteckster)
-# Co-Author: MickLesk
-# Co-Author: michelroegl-brunner
-# License: MIT | https://github.com/community-scripts/ProxmoxVED/raw/main/LICENSE
-
-# ==============================================================================
-# INSTALL.FUNC - UNIFIED CONTAINER INSTALLATION & SETUP
-# ==============================================================================
-#
-# All-in-One install.func supporting multiple Linux distributions:
-#   - Debian, Ubuntu, Devuan (apt, systemd/sysvinit)
-#   - Alpine (apk, OpenRC)
-#   - Fedora, Rocky, AlmaLinux, CentOS (dnf/yum, systemd)
-#   - Arch Linux (pacman, systemd)
-#   - openSUSE (zypper, systemd)
-#   - Gentoo (emerge, OpenRC)
-#   - NixOS (nix, systemd)
-#
-# Features:
-#   - Automatic OS detection
-#   - Unified package manager abstraction
-#   - Init system abstraction (systemd/OpenRC/runit/sysvinit)
-#   - Network connectivity verification
-#   - MOTD and SSH configuration
-#   - Container customization
-#
-# ==============================================================================
-
-# ==============================================================================
-# SECTION 1: INITIALIZATION & OS DETECTION
-# ==============================================================================
-
-# Global variables for OS detection
-OS_TYPE=""           # debian, ubuntu, alpine, fedora, arch, opensuse, gentoo, nixos, devuan, rocky, alma, centos
-OS_FAMILY=""         # debian, alpine, rhel, arch, suse, gentoo, nixos
-OS_VERSION=""        # Version number
-PKG_MANAGER=""       # apt, apk, dnf, yum, pacman, zypper, emerge, nix-env
-INIT_SYSTEM=""       # systemd, openrc, runit, sysvinit
-
-# ------------------------------------------------------------------------------
-# detect_os()
-#
-# Detects the operating system and sets global variables:
-#   OS_TYPE, OS_FAMILY, OS_VERSION, PKG_MANAGER, INIT_SYSTEM
-# ------------------------------------------------------------------------------
-detect_os() {
-  if [[ -f /etc/os-release ]]; then
-    # shellcheck disable=SC1091
-    . /etc/os-release
-    OS_TYPE="${ID:-unknown}"
-    OS_VERSION="${VERSION_ID:-unknown}"
-  elif [[ -f /etc/alpine-release ]]; then
-    OS_TYPE="alpine"
-    OS_VERSION=$(cat /etc/alpine-release)
-  elif [[ -f /etc/debian_version ]]; then
-    OS_TYPE="debian"
-    OS_VERSION=$(cat /etc/debian_version)
-  elif [[ -f /etc/redhat-release ]]; then
-    OS_TYPE="centos"
-    OS_VERSION=$(grep -oE '[0-9]+\.[0-9]+' /etc/redhat-release | head -1)
-  elif [[ -f /etc/arch-release ]]; then
-    OS_TYPE="arch"
-    OS_VERSION="rolling"
-  elif [[ -f /etc/gentoo-release ]]; then
-    OS_TYPE="gentoo"
-    OS_VERSION=$(cat /etc/gentoo-release | grep -oE '[0-9.]+')
-  else
-    OS_TYPE="unknown"
-    OS_VERSION="unknown"
-  fi
-
-  # Normalize OS type and determine family
-  case "$OS_TYPE" in
-    debian)
-      OS_FAMILY="debian"
-      PKG_MANAGER="apt"
-      ;;
-    ubuntu)
-      OS_FAMILY="debian"
-      PKG_MANAGER="apt"
-      ;;
-    devuan)
-      OS_FAMILY="debian"
-      PKG_MANAGER="apt"
-      ;;
-    alpine)
-      OS_FAMILY="alpine"
-      PKG_MANAGER="apk"
-      ;;
-    fedora)
-      OS_FAMILY="rhel"
-      PKG_MANAGER="dnf"
-      ;;
-    rocky | rockylinux)
-      OS_TYPE="rocky"
-      OS_FAMILY="rhel"
-      PKG_MANAGER="dnf"
-      ;;
-    alma | almalinux)
-      OS_TYPE="alma"
-      OS_FAMILY="rhel"
-      PKG_MANAGER="dnf"
-      ;;
-    centos)
-      OS_FAMILY="rhel"
-      # CentOS 7 uses yum, 8+ uses dnf
-      if [[ "${OS_VERSION%%.*}" -ge 8 ]]; then
-        PKG_MANAGER="dnf"
-      else
-        PKG_MANAGER="yum"
-      fi
-      ;;
-    rhel)
-      OS_FAMILY="rhel"
-      PKG_MANAGER="dnf"
-      ;;
-    arch | archlinux)
-      OS_TYPE="arch"
-      OS_FAMILY="arch"
-      PKG_MANAGER="pacman"
-      ;;
-    opensuse* | sles)
-      OS_TYPE="opensuse"
-      OS_FAMILY="suse"
-      PKG_MANAGER="zypper"
-      ;;
-    gentoo)
-      OS_FAMILY="gentoo"
-      PKG_MANAGER="emerge"
-      ;;
-    nixos)
-      OS_FAMILY="nixos"
-      PKG_MANAGER="nix-env"
-      ;;
-    *)
-      OS_FAMILY="unknown"
-      PKG_MANAGER="unknown"
-      ;;
-  esac
-
-  # Detect init system
-  if command -v systemctl &>/dev/null && [[ -d /run/systemd/system ]]; then
-    INIT_SYSTEM="systemd"
-  elif command -v rc-service &>/dev/null || [[ -d /etc/init.d && -f /sbin/openrc ]]; then
-    INIT_SYSTEM="openrc"
-  elif command -v sv &>/dev/null && [[ -d /etc/sv ]]; then
-    INIT_SYSTEM="runit"
-  elif [[ -f /etc/inittab ]]; then
-    INIT_SYSTEM="sysvinit"
-  else
-    INIT_SYSTEM="unknown"
-  fi
-}
-
-# ------------------------------------------------------------------------------
-# Bootstrap: Ensure curl is available and source core functions
-# ------------------------------------------------------------------------------
-_bootstrap() {
-  # Minimal bootstrap to get curl installed
-  if ! command -v curl &>/dev/null; then
-    printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
-    if command -v apt-get &>/dev/null; then
-      apt-get update &>/dev/null && apt-get install -y curl &>/dev/null
-    elif command -v apk &>/dev/null; then
-      apk update &>/dev/null && apk add curl &>/dev/null
-    elif command -v dnf &>/dev/null; then
-      dnf install -y curl &>/dev/null
-    elif command -v yum &>/dev/null; then
-      yum install -y curl &>/dev/null
-    elif command -v pacman &>/dev/null; then
-      pacman -Sy --noconfirm curl &>/dev/null
-    elif command -v zypper &>/dev/null; then
-      zypper install -y curl &>/dev/null
-    elif command -v emerge &>/dev/null; then
-      emerge --quiet net-misc/curl &>/dev/null
-    fi
-  fi
-
-  # Source core functions
-  source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/core.func)
-  source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/error_handler.func)
-  load_functions
-  catch_errors
-}
-
-# Run bootstrap and OS detection
-_bootstrap
-detect_os
-
-# ==============================================================================
-# SECTION 2: PACKAGE MANAGER ABSTRACTION
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# pkg_update()
-#
-# Updates package manager cache/database
-# ------------------------------------------------------------------------------
-pkg_update() {
-  case "$PKG_MANAGER" in
-    apt)
-      $STD apt-get update
-      ;;
-    apk)
-      $STD apk update
-      ;;
-    dnf)
-      $STD dnf makecache
-      ;;
-    yum)
-      $STD yum makecache
-      ;;
-    pacman)
-      $STD pacman -Sy
-      ;;
-    zypper)
-      $STD zypper refresh
-      ;;
-    emerge)
-      $STD emerge --sync
-      ;;
-    nix-env)
-      $STD nix-channel --update
-      ;;
-    *)
-      msg_error "Unknown package manager: $PKG_MANAGER"
-      return 1
-      ;;
-  esac
-}
-
-# ------------------------------------------------------------------------------
-# pkg_upgrade()
-#
-# Upgrades all installed packages
-# ------------------------------------------------------------------------------
-pkg_upgrade() {
-  case "$PKG_MANAGER" in
-    apt)
-      $STD apt-get -o Dpkg::Options::="--force-confold" -y dist-upgrade
-      ;;
-    apk)
-      $STD apk -U upgrade
-      ;;
-    dnf)
-      $STD dnf -y upgrade
-      ;;
-    yum)
-      $STD yum -y update
-      ;;
-    pacman)
-      $STD pacman -Syu --noconfirm
-      ;;
-    zypper)
-      $STD zypper -n update
-      ;;
-    emerge)
-      $STD emerge --quiet --update --deep @world
-      ;;
-    nix-env)
-      $STD nix-env -u
-      ;;
-    *)
-      msg_error "Unknown package manager: $PKG_MANAGER"
-      return 1
-      ;;
-  esac
-}
-
-# ------------------------------------------------------------------------------
-# pkg_install(packages...)
-#
-# Installs one or more packages
-# Arguments:
-#   packages - List of packages to install
-# ------------------------------------------------------------------------------
-pkg_install() {
-  local packages=("$@")
-  [[ ${#packages[@]} -eq 0 ]] && return 0
-
-  case "$PKG_MANAGER" in
-    apt)
-      $STD apt-get install -y "${packages[@]}"
-      ;;
-    apk)
-      $STD apk add --no-cache "${packages[@]}"
-      ;;
-    dnf)
-      $STD dnf install -y "${packages[@]}"
-      ;;
-    yum)
-      $STD yum install -y "${packages[@]}"
-      ;;
-    pacman)
-      $STD pacman -S --noconfirm "${packages[@]}"
-      ;;
-    zypper)
-      $STD zypper install -y "${packages[@]}"
-      ;;
-    emerge)
-      $STD emerge --quiet "${packages[@]}"
-      ;;
-    nix-env)
-      for pkg in "${packages[@]}"; do
-        $STD nix-env -iA "nixos.$pkg"
-      done
-      ;;
-    *)
-      msg_error "Unknown package manager: $PKG_MANAGER"
-      return 1
-      ;;
-  esac
-}
-
-# ------------------------------------------------------------------------------
-# pkg_remove(packages...)
-#
-# Removes one or more packages
-# ------------------------------------------------------------------------------
-pkg_remove() {
-  local packages=("$@")
-  [[ ${#packages[@]} -eq 0 ]] && return 0
-
-  case "$PKG_MANAGER" in
-    apt)
-      $STD apt-get remove -y "${packages[@]}"
-      ;;
-    apk)
-      $STD apk del "${packages[@]}"
-      ;;
-    dnf)
-      $STD dnf remove -y "${packages[@]}"
-      ;;
-    yum)
-      $STD yum remove -y "${packages[@]}"
-      ;;
-    pacman)
-      $STD pacman -Rs --noconfirm "${packages[@]}"
-      ;;
-    zypper)
-      $STD zypper remove -y "${packages[@]}"
-      ;;
-    emerge)
-      $STD emerge --quiet --unmerge "${packages[@]}"
-      ;;
-    nix-env)
-      for pkg in "${packages[@]}"; do
-        $STD nix-env -e "$pkg"
-      done
-      ;;
-    *)
-      msg_error "Unknown package manager: $PKG_MANAGER"
-      return 1
-      ;;
-  esac
-}
-
-# ------------------------------------------------------------------------------
-# pkg_clean()
-#
-# Cleans package manager cache to free space
-# ------------------------------------------------------------------------------
-pkg_clean() {
-  case "$PKG_MANAGER" in
-    apt)
-      $STD apt-get autoremove -y
-      $STD apt-get autoclean
-      ;;
-    apk)
-      $STD apk cache clean
-      ;;
-    dnf)
-      $STD dnf clean all
-      $STD dnf autoremove -y
-      ;;
-    yum)
-      $STD yum clean all
-      ;;
-    pacman)
-      $STD pacman -Scc --noconfirm
-      ;;
-    zypper)
-      $STD zypper clean
-      ;;
-    emerge)
-      $STD emerge --quiet --depclean
-      ;;
-    nix-env)
-      $STD nix-collect-garbage -d
-      ;;
-    *)
-      return 0
-      ;;
-  esac
-}
-
-# ==============================================================================
-# SECTION 3: SERVICE/INIT SYSTEM ABSTRACTION
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# svc_enable(service)
-#
-# Enables a service to start at boot
-# ------------------------------------------------------------------------------
-svc_enable() {
-  local service="$1"
-  [[ -z "$service" ]] && return 1
-
-  case "$INIT_SYSTEM" in
-    systemd)
-      $STD systemctl enable "$service"
-      ;;
-    openrc)
-      $STD rc-update add "$service" default
-      ;;
-    runit)
-      [[ -d "/etc/sv/$service" ]] && ln -sf "/etc/sv/$service" "/var/service/"
-      ;;
-    sysvinit)
-      if command -v update-rc.d &>/dev/null; then
-        $STD update-rc.d "$service" defaults
-      elif command -v chkconfig &>/dev/null; then
-        $STD chkconfig "$service" on
-      fi
-      ;;
-    *)
-      msg_warn "Unknown init system, cannot enable $service"
-      return 1
-      ;;
-  esac
-}
-
-# ------------------------------------------------------------------------------
-# svc_disable(service)
-#
-# Disables a service from starting at boot
-# ------------------------------------------------------------------------------
-svc_disable() {
-  local service="$1"
-  [[ -z "$service" ]] && return 1
-
-  case "$INIT_SYSTEM" in
-    systemd)
-      $STD systemctl disable "$service"
-      ;;
-    openrc)
-      $STD rc-update del "$service" default 2>/dev/null || true
-      ;;
-    runit)
-      rm -f "/var/service/$service"
-      ;;
-    sysvinit)
-      if command -v update-rc.d &>/dev/null; then
-        $STD update-rc.d "$service" remove
-      elif command -v chkconfig &>/dev/null; then
-        $STD chkconfig "$service" off
-      fi
-      ;;
-    *)
-      return 1
-      ;;
-  esac
-}
-
-# ------------------------------------------------------------------------------
-# svc_start(service)
-#
-# Starts a service immediately
-# ------------------------------------------------------------------------------
-svc_start() {
-  local service="$1"
-  [[ -z "$service" ]] && return 1
-
-  case "$INIT_SYSTEM" in
-    systemd)
-      $STD systemctl start "$service"
-      ;;
-    openrc)
-      $STD rc-service "$service" start
-      ;;
-    runit)
-      $STD sv start "$service"
-      ;;
-    sysvinit)
-      $STD /etc/init.d/"$service" start
-      ;;
-    *)
-      return 1
-      ;;
-  esac
-}
-
-# ------------------------------------------------------------------------------
-# svc_stop(service)
-#
-# Stops a running service
-# ------------------------------------------------------------------------------
-svc_stop() {
-  local service="$1"
-  [[ -z "$service" ]] && return 1
-
-  case "$INIT_SYSTEM" in
-    systemd)
-      $STD systemctl stop "$service"
-      ;;
-    openrc)
-      $STD rc-service "$service" stop
-      ;;
-    runit)
-      $STD sv stop "$service"
-      ;;
-    sysvinit)
-      $STD /etc/init.d/"$service" stop
-      ;;
-    *)
-      return 1
-      ;;
-  esac
-}
-
-# ------------------------------------------------------------------------------
-# svc_restart(service)
-#
-# Restarts a service
-# ------------------------------------------------------------------------------
-svc_restart() {
-  local service="$1"
-  [[ -z "$service" ]] && return 1
-
-  case "$INIT_SYSTEM" in
-    systemd)
-      $STD systemctl restart "$service"
-      ;;
-    openrc)
-      $STD rc-service "$service" restart
-      ;;
-    runit)
-      $STD sv restart "$service"
-      ;;
-    sysvinit)
-      $STD /etc/init.d/"$service" restart
-      ;;
-    *)
-      return 1
-      ;;
-  esac
-}
-
-# ------------------------------------------------------------------------------
-# svc_status(service)
-#
-# Gets service status (returns 0 if running)
-# ------------------------------------------------------------------------------
-svc_status() {
-  local service="$1"
-  [[ -z "$service" ]] && return 1
-
-  case "$INIT_SYSTEM" in
-    systemd)
-      systemctl is-active --quiet "$service"
-      ;;
-    openrc)
-      rc-service "$service" status &>/dev/null
-      ;;
-    runit)
-      sv status "$service" | grep -q "^run:"
-      ;;
-    sysvinit)
-      /etc/init.d/"$service" status &>/dev/null
-      ;;
-    *)
-      return 1
-      ;;
-  esac
-}
-
-# ------------------------------------------------------------------------------
-# svc_reload_daemon()
-#
-# Reloads init system daemon configuration (for systemd)
-# ------------------------------------------------------------------------------
-svc_reload_daemon() {
-  case "$INIT_SYSTEM" in
-    systemd)
-      $STD systemctl daemon-reload
-      ;;
-    *)
-      # Other init systems don't need this
-      return 0
-      ;;
-  esac
-}
-
-# ==============================================================================
-# SECTION 4: NETWORK & CONNECTIVITY
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# get_ip()
-#
-# Gets the primary IPv4 address of the container
-# Returns: IP address string
-# ------------------------------------------------------------------------------
-get_ip() {
-  local ip=""
-
-  # Try hostname -I first (most common)
-  if command -v hostname &>/dev/null; then
-    ip=$(hostname -I 2>/dev/null | awk '{print $1}')
-  fi
-
-  # Fallback to ip command
-  if [[ -z "$ip" ]] && command -v ip &>/dev/null; then
-    ip=$(ip -4 addr show scope global | grep -oP '(?<=inet\s)\d+(\.\d+){3}' | head -1)
-  fi
-
-  # Fallback to ifconfig
-  if [[ -z "$ip" ]] && command -v ifconfig &>/dev/null; then
-    ip=$(ifconfig | grep -Eo 'inet (addr:)?([0-9]*\.){3}[0-9]*' | grep -Eo '([0-9]*\.){3}[0-9]*' | grep -v '127.0.0.1' | head -1)
-  fi
-
-  echo "$ip"
-}
-
-# ------------------------------------------------------------------------------
-# verb_ip6()
-#
-# Configures IPv6 based on IPV6_METHOD variable
-# If IPV6_METHOD=disable: disables IPv6 via sysctl
-# ------------------------------------------------------------------------------
-verb_ip6() {
-  set_std_mode # Set STD mode based on VERBOSE
-
-  if [[ "${IPV6_METHOD:-}" == "disable" ]]; then
-    msg_info "Disabling IPv6 (this may affect some services)"
-    mkdir -p /etc/sysctl.d
-    cat >/etc/sysctl.d/99-disable-ipv6.conf <<EOF
-# Disable IPv6 (set by community-scripts)
-net.ipv6.conf.all.disable_ipv6 = 1
-net.ipv6.conf.default.disable_ipv6 = 1
-net.ipv6.conf.lo.disable_ipv6 = 1
-EOF
-    $STD sysctl -p /etc/sysctl.d/99-disable-ipv6.conf
-
-    # For OpenRC, ensure sysctl runs at boot
-    if [[ "$INIT_SYSTEM" == "openrc" ]]; then
-      $STD rc-update add sysctl default 2>/dev/null || true
-    fi
-    msg_ok "Disabled IPv6"
-  fi
-}
-
-# ------------------------------------------------------------------------------
-# setting_up_container()
-#
-# Initial container setup:
-#   - Verifies network connectivity
-#   - Removes Python EXTERNALLY-MANAGED restrictions
-#   - Disables network wait services
-# ------------------------------------------------------------------------------
-setting_up_container() {
-  msg_info "Setting up Container OS"
-
-  # Wait for network
-  local i
-  for ((i = RETRY_NUM; i > 0; i--)); do
-    if [[ -n "$(get_ip)" ]]; then
-      break
-    fi
-    echo 1>&2 -en "${CROSS}${RD} No Network! "
-    sleep "$RETRY_EVERY"
-  done
-
-  if [[ -z "$(get_ip)" ]]; then
-    echo 1>&2 -e "\n${CROSS}${RD} No Network After $RETRY_NUM Tries${CL}"
-    echo -e "${NETWORK}Check Network Settings"
-    exit 1
-  fi
-
-  # Remove Python EXTERNALLY-MANAGED restriction (Debian 12+, Ubuntu 23.04+)
-  rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED 2>/dev/null || true
-
-  # Disable network wait services for faster boot
-  case "$INIT_SYSTEM" in
-    systemd)
-      systemctl disable -q --now systemd-networkd-wait-online.service 2>/dev/null || true
-      ;;
-  esac
-
-  msg_ok "Set up Container OS"
-  msg_ok "Network Connected: ${BL}$(get_ip)"
-}
-
-# ------------------------------------------------------------------------------
-# network_check()
-#
-# Comprehensive network connectivity check for IPv4 and IPv6
-# Tests connectivity to DNS servers and verifies DNS resolution
-# ------------------------------------------------------------------------------
-network_check() {
-  set +e
-  trap - ERR
-  local ipv4_connected=false
-  local ipv6_connected=false
-  sleep 1
-
-  # Check IPv4 connectivity
-  if ping -c 1 -W 1 1.1.1.1 &>/dev/null || ping -c 1 -W 1 8.8.8.8 &>/dev/null || ping -c 1 -W 1 9.9.9.9 &>/dev/null; then
-    msg_ok "IPv4 Internet Connected"
-    ipv4_connected=true
-  else
-    msg_error "IPv4 Internet Not Connected"
-  fi
-
-  # Check IPv6 connectivity (if ping6 exists)
-  if command -v ping6 &>/dev/null; then
-    if ping6 -c 1 -W 1 2606:4700:4700::1111 &>/dev/null || ping6 -c 1 -W 1 2001:4860:4860::8888 &>/dev/null; then
-      msg_ok "IPv6 Internet Connected"
-      ipv6_connected=true
-    else
-      msg_error "IPv6 Internet Not Connected"
-    fi
-  fi
-
-  # Prompt if both fail
-  if [[ $ipv4_connected == false && $ipv6_connected == false ]]; then
-    read -r -p "No Internet detected, would you like to continue anyway? <y/N> " prompt
-    if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
-      echo -e "${INFO}${RD}Expect Issues Without Internet${CL}"
-    else
-      echo -e "${NETWORK}Check Network Settings"
-      exit 1
-    fi
-  fi
-
-  # DNS resolution checks
-  local GIT_HOSTS=("github.com" "raw.githubusercontent.com" "git.community-scripts.org")
-  local GIT_STATUS="Git DNS:"
-  local DNS_FAILED=false
-
-  for HOST in "${GIT_HOSTS[@]}"; do
-    local RESOLVEDIP
-    RESOLVEDIP=$(getent hosts "$HOST" 2>/dev/null | awk '{ print $1 }' | head -n1)
-    if [[ -z "$RESOLVEDIP" ]]; then
-      GIT_STATUS+=" $HOST:(${DNSFAIL:-FAIL})"
-      DNS_FAILED=true
-    else
-      GIT_STATUS+=" $HOST:(${DNSOK:-OK})"
-    fi
-  done
-
-  if [[ "$DNS_FAILED" == true ]]; then
-    fatal "$GIT_STATUS"
-  else
-    msg_ok "$GIT_STATUS"
-  fi
-
-  set -e
-  trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
-}
-
-# ==============================================================================
-# SECTION 5: OS UPDATE & PACKAGE MANAGEMENT
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# update_os()
-#
-# Updates container OS and sources appropriate tools.func
-# ------------------------------------------------------------------------------
-update_os() {
-  msg_info "Updating Container OS"
-
-  # Configure APT cacher proxy if enabled (Debian/Ubuntu only)
-  if [[ "$PKG_MANAGER" == "apt" && "${CACHER:-}" == "yes" ]]; then
-    echo 'Acquire::http::Proxy-Auto-Detect "/usr/local/bin/apt-proxy-detect.sh";' >/etc/apt/apt.conf.d/00aptproxy
-    cat <<EOF >/usr/local/bin/apt-proxy-detect.sh
-#!/bin/bash
-if nc -w1 -z "${CACHER_IP}" 3142; then
-  echo -n "http://${CACHER_IP}:3142"
-else
-  echo -n "DIRECT"
-fi
-EOF
-    chmod +x /usr/local/bin/apt-proxy-detect.sh
-  fi
-
-  # Update and upgrade
-  pkg_update
-  pkg_upgrade
-
-  # Remove Python EXTERNALLY-MANAGED restriction
-  rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED 2>/dev/null || true
-
-  msg_ok "Updated Container OS"
-
-  # Source appropriate tools.func based on OS
-  case "$OS_FAMILY" in
-    alpine)
-      source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/alpine-tools.func)
-      ;;
-    *)
-      source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVED/raw/branch/main/misc/tools.func)
-      ;;
-  esac
-}
-
-# ==============================================================================
-# SECTION 6: MOTD & SSH CONFIGURATION
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# motd_ssh()
-#
-# Configures Message of the Day and SSH settings
-# ------------------------------------------------------------------------------
-motd_ssh() {
-  # Set terminal to 256-color mode
-  grep -qxF "export TERM='xterm-256color'" /root/.bashrc 2>/dev/null || echo "export TERM='xterm-256color'" >>/root/.bashrc
-
-  # Get OS information
-  local os_name="$OS_TYPE"
-  local os_version="$OS_VERSION"
-
-  if [[ -f /etc/os-release ]]; then
-    os_name=$(grep ^NAME /etc/os-release | cut -d= -f2 | tr -d '"')
-    os_version=$(grep ^VERSION_ID /etc/os-release | cut -d= -f2 | tr -d '"')
-  fi
-
-  # Create MOTD profile script
-  local PROFILE_FILE="/etc/profile.d/00_lxc-details.sh"
-  cat >"$PROFILE_FILE" <<EOF
-echo ""
-echo -e "${BOLD:-}${YW:-}${APPLICATION:-Container} LXC Container - DEV Repository${CL:-}"
-echo -e "${RD:-}WARNING: This is a DEVELOPMENT version (ProxmoxVED). Do NOT use in production!${CL:-}"
-echo -e "${YW:-} OS: ${GN:-}${os_name} - Version: ${os_version}${CL:-}"
-echo -e "${YW:-} Hostname: ${GN:-}\$(hostname)${CL:-}"
-echo -e "${YW:-} IP Address: ${GN:-}\$(hostname -I 2>/dev/null | awk '{print \$1}' || ip -4 addr show scope global | grep -oP '(?<=inet\s)\\d+(\\.\\d+){3}' | head -1)${CL:-}"
-echo -e "${YW:-} Repository: ${GN:-}https://github.com/community-scripts/ProxmoxVED${CL:-}"
-echo ""
-EOF
-
-  # Disable default MOTD scripts (Debian/Ubuntu)
-  [[ -d /etc/update-motd.d ]] && chmod -x /etc/update-motd.d/* 2>/dev/null || true
-
-  # Configure SSH root access if requested
-  if [[ "${SSH_ROOT:-}" == "yes" ]]; then
-    local sshd_config="/etc/ssh/sshd_config"
-    if [[ -f "$sshd_config" ]]; then
-      sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" "$sshd_config"
-      sed -i "s/PermitRootLogin prohibit-password/PermitRootLogin yes/g" "$sshd_config"
-
-      case "$INIT_SYSTEM" in
-        systemd)
-          svc_restart sshd 2>/dev/null || svc_restart ssh 2>/dev/null || true
-          ;;
-        openrc)
-          svc_enable sshd 2>/dev/null || true
-          svc_start sshd 2>/dev/null || true
-          ;;
-        *)
-          svc_restart sshd 2>/dev/null || true
-          ;;
-      esac
-    fi
-  fi
-}
-
-# ==============================================================================
-# SECTION 7: CONTAINER CUSTOMIZATION
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# customize()
-#
-# Customizes container for passwordless login and creates update script
-# ------------------------------------------------------------------------------
-customize() {
-  if [[ "${PASSWORD:-}" == "" ]]; then
-    msg_info "Customizing Container"
-
-    # Remove root password for auto-login
-    passwd -d root &>/dev/null || true
-
-    case "$INIT_SYSTEM" in
-      systemd)
-        # Configure getty for auto-login
-        local GETTY_OVERRIDE="/etc/systemd/system/container-getty@1.service.d/override.conf"
-        mkdir -p "$(dirname "$GETTY_OVERRIDE")"
-        cat >"$GETTY_OVERRIDE" <<EOF
-[Service]
-ExecStart=
-ExecStart=-/sbin/agetty --autologin root --noclear --keep-baud tty%I 115200,38400,9600 \$TERM
-EOF
-        svc_reload_daemon
-        systemctl restart "$(basename "$(dirname "$GETTY_OVERRIDE")" | sed 's/\.d//')" 2>/dev/null || true
-        ;;
-
-      openrc)
-        # Alpine/Gentoo: use inittab for auto-login
-        pkg_install util-linux 2>/dev/null || true
-
-        # Create persistent autologin boot script
-        mkdir -p /etc/local.d
-        cat <<'EOFSCRIPT' >/etc/local.d/autologin.start
-#!/bin/sh
-sed -i 's|^tty1::respawn:.*|tty1::respawn:/sbin/agetty --autologin root --noclear tty1 38400 linux|' /etc/inittab
-kill -HUP 1
-EOFSCRIPT
-        chmod +x /etc/local.d/autologin.start
-        rc-update add local 2>/dev/null || true
-        /etc/local.d/autologin.start 2>/dev/null || true
-        touch /root/.hushlogin
-        ;;
-
-      sysvinit)
-        # Devuan/older systems
-        if [[ -f /etc/inittab ]]; then
-          sed -i 's|^1:2345:respawn:/sbin/getty.*|1:2345:respawn:/sbin/agetty --autologin root tty1 38400 linux|' /etc/inittab
-          telinit q 2>/dev/null || true
-        fi
-        ;;
-    esac
-
-    msg_ok "Customized Container"
-  fi
-
-  # Create update script
-  echo "bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/ct/${app}.sh)\"" >/usr/bin/update
-  chmod +x /usr/bin/update
-
-  # Inject SSH authorized keys if provided
-  if [[ -n "${SSH_AUTHORIZED_KEY:-}" ]]; then
-    mkdir -p /root/.ssh
-    echo "${SSH_AUTHORIZED_KEY}" >/root/.ssh/authorized_keys
-    chmod 700 /root/.ssh
-    chmod 600 /root/.ssh/authorized_keys
-  fi
-}
-
-# ==============================================================================
-# SECTION 8: UTILITY FUNCTIONS
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# validate_tz(timezone)
-#
-# Validates if a timezone is valid
-# Returns: 0 if valid, 1 if invalid
-# ------------------------------------------------------------------------------
-validate_tz() {
-  local tz="$1"
-  [[ -f "/usr/share/zoneinfo/$tz" ]]
-}
-
-# ------------------------------------------------------------------------------
-# set_timezone(timezone)
-#
-# Sets container timezone
-# ------------------------------------------------------------------------------
-set_timezone() {
-  local tz="$1"
-  if validate_tz "$tz"; then
-    ln -sf "/usr/share/zoneinfo/$tz" /etc/localtime
-    echo "$tz" >/etc/timezone 2>/dev/null || true
-
-    # Update tzdata if available
-    case "$PKG_MANAGER" in
-      apt)
-        dpkg-reconfigure -f noninteractive tzdata 2>/dev/null || true
-        ;;
-    esac
-    msg_ok "Timezone set to $tz"
-  else
-    msg_warn "Invalid timezone: $tz"
-  fi
-}
-
-# ------------------------------------------------------------------------------
-# os_info()
-#
-# Prints detected OS information (for debugging)
-# ------------------------------------------------------------------------------
-os_info() {
-  echo "OS Type:      $OS_TYPE"
-  echo "OS Family:    $OS_FAMILY"
-  echo "OS Version:   $OS_VERSION"
-  echo "Pkg Manager:  $PKG_MANAGER"
-  echo "Init System:  $INIT_SYSTEM"
-}
diff --git a/misc/data/.gitignore b/misc/data/.gitignore
deleted file mode 100644
index 03cf14d6..00000000
--- a/misc/data/.gitignore
+++ /dev/null
@@ -1,34 +0,0 @@
-# If you prefer the allow list template instead of the deny list, see community template:
-# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
-#
-# Binaries for programs and plugins
-*.exe
-*.exe~
-*.dll
-*.so
-*.dylib
-telemetry-service
-migration/migrate
-
-# Test binary, built with `go test -c`
-*.test
-
-# Code coverage profiles and other test artifacts
-*.out
-coverage.*
-*.coverprofile
-profile.cov
-
-# Dependency directories (remove the comment below to include it)
-# vendor/
-
-# Go workspace file
-go.work
-go.work.sum
-
-# env file
-.env
-
-# Editor/IDE
-# .idea/
-# .vscode/
diff --git a/misc/data/Dockerfile b/misc/data/Dockerfile
deleted file mode 100644
index 7201849b..00000000
--- a/misc/data/Dockerfile
+++ /dev/null
@@ -1,52 +0,0 @@
-FROM golang:1.25-alpine AS build
-WORKDIR /src
-COPY go.mod go.sum* ./
-RUN go mod download 2>/dev/null || true
-COPY . .
-RUN go build -trimpath -ldflags "-s -w" -o /out/telemetry-service .
-RUN go build -trimpath -ldflags "-s -w" -o /out/migrate ./migration/migrate.go
-
-FROM alpine:3.23
-RUN apk add --no-cache ca-certificates tzdata
-WORKDIR /app
-COPY --from=build /out/telemetry-service /app/telemetry-service
-COPY --from=build /out/migrate /app/migrate
-COPY entrypoint.sh /app/entrypoint.sh
-RUN chmod +x /app/entrypoint.sh /app/migrate
-
-# Service config
-ENV LISTEN_ADDR=":8080"
-ENV MAX_BODY_BYTES="1024"
-ENV RATE_LIMIT_RPM="60"
-ENV RATE_BURST="20"
-ENV UPSTREAM_TIMEOUT_MS="4000"
-ENV ENABLE_REQUEST_LOGGING="false"
-
-# Cache config (optional)
-ENV ENABLE_CACHE="true"
-ENV CACHE_TTL_SECONDS="300"
-ENV ENABLE_REDIS="false"
-# ENV REDIS_URL="redis://localhost:6379"
-
-# Alert config (optional)
-ENV ALERT_ENABLED="false"
-# ENV SMTP_HOST=""
-# ENV SMTP_PORT="587"
-# ENV SMTP_USER=""
-# ENV SMTP_PASSWORD=""
-# ENV SMTP_FROM="telemetry@proxmoxved.local"
-# ENV SMTP_TO=""
-# ENV SMTP_USE_TLS="false"
-ENV ALERT_FAILURE_THRESHOLD="20.0"
-ENV ALERT_CHECK_INTERVAL_MIN="15"
-ENV ALERT_COOLDOWN_MIN="60"
-
-# Migration config (optional)
-ENV RUN_MIGRATION="false"
-ENV MIGRATION_REQUIRED="false"
-ENV MIGRATION_SOURCE_URL="https://api.htl-braunau.at/dev/data"
-
-EXPOSE 8080
-HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
-    CMD wget -q --spider http://localhost:8080/healthz || exit 1
-ENTRYPOINT ["/app/entrypoint.sh"]
diff --git a/misc/data/LICENSE b/misc/data/LICENSE
deleted file mode 100644
index 1fae4b9c..00000000
--- a/misc/data/LICENSE
+++ /dev/null
@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Community Scripts
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
diff --git a/misc/data/README.md b/misc/data/README.md
deleted file mode 100644
index 0211ab9f..00000000
--- a/misc/data/README.md
+++ /dev/null
@@ -1,81 +0,0 @@
-# Telemetry Service
-
-A standalone Go microservice that collects anonymous telemetry data from [ProxmoxVE](https://github.com/community-scripts/ProxmoxVE) and [ProxmoxVED](https://github.com/community-scripts/ProxmoxVED) script installations.
-
-## Overview
-
-This service acts as a telemetry ingestion layer between the bash installation scripts and a PocketBase backend. When users run scripts from the ProxmoxVE/ProxmoxVED repositories, optional anonymous usage data is sent here for aggregation and analysis.
-
-**What gets collected:**
-- Script name and installation status (success/failed)
-- Container/VM type and resource allocation (CPU, RAM, disk)
-- OS type and version
-- Proxmox VE version
-- Anonymous session ID (randomly generated UUID)
-
-**What is NOT collected:**
-- IP addresses (not logged, not stored)
-- Hostnames or domain names
-- User credentials or personal information
-- Hardware identifiers (MAC addresses, serial numbers)
-- Network configuration or internal IPs
-- Any data that could identify a person or system
-
-**What this enables:**
-- Understanding which scripts are most popular
-- Identifying scripts with high failure rates
-- Tracking resource allocation trends
-- Improving script quality based on real-world data
-
-## Features
-
-- **Telemetry Ingestion** - Receives and validates telemetry data from bash scripts
-- **PocketBase Integration** - Stores data in PocketBase collections
-- **Rate Limiting** - Configurable per-IP rate limiting to prevent abuse
-- **Caching** - In-memory or Redis-backed caching support
-- **Email Alerts** - SMTP-based alerts when failure rates exceed thresholds
-- **Dashboard** - Built-in HTML dashboard for telemetry visualization
-- **Migration Tool** - Migrate data from external sources to PocketBase
-
-## Architecture
-
-```
-┌─────────────────┐     ┌───────────────────┐     ┌────────────┐
-│  Bash Scripts   │────▶│ Telemetry Service │────▶│ PocketBase │
-│ (ProxmoxVE/VED) │     │    (this repo)    │     │  Database  │
-└─────────────────┘     └───────────────────┘     └────────────┘
-```
-
-## Project Structure
-
-```
-├── service.go          # Main service, HTTP handlers, rate limiting
-├── cache.go            # In-memory and Redis caching
-├── alerts.go           # SMTP alert system
-├── dashboard.go        # Dashboard HTML generation
-├── migration/
-│   ├── migrate.go      # Data migration tool
-│   └── migrate.sh      # Migration shell script
-├── Dockerfile          # Container build
-├── entrypoint.sh       # Container entrypoint with migration support
-└── go.mod              # Go module definition
-```
-
-## Related Projects
-
-- [ProxmoxVE](https://github.com/community-scripts/ProxmoxVE) - Proxmox VE Helper Scripts
-- [ProxmoxVED](https://github.com/community-scripts/ProxmoxVED) - Proxmox VE Helper Scripts (Dev)
-
-## Privacy & Compliance
-
-This service is designed with privacy in mind and is **GDPR/DSGVO compliant**:
-
-- ✅ **No personal data** - Only anonymous technical metrics are collected
-- ✅ **No IP logging** - Request logging is disabled by default, IPs are never stored
-- ✅ **Transparent** - All collected fields are documented and the code is open source
-- ✅ **No tracking** - Session IDs are randomly generated and cannot be linked to users
-- ✅ **No third parties** - Data is only stored in our self-hosted PocketBase instance
-
-## License
-
-MIT License - see [LICENSE](LICENSE) file.
diff --git a/misc/data/alerts.go b/misc/data/alerts.go
deleted file mode 100644
index 9890cbb7..00000000
--- a/misc/data/alerts.go
+++ /dev/null
@@ -1,853 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"crypto/tls"
-	"fmt"
-	"log"
-	"net/smtp"
-	"strings"
-	"sync"
-	"time"
-)
-
-// AlertConfig holds SMTP alert configuration
-type AlertConfig struct {
-	Enabled          bool
-	SMTPHost         string
-	SMTPPort         int
-	SMTPUser         string
-	SMTPPassword     string
-	SMTPFrom         string
-	SMTPTo           []string
-	UseTLS           bool
-	FailureThreshold float64       // Alert when failure rate exceeds this (e.g., 20.0 = 20%)
-	CheckInterval    time.Duration // How often to check
-	Cooldown         time.Duration // Minimum time between alerts
-
-	// Weekly Report settings
-	WeeklyReportEnabled bool          // Enable weekly summary reports
-	WeeklyReportDay     time.Weekday  // Day to send report (0=Sunday, 1=Monday, etc.)
-	WeeklyReportHour    int           // Hour to send report (0-23)
-}
-
-// WeeklyReportData contains aggregated weekly statistics
-type WeeklyReportData struct {
-	CalendarWeek     int
-	Year             int
-	StartDate        time.Time
-	EndDate          time.Time
-	TotalInstalls    int
-	SuccessCount     int
-	FailedCount      int
-	SuccessRate      float64
-	TopApps          []AppStat
-	TopFailedApps    []AppStat
-	ComparedToPrev   WeekComparison
-	OsDistribution   map[string]int
-	TypeDistribution map[string]int
-}
-
-// AppStat represents statistics for a single app
-type AppStat struct {
-	Name        string
-	Total       int
-	Failed      int
-	FailureRate float64
-}
-
-// WeekComparison shows changes compared to previous week
-type WeekComparison struct {
-	InstallsChange   int     // Difference in total installs
-	InstallsPercent  float64 // Percentage change
-	FailRateChange   float64 // Change in failure rate (percentage points)
-}
-
-// Alerter handles alerting functionality
-type Alerter struct {
-	cfg              AlertConfig
-	lastAlertAt      time.Time
-	lastWeeklyReport time.Time
-	mu               sync.Mutex
-	pb               *PBClient
-	lastStats        alertStats
-	alertHistory     []AlertEvent
-}
-
-type alertStats struct {
-	successCount int
-	failedCount  int
-	checkedAt    time.Time
-}
-
-// AlertEvent records an alert that was sent
-type AlertEvent struct {
-	Timestamp   time.Time `json:"timestamp"`
-	Type        string    `json:"type"`
-	Message     string    `json:"message"`
-	FailureRate float64   `json:"failure_rate,omitempty"`
-}
-
-// NewAlerter creates a new alerter instance
-func NewAlerter(cfg AlertConfig, pb *PBClient) *Alerter {
-	return &Alerter{
-		cfg:          cfg,
-		pb:           pb,
-		alertHistory: make([]AlertEvent, 0),
-	}
-}
-
-// Start begins the alert monitoring loop
-func (a *Alerter) Start() {
-	if !a.cfg.Enabled {
-		log.Println("INFO: alerting disabled")
-		return
-	}
-
-	if a.cfg.SMTPHost == "" || len(a.cfg.SMTPTo) == 0 {
-		log.Println("WARN: alerting enabled but SMTP not configured")
-		return
-	}
-
-	go a.monitorLoop()
-	log.Printf("INFO: alert monitoring started (threshold: %.1f%%, interval: %v)", a.cfg.FailureThreshold, a.cfg.CheckInterval)
-
-	// Start weekly report scheduler if enabled
-	if a.cfg.WeeklyReportEnabled {
-		go a.weeklyReportLoop()
-		log.Printf("INFO: weekly report scheduler started (day: %s, hour: %02d:00)", a.cfg.WeeklyReportDay, a.cfg.WeeklyReportHour)
-	}
-}
-
-func (a *Alerter) monitorLoop() {
-	ticker := time.NewTicker(a.cfg.CheckInterval)
-	defer ticker.Stop()
-
-	for range ticker.C {
-		a.checkAndAlert()
-	}
-}
-
-func (a *Alerter) checkAndAlert() {
-	ctx, cancel := newTimeoutContext(10 * time.Second)
-	defer cancel()
-
-	// Fetch last hour's data
-	data, err := a.pb.FetchDashboardData(ctx, 1, "ProxmoxVE")
-	if err != nil {
-		log.Printf("WARN: alert check failed: %v", err)
-		return
-	}
-
-	// Calculate current failure rate
-	total := data.SuccessCount + data.FailedCount
-	if total < 10 {
-		// Not enough data to determine rate
-		return
-	}
-
-	failureRate := float64(data.FailedCount) / float64(total) * 100
-
-	// Check if we should alert
-	if failureRate >= a.cfg.FailureThreshold {
-		a.maybeSendAlert(failureRate, data.FailedCount, total)
-	}
-}
-
-func (a *Alerter) maybeSendAlert(rate float64, failed, total int) {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-
-	// Check cooldown
-	if time.Since(a.lastAlertAt) < a.cfg.Cooldown {
-		return
-	}
-
-	// Send alert
-	subject := fmt.Sprintf("[ProxmoxVED Alert] High Failure Rate: %.1f%%", rate)
-	body := fmt.Sprintf(`ProxmoxVE Helper Scripts - Telemetry Alert
-
-⚠️ High installation failure rate detected!
-
-Current Statistics (last 24h):
-- Failure Rate: %.1f%%
-- Failed Installations: %d
-- Total Installations: %d
-- Threshold: %.1f%%
-
-Time: %s
-
-Please check the dashboard for more details.
-
----
-This is an automated alert from the telemetry service.
-`, rate, failed, total, a.cfg.FailureThreshold, time.Now().Format(time.RFC1123))
-
-	if err := a.sendEmail(subject, body); err != nil {
-		log.Printf("ERROR: failed to send alert email: %v", err)
-		return
-	}
-
-	a.lastAlertAt = time.Now()
-	a.alertHistory = append(a.alertHistory, AlertEvent{
-		Timestamp:   time.Now(),
-		Type:        "high_failure_rate",
-		Message:     fmt.Sprintf("Failure rate %.1f%% exceeded threshold %.1f%%", rate, a.cfg.FailureThreshold),
-		FailureRate: rate,
-	})
-
-	// Keep only last 100 alerts
-	if len(a.alertHistory) > 100 {
-		a.alertHistory = a.alertHistory[len(a.alertHistory)-100:]
-	}
-
-	log.Printf("ALERT: sent high failure rate alert (%.1f%%)", rate)
-}
-
-func (a *Alerter) sendEmail(subject, body string) error {
-	return a.sendEmailWithType(subject, body, "text/plain")
-}
-
-func (a *Alerter) sendHTMLEmail(subject, body string) error {
-	return a.sendEmailWithType(subject, body, "text/html")
-}
-
-func (a *Alerter) sendEmailWithType(subject, body, contentType string) error {
-	// Build message
-	var msg bytes.Buffer
-	msg.WriteString(fmt.Sprintf("From: %s\r\n", a.cfg.SMTPFrom))
-	msg.WriteString(fmt.Sprintf("To: %s\r\n", strings.Join(a.cfg.SMTPTo, ", ")))
-	msg.WriteString(fmt.Sprintf("Subject: %s\r\n", subject))
-	msg.WriteString("MIME-Version: 1.0\r\n")
-	msg.WriteString(fmt.Sprintf("Content-Type: %s; charset=UTF-8\r\n", contentType))
-	msg.WriteString("\r\n")
-	msg.WriteString(body)
-
-	addr := fmt.Sprintf("%s:%d", a.cfg.SMTPHost, a.cfg.SMTPPort)
-
-	var auth smtp.Auth
-	if a.cfg.SMTPUser != "" && a.cfg.SMTPPassword != "" {
-		auth = smtp.PlainAuth("", a.cfg.SMTPUser, a.cfg.SMTPPassword, a.cfg.SMTPHost)
-	}
-
-	if a.cfg.UseTLS {
-		// TLS connection
-		tlsConfig := &tls.Config{
-			ServerName: a.cfg.SMTPHost,
-		}
-
-		conn, err := tls.Dial("tcp", addr, tlsConfig)
-		if err != nil {
-			return fmt.Errorf("TLS dial failed: %w", err)
-		}
-		defer conn.Close()
-
-		client, err := smtp.NewClient(conn, a.cfg.SMTPHost)
-		if err != nil {
-			return fmt.Errorf("SMTP client failed: %w", err)
-		}
-		defer client.Close()
-
-		if auth != nil {
-			if err := client.Auth(auth); err != nil {
-				return fmt.Errorf("SMTP auth failed: %w", err)
-			}
-		}
-
-		if err := client.Mail(a.cfg.SMTPFrom); err != nil {
-			return fmt.Errorf("SMTP MAIL failed: %w", err)
-		}
-
-		for _, to := range a.cfg.SMTPTo {
-			if err := client.Rcpt(to); err != nil {
-				return fmt.Errorf("SMTP RCPT failed: %w", err)
-			}
-		}
-
-		w, err := client.Data()
-		if err != nil {
-			return fmt.Errorf("SMTP DATA failed: %w", err)
-		}
-
-		_, err = w.Write(msg.Bytes())
-		if err != nil {
-			return fmt.Errorf("SMTP write failed: %w", err)
-		}
-
-		return w.Close()
-	}
-
-	// Non-TLS (STARTTLS)
-	return smtp.SendMail(addr, auth, a.cfg.SMTPFrom, a.cfg.SMTPTo, msg.Bytes())
-}
-
-// GetAlertHistory returns recent alert events
-func (a *Alerter) GetAlertHistory() []AlertEvent {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	result := make([]AlertEvent, len(a.alertHistory))
-	copy(result, a.alertHistory)
-	return result
-}
-
-// TestAlert sends a test alert email
-func (a *Alerter) TestAlert() error {
-	if !a.cfg.Enabled || a.cfg.SMTPHost == "" {
-		return fmt.Errorf("alerting not configured")
-	}
-
-	subject := "[ProxmoxVED] Test Alert"
-	body := fmt.Sprintf(`This is a test alert from ProxmoxVE Helper Scripts telemetry service.
-
-If you received this email, your alert configuration is working correctly.
-
-Time: %s
-SMTP Host: %s
-Recipients: %s
-
----
-This is an automated test message.
-`, time.Now().Format(time.RFC1123), a.cfg.SMTPHost, strings.Join(a.cfg.SMTPTo, ", "))
-
-	return a.sendEmail(subject, body)
-}
-
-// Helper for timeout context
-func newTimeoutContext(d time.Duration) (context.Context, context.CancelFunc) {
-	return context.WithTimeout(context.Background(), d)
-}
-
-// weeklyReportLoop checks periodically if it's time to send the weekly report
-func (a *Alerter) weeklyReportLoop() {
-	// Check every hour
-	ticker := time.NewTicker(1 * time.Hour)
-	defer ticker.Stop()
-
-	for range ticker.C {
-		a.checkAndSendWeeklyReport()
-	}
-}
-
-// checkAndSendWeeklyReport sends the weekly report if it's the right time
-func (a *Alerter) checkAndSendWeeklyReport() {
-	now := time.Now()
-
-	// Check if it's the right day and hour
-	if now.Weekday() != a.cfg.WeeklyReportDay || now.Hour() != a.cfg.WeeklyReportHour {
-		return
-	}
-
-	a.mu.Lock()
-	// Check if we already sent a report this week
-	_, lastWeek := a.lastWeeklyReport.ISOWeek()
-	_, currentWeek := now.ISOWeek()
-	if a.lastWeeklyReport.Year() == now.Year() && lastWeek == currentWeek {
-		a.mu.Unlock()
-		return
-	}
-	a.mu.Unlock()
-
-	// Send the weekly report
-	if err := a.SendWeeklyReport(); err != nil {
-		log.Printf("ERROR: failed to send weekly report: %v", err)
-	}
-}
-
-// SendWeeklyReport generates and sends the weekly summary email
-func (a *Alerter) SendWeeklyReport() error {
-	if !a.cfg.Enabled || a.cfg.SMTPHost == "" {
-		return fmt.Errorf("alerting not configured")
-	}
-
-	ctx, cancel := newTimeoutContext(30 * time.Second)
-	defer cancel()
-
-	// Get data for the past week
-	reportData, err := a.fetchWeeklyReportData(ctx)
-	if err != nil {
-		return fmt.Errorf("failed to fetch weekly data: %w", err)
-	}
-
-	// Generate email content
-	subject := fmt.Sprintf("[ProxmoxVED] Weekly Report - Week %d, %d", reportData.CalendarWeek, reportData.Year)
-	body := a.generateWeeklyReportHTML(reportData)
-
-	if err := a.sendHTMLEmail(subject, body); err != nil {
-		return fmt.Errorf("failed to send email: %w", err)
-	}
-
-	a.mu.Lock()
-	a.lastWeeklyReport = time.Now()
-	a.alertHistory = append(a.alertHistory, AlertEvent{
-		Timestamp: time.Now(),
-		Type:      "weekly_report",
-		Message:   fmt.Sprintf("Weekly report KW %d/%d sent", reportData.CalendarWeek, reportData.Year),
-	})
-	a.mu.Unlock()
-
-	log.Printf("INFO: weekly report KW %d/%d sent successfully", reportData.CalendarWeek, reportData.Year)
-	return nil
-}
-
-// fetchWeeklyReportData collects data for the weekly report
-func (a *Alerter) fetchWeeklyReportData(ctx context.Context) (*WeeklyReportData, error) {
-	// Calculate the previous week's date range (Mon-Sun)
-	now := time.Now()
-	
-	// Find last Monday
-	daysToLastMonday := int(now.Weekday() - time.Monday)
-	if daysToLastMonday < 0 {
-		daysToLastMonday += 7
-	}
-	// Go back to the Monday of LAST week
-	lastMonday := now.AddDate(0, 0, -daysToLastMonday-7)
-	lastMonday = time.Date(lastMonday.Year(), lastMonday.Month(), lastMonday.Day(), 0, 0, 0, 0, lastMonday.Location())
-	lastSunday := lastMonday.AddDate(0, 0, 6)
-	lastSunday = time.Date(lastSunday.Year(), lastSunday.Month(), lastSunday.Day(), 23, 59, 59, 0, lastSunday.Location())
-
-	// Get calendar week
-	year, week := lastMonday.ISOWeek()
-
-	// Fetch current week's data (7 days)
-	currentData, err := a.pb.FetchDashboardData(ctx, 7, "ProxmoxVE")
-	if err != nil {
-		return nil, fmt.Errorf("failed to fetch current week data: %w", err)
-	}
-
-	// Fetch previous week's data for comparison (14 days, we'll compare)
-	prevData, err := a.pb.FetchDashboardData(ctx, 14, "ProxmoxVE")
-	if err != nil {
-		// Non-fatal, just log
-		log.Printf("WARN: could not fetch previous week data: %v", err)
-		prevData = nil
-	}
-
-	// Build report data
-	report := &WeeklyReportData{
-		CalendarWeek:     week,
-		Year:             year,
-		StartDate:        lastMonday,
-		EndDate:          lastSunday,
-		TotalInstalls:    currentData.TotalInstalls,
-		SuccessCount:     currentData.SuccessCount,
-		FailedCount:      currentData.FailedCount,
-		OsDistribution:   make(map[string]int),
-		TypeDistribution: make(map[string]int),
-	}
-
-	// Calculate success rate
-	if report.TotalInstalls > 0 {
-		report.SuccessRate = float64(report.SuccessCount) / float64(report.TotalInstalls) * 100
-	}
-
-	// Top 5 installed apps
-	for i, app := range currentData.TopApps {
-		if i >= 5 {
-			break
-		}
-		report.TopApps = append(report.TopApps, AppStat{
-			Name:  app.App,
-			Total: app.Count,
-		})
-	}
-
-	// Top 5 failed apps
-	for i, app := range currentData.FailedApps {
-		if i >= 5 {
-			break
-		}
-		report.TopFailedApps = append(report.TopFailedApps, AppStat{
-			Name:        app.App,
-			Total:       app.TotalCount,
-			Failed:      app.FailedCount,
-			FailureRate: app.FailureRate,
-		})
-	}
-
-	// OS distribution
-	for _, os := range currentData.OsDistribution {
-		report.OsDistribution[os.Os] = os.Count
-	}
-
-	// Type distribution (LXC vs VM)
-	for _, t := range currentData.TypeStats {
-		report.TypeDistribution[t.Type] = t.Count
-	}
-
-	// Calculate comparison to previous week
-	if prevData != nil {
-		// Previous week stats (subtract current from 14-day total)
-		prevInstalls := prevData.TotalInstalls - currentData.TotalInstalls
-		prevFailed := prevData.FailedCount - currentData.FailedCount
-		prevSuccess := prevData.SuccessCount - currentData.SuccessCount
-
-		if prevInstalls > 0 {
-			prevFailRate := float64(prevFailed) / float64(prevInstalls) * 100
-			currentFailRate := 100 - report.SuccessRate
-
-			report.ComparedToPrev.InstallsChange = report.TotalInstalls - prevInstalls
-			if prevInstalls > 0 {
-				report.ComparedToPrev.InstallsPercent = float64(report.TotalInstalls-prevInstalls) / float64(prevInstalls) * 100
-			}
-			report.ComparedToPrev.FailRateChange = currentFailRate - prevFailRate
-			_ = prevSuccess // suppress unused warning
-		}
-	}
-
-	return report, nil
-}
-
-// generateWeeklyReportHTML creates the HTML email body for the weekly report
-func (a *Alerter) generateWeeklyReportHTML(data *WeeklyReportData) string {
-	var b strings.Builder
-
-	// HTML Email Template
-	b.WriteString(`<!DOCTYPE html>
-<html>
-<head>
-<meta charset="UTF-8">
-<meta name="viewport" content="width=device-width, initial-scale=1.0">
-</head>
-<body style="margin:0;padding:0;background-color:#f6f9fc;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">
-<table width="100%" cellpadding="0" cellspacing="0" style="background-color:#f6f9fc;padding:40px 20px;">
-<tr><td align="center">
-<table width="600" cellpadding="0" cellspacing="0" style="background-color:#ffffff;border-radius:12px;box-shadow:0 4px 6px rgba(0,0,0,0.07);">
-
-<!-- Header -->
-<tr>
-<td style="background:linear-gradient(135deg,#667eea 0%,#764ba2 100%);padding:32px 40px;border-radius:12px 12px 0 0;">
-<h1 style="margin:0;color:#ffffff;font-size:24px;font-weight:600;">📊 Weekly Telemetry Report</h1>
-<p style="margin:8px 0 0;color:rgba(255,255,255,0.85);font-size:14px;">ProxmoxVE Helper Scripts</p>
-</td>
-</tr>
-
-<!-- Week Info -->
-<tr>
-<td style="padding:24px 40px 0;">
-<table width="100%" style="background:#f8fafc;border-radius:8px;padding:16px;">
-<tr>
-<td style="padding:12px 16px;">
-<span style="color:#64748b;font-size:12px;text-transform:uppercase;letter-spacing:0.5px;">Calendar Week</span><br>
-<span style="color:#1e293b;font-size:20px;font-weight:600;">Week `)
-	b.WriteString(fmt.Sprintf("%d, %d", data.CalendarWeek, data.Year))
-	b.WriteString(`</span>
-</td>
-<td style="padding:12px 16px;text-align:right;">
-<span style="color:#64748b;font-size:12px;text-transform:uppercase;letter-spacing:0.5px;">Period</span><br>
-<span style="color:#1e293b;font-size:14px;">`)
-	b.WriteString(fmt.Sprintf("%s – %s", data.StartDate.Format("Jan 02"), data.EndDate.Format("Jan 02, 2006")))
-	b.WriteString(`</span>
-</td>
-</tr>
-</table>
-</td>
-</tr>
-
-<!-- Stats Grid -->
-<tr>
-<td style="padding:24px 40px;">
-<table width="100%" cellpadding="0" cellspacing="0">
-<tr>
-<td width="25%" style="padding:8px;">
-<div style="background:#f0fdf4;border-radius:8px;padding:16px;text-align:center;">
-<div style="color:#16a34a;font-size:28px;font-weight:700;">`)
-	b.WriteString(fmt.Sprintf("%d", data.TotalInstalls))
-	b.WriteString(`</div>
-<div style="color:#166534;font-size:11px;text-transform:uppercase;letter-spacing:0.5px;margin-top:4px;">Total</div>
-</div>
-</td>
-<td width="25%" style="padding:8px;">
-<div style="background:#f0fdf4;border-radius:8px;padding:16px;text-align:center;">
-<div style="color:#16a34a;font-size:28px;font-weight:700;">`)
-	b.WriteString(fmt.Sprintf("%d", data.SuccessCount))
-	b.WriteString(`</div>
-<div style="color:#166534;font-size:11px;text-transform:uppercase;letter-spacing:0.5px;margin-top:4px;">Successful</div>
-</div>
-</td>
-<td width="25%" style="padding:8px;">
-<div style="background:#fef2f2;border-radius:8px;padding:16px;text-align:center;">
-<div style="color:#dc2626;font-size:28px;font-weight:700;">`)
-	b.WriteString(fmt.Sprintf("%d", data.FailedCount))
-	b.WriteString(`</div>
-<div style="color:#991b1b;font-size:11px;text-transform:uppercase;letter-spacing:0.5px;margin-top:4px;">Failed</div>
-</div>
-</td>
-<td width="25%" style="padding:8px;">
-<div style="background:#eff6ff;border-radius:8px;padding:16px;text-align:center;">
-<div style="color:#2563eb;font-size:28px;font-weight:700;">`)
-	b.WriteString(fmt.Sprintf("%.1f%%", data.SuccessRate))
-	b.WriteString(`</div>
-<div style="color:#1e40af;font-size:11px;text-transform:uppercase;letter-spacing:0.5px;margin-top:4px;">Success Rate</div>
-</div>
-</td>
-</tr>
-</table>
-</td>
-</tr>
-`)
-
-	// Week comparison
-	if data.ComparedToPrev.InstallsChange != 0 || data.ComparedToPrev.FailRateChange != 0 {
-		installIcon := "📈"
-		installColor := "#16a34a"
-		if data.ComparedToPrev.InstallsChange < 0 {
-			installIcon = "📉"
-			installColor = "#dc2626"
-		}
-		failIcon := "✅"
-		failColor := "#16a34a"
-		if data.ComparedToPrev.FailRateChange > 0 {
-			failIcon = "⚠️"
-			failColor = "#dc2626"
-		}
-
-		b.WriteString(`<tr>
-<td style="padding:0 40px 24px;">
-<table width="100%" style="background:#fafafa;border-radius:8px;">
-<tr>
-<td style="padding:16px;border-right:1px solid #e5e7eb;">
-<span style="font-size:12px;color:#64748b;">vs. Previous Week</span><br>
-<span style="font-size:16px;color:`)
-		b.WriteString(installColor)
-		b.WriteString(`;">`)
-		b.WriteString(installIcon)
-		b.WriteString(fmt.Sprintf(" %+d installations (%.1f%%)", data.ComparedToPrev.InstallsChange, data.ComparedToPrev.InstallsPercent))
-		b.WriteString(`</span>
-</td>
-<td style="padding:16px;">
-<span style="font-size:12px;color:#64748b;">Failure Rate Change</span><br>
-<span style="font-size:16px;color:`)
-		b.WriteString(failColor)
-		b.WriteString(`;">`)
-		b.WriteString(failIcon)
-		b.WriteString(fmt.Sprintf(" %+.1f percentage points", data.ComparedToPrev.FailRateChange))
-		b.WriteString(`</span>
-</td>
-</tr>
-</table>
-</td>
-</tr>
-`)
-	}
-
-	// Top 5 Installed Scripts
-	b.WriteString(`<tr>
-<td style="padding:0 40px 24px;">
-<h2 style="margin:0 0 16px;font-size:16px;color:#1e293b;border-bottom:2px solid #e2e8f0;padding-bottom:8px;">🏆 Top 5 Installed Scripts</h2>
-<table width="100%" cellpadding="0" cellspacing="0" style="font-size:14px;">
-`)
-	if len(data.TopApps) > 0 {
-		for i, app := range data.TopApps {
-			bgColor := "#ffffff"
-			if i%2 == 0 {
-				bgColor = "#f8fafc"
-			}
-			b.WriteString(fmt.Sprintf(`<tr style="background:%s;">
-<td style="padding:12px 16px;border-radius:4px 0 0 4px;">
-<span style="background:#e0e7ff;color:#4338ca;padding:2px 8px;border-radius:4px;font-size:12px;font-weight:600;">%d</span>
-<span style="margin-left:12px;font-weight:500;color:#1e293b;">%s</span>
-</td>
-<td style="padding:12px 16px;text-align:right;border-radius:0 4px 4px 0;color:#64748b;">%d installs</td>
-</tr>`, bgColor, i+1, app.Name, app.Total))
-		}
-	} else {
-		b.WriteString(`<tr><td style="padding:12px 16px;color:#64748b;">No data available</td></tr>`)
-	}
-	b.WriteString(`</table>
-</td>
-</tr>
-`)
-
-	// Top 5 Failed Scripts
-	b.WriteString(`<tr>
-<td style="padding:0 40px 24px;">
-<h2 style="margin:0 0 16px;font-size:16px;color:#1e293b;border-bottom:2px solid #e2e8f0;padding-bottom:8px;">⚠️ Top 5 Scripts with Highest Failure Rates</h2>
-<table width="100%" cellpadding="0" cellspacing="0" style="font-size:14px;">
-`)
-	if len(data.TopFailedApps) > 0 {
-		for i, app := range data.TopFailedApps {
-			bgColor := "#ffffff"
-			if i%2 == 0 {
-				bgColor = "#fef2f2"
-			}
-			rateColor := "#dc2626"
-			if app.FailureRate < 20 {
-				rateColor = "#ea580c"
-			}
-			if app.FailureRate < 10 {
-				rateColor = "#ca8a04"
-			}
-			b.WriteString(fmt.Sprintf(`<tr style="background:%s;">
-<td style="padding:12px 16px;border-radius:4px 0 0 4px;">
-<span style="font-weight:500;color:#1e293b;">%s</span>
-</td>
-<td style="padding:12px 16px;text-align:center;color:#64748b;">%d / %d failed</td>
-<td style="padding:12px 16px;text-align:right;border-radius:0 4px 4px 0;">
-<span style="background:%s;color:#ffffff;padding:4px 10px;border-radius:12px;font-size:12px;font-weight:600;">%.1f%%</span>
-</td>
-</tr>`, bgColor, app.Name, app.Failed, app.Total, rateColor, app.FailureRate))
-		}
-	} else {
-		b.WriteString(`<tr><td style="padding:12px 16px;color:#16a34a;">🎉 No failures this week!</td></tr>`)
-	}
-	b.WriteString(`</table>
-</td>
-</tr>
-`)
-
-	// Type Distribution
-	if len(data.TypeDistribution) > 0 {
-		b.WriteString(`<tr>
-<td style="padding:0 40px 24px;">
-<h2 style="margin:0 0 16px;font-size:16px;color:#1e293b;border-bottom:2px solid #e2e8f0;padding-bottom:8px;">📦 Distribution by Type</h2>
-<table width="100%" cellpadding="0" cellspacing="0">
-<tr>
-`)
-		for t, count := range data.TypeDistribution {
-			percent := float64(count) / float64(data.TotalInstalls) * 100
-			b.WriteString(fmt.Sprintf(`<td style="padding:8px;">
-<div style="background:#f1f5f9;border-radius:8px;padding:16px;text-align:center;">
-<div style="font-size:24px;font-weight:700;color:#475569;">%d</div>
-<div style="font-size:12px;color:#64748b;margin-top:4px;">%s (%.1f%%)</div>
-</div>
-</td>`, count, strings.ToUpper(t), percent))
-		}
-		b.WriteString(`</tr>
-</table>
-</td>
-</tr>
-`)
-	}
-
-	// OS Distribution
-	if len(data.OsDistribution) > 0 {
-		b.WriteString(`<tr>
-<td style="padding:0 40px 24px;">
-<h2 style="margin:0 0 16px;font-size:16px;color:#1e293b;border-bottom:2px solid #e2e8f0;padding-bottom:8px;">🐧 Top Operating Systems</h2>
-<table width="100%" cellpadding="0" cellspacing="0" style="font-size:14px;">
-`)
-		// Sort OS by count
-		type osEntry struct {
-			name  string
-			count int
-		}
-		var osList []osEntry
-		for name, count := range data.OsDistribution {
-			osList = append(osList, osEntry{name, count})
-		}
-		for i := 0; i < len(osList); i++ {
-			for j := i + 1; j < len(osList); j++ {
-				if osList[j].count > osList[i].count {
-					osList[i], osList[j] = osList[j], osList[i]
-				}
-			}
-		}
-		for i, os := range osList {
-			if i >= 5 {
-				break
-			}
-			percent := float64(os.count) / float64(data.TotalInstalls) * 100
-			barWidth := int(percent * 2) // Scale for visual
-			if barWidth > 100 {
-				barWidth = 100
-			}
-			b.WriteString(fmt.Sprintf(`<tr>
-<td style="padding:8px 16px;width:100px;">%s</td>
-<td style="padding:8px 16px;">
-<div style="background:#e2e8f0;border-radius:4px;height:20px;width:100%%;">
-<div style="background:linear-gradient(90deg,#667eea,#764ba2);border-radius:4px;height:20px;width:%d%%;"></div>
-</div>
-</td>
-<td style="padding:8px 16px;text-align:right;width:80px;color:#64748b;">%d (%.1f%%)</td>
-</tr>`, os.name, barWidth, os.count, percent))
-		}
-		b.WriteString(`</table>
-</td>
-</tr>
-`)
-	}
-
-	// Footer
-	b.WriteString(`<tr>
-<td style="padding:24px 40px;background:#f8fafc;border-radius:0 0 12px 12px;border-top:1px solid #e2e8f0;">
-<p style="margin:0;font-size:12px;color:#64748b;text-align:center;">
-Generated `)
-	b.WriteString(time.Now().Format("Jan 02, 2006 at 15:04 MST"))
-	b.WriteString(`<br>
-<a href="https://github.com/community-scripts/ProxmoxVE" style="color:#667eea;text-decoration:none;">ProxmoxVE Helper Scripts</a> — 
-This is an automated report from the telemetry service.
-</p>
-</td>
-</tr>
-
-</table>
-</td></tr>
-</table>
-</body>
-</html>`)
-
-	return b.String()
-}
-
-// generateWeeklyReportEmail creates the plain text email body (kept for compatibility)
-func (a *Alerter) generateWeeklyReportEmail(data *WeeklyReportData) string {
-	var b strings.Builder
-
-	b.WriteString("ProxmoxVE Helper Scripts - Weekly Telemetry Report\n")
-	b.WriteString("==================================================\n\n")
-
-	b.WriteString(fmt.Sprintf("Calendar Week: %d, %d\n", data.CalendarWeek, data.Year))
-	b.WriteString(fmt.Sprintf("Period: %s - %s\n\n",
-		data.StartDate.Format("Jan 02, 2006"),
-		data.EndDate.Format("Jan 02, 2006")))
-
-	b.WriteString("OVERVIEW\n")
-	b.WriteString("--------\n")
-	b.WriteString(fmt.Sprintf("Total Installations:  %d\n", data.TotalInstalls))
-	b.WriteString(fmt.Sprintf("Successful:           %d\n", data.SuccessCount))
-	b.WriteString(fmt.Sprintf("Failed:               %d\n", data.FailedCount))
-	b.WriteString(fmt.Sprintf("Success Rate:         %.1f%%\n\n", data.SuccessRate))
-
-	if data.ComparedToPrev.InstallsChange != 0 || data.ComparedToPrev.FailRateChange != 0 {
-		b.WriteString("vs. Previous Week:\n")
-		b.WriteString(fmt.Sprintf("  Installations: %+d (%.1f%%)\n", data.ComparedToPrev.InstallsChange, data.ComparedToPrev.InstallsPercent))
-		b.WriteString(fmt.Sprintf("  Failure Rate:  %+.1f pp\n\n", data.ComparedToPrev.FailRateChange))
-	}
-
-	b.WriteString("TOP 5 INSTALLED SCRIPTS\n")
-	b.WriteString("-----------------------\n")
-	for i, app := range data.TopApps {
-		if i >= 5 {
-			break
-		}
-		b.WriteString(fmt.Sprintf("%d. %-25s %5d installs\n", i+1, app.Name, app.Total))
-	}
-	b.WriteString("\n")
-
-	b.WriteString("TOP 5 FAILED SCRIPTS\n")
-	b.WriteString("--------------------\n")
-	if len(data.TopFailedApps) > 0 {
-		for i, app := range data.TopFailedApps {
-			if i >= 5 {
-				break
-			}
-			b.WriteString(fmt.Sprintf("%d. %-20s %3d/%3d failed (%.1f%%)\n",
-				i+1, app.Name, app.Failed, app.Total, app.FailureRate))
-		}
-	} else {
-		b.WriteString("No failures this week!\n")
-	}
-	b.WriteString("\n")
-
-	b.WriteString("---\n")
-	b.WriteString(fmt.Sprintf("Generated: %s\n", time.Now().Format("Jan 02, 2006 15:04 MST")))
-	b.WriteString("This is an automated report from the telemetry service.\n")
-
-	return b.String()
-}
-
-// TestWeeklyReport sends a test weekly report email
-func (a *Alerter) TestWeeklyReport() error {
-	return a.SendWeeklyReport()
-}
\ No newline at end of file
diff --git a/misc/data/cache.go b/misc/data/cache.go
deleted file mode 100644
index f45a3429..00000000
--- a/misc/data/cache.go
+++ /dev/null
@@ -1,158 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"log"
-	"sync"
-	"time"
-
-	"github.com/redis/go-redis/v9"
-)
-
-// CacheConfig holds cache configuration
-type CacheConfig struct {
-	RedisURL    string
-	EnableRedis bool
-	DefaultTTL  time.Duration
-}
-
-// Cache provides caching functionality with Redis or in-memory fallback
-type Cache struct {
-	redis      *redis.Client
-	useRedis   bool
-	defaultTTL time.Duration
-
-	// In-memory fallback
-	mu      sync.RWMutex
-	memData map[string]cacheEntry
-}
-
-type cacheEntry struct {
-	data      []byte
-	expiresAt time.Time
-}
-
-// NewCache creates a new cache instance
-func NewCache(cfg CacheConfig) *Cache {
-	c := &Cache{
-		defaultTTL: cfg.DefaultTTL,
-		memData:    make(map[string]cacheEntry),
-	}
-
-	if cfg.EnableRedis && cfg.RedisURL != "" {
-		opts, err := redis.ParseURL(cfg.RedisURL)
-		if err != nil {
-			log.Printf("WARN: invalid redis URL, using in-memory cache: %v", err)
-			return c
-		}
-
-		client := redis.NewClient(opts)
-		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-		defer cancel()
-
-		if err := client.Ping(ctx).Err(); err != nil {
-			log.Printf("WARN: redis connection failed, using in-memory cache: %v", err)
-			return c
-		}
-
-		c.redis = client
-		c.useRedis = true
-		log.Printf("INFO: connected to Redis for caching")
-	}
-
-	// Start cleanup goroutine for in-memory cache
-	if !c.useRedis {
-		go c.cleanupLoop()
-	}
-
-	return c
-}
-
-func (c *Cache) cleanupLoop() {
-	ticker := time.NewTicker(5 * time.Minute)
-	defer ticker.Stop()
-
-	for range ticker.C {
-		c.mu.Lock()
-		now := time.Now()
-		for k, v := range c.memData {
-			if now.After(v.expiresAt) {
-				delete(c.memData, k)
-			}
-		}
-		c.mu.Unlock()
-	}
-}
-
-// Get retrieves a value from cache
-func (c *Cache) Get(ctx context.Context, key string, dest interface{}) bool {
-	if c.useRedis {
-		data, err := c.redis.Get(ctx, key).Bytes()
-		if err != nil {
-			return false
-		}
-		return json.Unmarshal(data, dest) == nil
-	}
-
-	// In-memory fallback
-	c.mu.RLock()
-	entry, ok := c.memData[key]
-	c.mu.RUnlock()
-
-	if !ok || time.Now().After(entry.expiresAt) {
-		return false
-	}
-
-	return json.Unmarshal(entry.data, dest) == nil
-}
-
-// Set stores a value in cache
-func (c *Cache) Set(ctx context.Context, key string, value interface{}, ttl time.Duration) error {
-	if ttl == 0 {
-		ttl = c.defaultTTL
-	}
-
-	data, err := json.Marshal(value)
-	if err != nil {
-		return err
-	}
-
-	if c.useRedis {
-		return c.redis.Set(ctx, key, data, ttl).Err()
-	}
-
-	// In-memory fallback
-	c.mu.Lock()
-	c.memData[key] = cacheEntry{
-		data:      data,
-		expiresAt: time.Now().Add(ttl),
-	}
-	c.mu.Unlock()
-
-	return nil
-}
-
-// Delete removes a key from cache
-func (c *Cache) Delete(ctx context.Context, key string) error {
-	if c.useRedis {
-		return c.redis.Del(ctx, key).Err()
-	}
-
-	c.mu.Lock()
-	delete(c.memData, key)
-	c.mu.Unlock()
-	return nil
-}
-
-// InvalidateDashboard clears dashboard cache
-func (c *Cache) InvalidateDashboard(ctx context.Context) {
-	// Delete all dashboard cache keys
-	for days := 1; days <= 365; days++ {
-		_ = c.Delete(ctx, dashboardCacheKey(days))
-	}
-}
-
-func dashboardCacheKey(days int) string {
-	return "dashboard:" + string(rune(days))
-}
\ No newline at end of file
diff --git a/misc/data/cleanup.go b/misc/data/cleanup.go
deleted file mode 100644
index 5b0e672f..00000000
--- a/misc/data/cleanup.go
+++ /dev/null
@@ -1,173 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"log"
-	"net/http"
-	"net/url"
-	"time"
-)
-
-// CleanupConfig holds configuration for the cleanup job
-type CleanupConfig struct {
-	Enabled         bool
-	CheckInterval   time.Duration // How often to run cleanup
-	StuckAfterHours int           // Consider "installing" as stuck after X hours
-}
-
-// Cleaner handles cleanup of stuck installations
-type Cleaner struct {
-	cfg CleanupConfig
-	pb  *PBClient
-}
-
-// NewCleaner creates a new cleaner instance
-func NewCleaner(cfg CleanupConfig, pb *PBClient) *Cleaner {
-	return &Cleaner{
-		cfg: cfg,
-		pb:  pb,
-	}
-}
-
-// Start begins the cleanup loop
-func (c *Cleaner) Start() {
-	if !c.cfg.Enabled {
-		log.Println("INFO: cleanup job disabled")
-		return
-	}
-
-	go c.cleanupLoop()
-	log.Printf("INFO: cleanup job started (interval: %v, stuck after: %d hours)", c.cfg.CheckInterval, c.cfg.StuckAfterHours)
-}
-
-func (c *Cleaner) cleanupLoop() {
-	// Run immediately on start
-	c.runCleanup()
-
-	ticker := time.NewTicker(c.cfg.CheckInterval)
-	defer ticker.Stop()
-
-	for range ticker.C {
-		c.runCleanup()
-	}
-}
-
-// runCleanup finds and updates stuck installations
-func (c *Cleaner) runCleanup() {
-	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
-	defer cancel()
-
-	// Find stuck records
-	stuckRecords, err := c.findStuckInstallations(ctx)
-	if err != nil {
-		log.Printf("WARN: cleanup - failed to find stuck installations: %v", err)
-		return
-	}
-
-	if len(stuckRecords) == 0 {
-		log.Printf("INFO: cleanup - no stuck installations found")
-		return
-	}
-
-	log.Printf("INFO: cleanup - found %d stuck installations", len(stuckRecords))
-
-	// Update each record
-	updated := 0
-	for _, record := range stuckRecords {
-		if err := c.markAsUnknown(ctx, record.ID); err != nil {
-			log.Printf("WARN: cleanup - failed to update record %s: %v", record.ID, err)
-			continue
-		}
-		updated++
-	}
-
-	log.Printf("INFO: cleanup - updated %d stuck installations to 'unknown'", updated)
-}
-
-// StuckRecord represents a minimal record for cleanup
-type StuckRecord struct {
-	ID      string `json:"id"`
-	NSAPP   string `json:"nsapp"`
-	Created string `json:"created"`
-}
-
-// findStuckInstallations finds records that are stuck in "installing" status
-func (c *Cleaner) findStuckInstallations(ctx context.Context) ([]StuckRecord, error) {
-	if err := c.pb.ensureAuth(ctx); err != nil {
-		return nil, err
-	}
-
-	// Calculate cutoff time
-	cutoff := time.Now().Add(-time.Duration(c.cfg.StuckAfterHours) * time.Hour)
-	cutoffStr := cutoff.Format("2006-01-02 15:04:05")
-
-	// Build filter: status='installing' AND created < cutoff
-	filter := url.QueryEscape(fmt.Sprintf("status='installing' && created<'%s'", cutoffStr))
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet,
-		fmt.Sprintf("%s/api/collections/%s/records?filter=%s&perPage=100",
-			c.pb.baseURL, c.pb.targetColl, filter),
-		nil,
-	)
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Authorization", "Bearer "+c.pb.token)
-
-	resp, err := c.pb.http.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	var result struct {
-		Items []StuckRecord `json:"items"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return nil, err
-	}
-
-	return result.Items, nil
-}
-
-// markAsUnknown updates a record's status to "unknown"
-func (c *Cleaner) markAsUnknown(ctx context.Context, recordID string) error {
-	update := TelemetryStatusUpdate{
-		Status: "unknown",
-		Error:  "Installation timed out - no completion status received",
-	}
-	return c.pb.UpdateTelemetryStatus(ctx, recordID, update)
-}
-
-// RunNow triggers an immediate cleanup run (for testing/manual trigger)
-func (c *Cleaner) RunNow() (int, error) {
-	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
-	defer cancel()
-
-	stuckRecords, err := c.findStuckInstallations(ctx)
-	if err != nil {
-		return 0, fmt.Errorf("failed to find stuck installations: %w", err)
-	}
-
-	updated := 0
-	for _, record := range stuckRecords {
-		if err := c.markAsUnknown(ctx, record.ID); err != nil {
-			log.Printf("WARN: cleanup - failed to update record %s: %v", record.ID, err)
-			continue
-		}
-		updated++
-	}
-
-	return updated, nil
-}
-
-// GetStuckCount returns the current number of stuck installations
-func (c *Cleaner) GetStuckCount(ctx context.Context) (int, error) {
-	records, err := c.findStuckInstallations(ctx)
-	if err != nil {
-		return 0, err
-	}
-	return len(records), nil
-}
diff --git a/misc/data/dashboard.go b/misc/data/dashboard.go
deleted file mode 100644
index fbfff5ff..00000000
--- a/misc/data/dashboard.go
+++ /dev/null
@@ -1,2937 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/url"
-	"strings"
-	"time"
-)
-
-// DashboardData holds aggregated statistics for the dashboard
-type DashboardData struct {
-	TotalInstalls   int               `json:"total_installs"`
-	TotalAllTime    int               `json:"total_all_time"`    // Total records in DB (not limited)
-	SampleSize      int               `json:"sample_size"`       // How many records were sampled
-	SuccessCount    int               `json:"success_count"`
-	FailedCount     int               `json:"failed_count"`
-	InstallingCount int               `json:"installing_count"`
-	SuccessRate     float64           `json:"success_rate"`
-	TopApps         []AppCount        `json:"top_apps"`
-	OsDistribution  []OsCount         `json:"os_distribution"`
-	MethodStats     []MethodCount     `json:"method_stats"`
-	PveVersions     []PveCount        `json:"pve_versions"`
-	TypeStats       []TypeCount       `json:"type_stats"`
-	ErrorAnalysis   []ErrorGroup      `json:"error_analysis"`
-	FailedApps      []AppFailure      `json:"failed_apps"`
-	RecentRecords   []TelemetryRecord `json:"recent_records"`
-	DailyStats      []DailyStat       `json:"daily_stats"`
-
-	// Extended metrics
-	GPUStats           []GPUCount       `json:"gpu_stats"`
-	ErrorCategories    []ErrorCatCount  `json:"error_categories"`
-	TopTools           []ToolCount      `json:"top_tools"`
-	TopAddons          []AddonCount     `json:"top_addons"`
-	AvgInstallDuration float64          `json:"avg_install_duration"` // seconds
-	TotalTools         int              `json:"total_tools"`
-	TotalAddons        int              `json:"total_addons"`
-}
-
-type AppCount struct {
-	App   string `json:"app"`
-	Count int    `json:"count"`
-}
-
-type OsCount struct {
-	Os    string `json:"os"`
-	Count int    `json:"count"`
-}
-
-type MethodCount struct {
-	Method string `json:"method"`
-	Count  int    `json:"count"`
-}
-
-type PveCount struct {
-	Version string `json:"version"`
-	Count   int    `json:"count"`
-}
-
-type TypeCount struct {
-	Type  string `json:"type"`
-	Count int    `json:"count"`
-}
-
-type ErrorGroup struct {
-	Pattern string `json:"pattern"`
-	Count   int    `json:"count"`
-	Apps    string `json:"apps"` // Comma-separated list of affected apps
-}
-
-type AppFailure struct {
-	App         string  `json:"app"`
-	TotalCount  int     `json:"total_count"`
-	FailedCount int     `json:"failed_count"`
-	FailureRate float64 `json:"failure_rate"`
-}
-
-type DailyStat struct {
-	Date    string `json:"date"`
-	Success int    `json:"success"`
-	Failed  int    `json:"failed"`
-}
-
-// Extended metric types
-type GPUCount struct {
-	Vendor     string `json:"vendor"`
-	Passthrough string `json:"passthrough"`
-	Count      int    `json:"count"`
-}
-
-type ErrorCatCount struct {
-	Category string `json:"category"`
-	Count    int    `json:"count"`
-}
-
-type ToolCount struct {
-	Tool  string `json:"tool"`
-	Count int    `json:"count"`
-}
-
-type AddonCount struct {
-	Addon string `json:"addon"`
-	Count int    `json:"count"`
-}
-
-// FetchDashboardData retrieves aggregated data from PocketBase
-// repoSource filters by repo_source field ("ProxmoxVE", "ProxmoxVED", "external", or "" for all)
-func (p *PBClient) FetchDashboardData(ctx context.Context, days int, repoSource string) (*DashboardData, error) {
-	if err := p.ensureAuth(ctx); err != nil {
-		return nil, err
-	}
-
-	data := &DashboardData{}
-
-	// Build filter parts
-	var filterParts []string
-
-	// Date filter (days=0 means all entries)
-	if days > 0 {
-		since := time.Now().AddDate(0, 0, -days).Format("2006-01-02 00:00:00")
-		filterParts = append(filterParts, fmt.Sprintf("created >= '%s'", since))
-	}
-
-	// Repo source filter
-	if repoSource != "" {
-		filterParts = append(filterParts, fmt.Sprintf("repo_source = '%s'", repoSource))
-	}
-
-	var filter string
-	if len(filterParts) > 0 {
-		filter = url.QueryEscape(strings.Join(filterParts, " && "))
-	}
-
-	// Fetch all records for the period
-	result, err := p.fetchRecords(ctx, filter)
-	if err != nil {
-		return nil, err
-	}
-	records := result.Records
-	
-	// Set total counts
-	data.TotalAllTime = result.TotalItems    // Actual total in database
-	data.SampleSize = len(records)           // How many we actually processed
-
-	// Aggregate statistics
-	appCounts := make(map[string]int)
-	appFailures := make(map[string]int)
-	osCounts := make(map[string]int)
-	methodCounts := make(map[string]int)
-	pveCounts := make(map[string]int)
-	typeCounts := make(map[string]int)
-	errorPatterns := make(map[string]map[string]bool) // pattern -> set of apps
-	dailySuccess := make(map[string]int)
-	dailyFailed := make(map[string]int)
-
-	// Extended metrics maps
-	gpuCounts := make(map[string]int)              // "vendor|passthrough" -> count
-	errorCatCounts := make(map[string]int)          // category -> count
-	toolCounts := make(map[string]int)              // tool_name -> count
-	addonCounts := make(map[string]int)             // addon_name -> count
-	var totalDuration, durationCount int
-
-	for _, r := range records {
-		data.TotalInstalls++
-
-		switch r.Status {
-		case "success":
-			data.SuccessCount++
-		case "failed":
-			data.FailedCount++
-			// Track failed apps
-			if r.NSAPP != "" {
-				appFailures[r.NSAPP]++
-			}
-			// Group errors by pattern
-			if r.Error != "" {
-				pattern := normalizeError(r.Error)
-				if errorPatterns[pattern] == nil {
-					errorPatterns[pattern] = make(map[string]bool)
-				}
-				if r.NSAPP != "" {
-					errorPatterns[pattern][r.NSAPP] = true
-				}
-			}
-		case "installing":
-			data.InstallingCount++
-		}
-
-		// Count apps
-		if r.NSAPP != "" {
-			appCounts[r.NSAPP]++
-		}
-
-		// Count OS
-		if r.OsType != "" {
-			osCounts[r.OsType]++
-		}
-
-		// Count methods
-		if r.Method != "" {
-			methodCounts[r.Method]++
-		}
-
-		// Count PVE versions
-		if r.PveVer != "" {
-			pveCounts[r.PveVer]++
-		}
-
-		// Count types (LXC vs VM)
-		if r.Type != "" {
-			typeCounts[r.Type]++
-		}
-
-		// === Extended metrics tracking ===
-
-		// Track tool executions (type="tool", tool name is in nsapp)
-		if r.Type == "tool" && r.NSAPP != "" {
-			toolCounts[r.NSAPP]++
-			data.TotalTools++
-		}
-
-		// Track addon installations
-		if r.Type == "addon" {
-			addonCounts[r.NSAPP]++
-			data.TotalAddons++
-		}
-
-		// Track GPU usage
-		if r.GPUVendor != "" {
-			key := r.GPUVendor
-			if r.GPUPassthrough != "" {
-				key += "|" + r.GPUPassthrough
-			}
-			gpuCounts[key]++
-		}
-
-		// Track error categories
-		if r.Status == "failed" && r.ErrorCategory != "" {
-			errorCatCounts[r.ErrorCategory]++
-		}
-
-		// Track install duration (for averaging)
-		if r.InstallDuration > 0 {
-			totalDuration += r.InstallDuration
-			durationCount++
-		}
-
-		// Daily stats (use Created field if available)
-		if r.Created != "" {
-			date := r.Created[:10] // "2026-02-09"
-			if r.Status == "success" {
-				dailySuccess[date]++
-			} else if r.Status == "failed" {
-				dailyFailed[date]++
-			}
-		}
-	}
-
-	// Calculate success rate
-	completed := data.SuccessCount + data.FailedCount
-	if completed > 0 {
-		data.SuccessRate = float64(data.SuccessCount) / float64(completed) * 100
-	}
-
-	// Convert maps to sorted slices (increased limits for better analytics)
-	data.TopApps = topN(appCounts, 20)
-	data.OsDistribution = topNOs(osCounts, 15)
-	data.MethodStats = topNMethod(methodCounts, 10)
-	data.PveVersions = topNPve(pveCounts, 15)
-	data.TypeStats = topNType(typeCounts, 10)
-
-	// Error analysis
-	data.ErrorAnalysis = buildErrorAnalysis(errorPatterns, 15)
-
-	// Failed apps with failure rates (min 10 installs threshold)
-	data.FailedApps = buildFailedApps(appCounts, appFailures, 15)
-
-	// Daily stats for chart
-	data.DailyStats = buildDailyStats(dailySuccess, dailyFailed, days)
-
-	// === Extended metrics ===
-
-	// GPU stats
-	data.GPUStats = buildGPUStats(gpuCounts)
-
-	// Error categories
-	data.ErrorCategories = buildErrorCategories(errorCatCounts)
-
-	// Top tools
-	data.TopTools = buildToolStats(toolCounts, 15)
-
-	// Top addons
-	data.TopAddons = buildAddonStats(addonCounts, 15)
-
-	// Average install duration
-	if durationCount > 0 {
-		data.AvgInstallDuration = float64(totalDuration) / float64(durationCount)
-	}
-
-	// Recent records (last 20)
-	if len(records) > 20 {
-		data.RecentRecords = records[:20]
-	} else {
-		data.RecentRecords = records
-	}
-
-	return data, nil
-}
-
-// TelemetryRecord includes Created timestamp
-type TelemetryRecord struct {
-	TelemetryOut
-	Created string `json:"created"`
-}
-
-// fetchRecordsResult contains records and total count
-type fetchRecordsResult struct {
-	Records    []TelemetryRecord
-	TotalItems int // Actual total in database (not limited)
-}
-
-func (p *PBClient) fetchRecords(ctx context.Context, filter string) (*fetchRecordsResult, error) {
-	var allRecords []TelemetryRecord
-	page := 1
-	perPage := 500
-	maxRecords := 100000 // Limit to prevent timeout with large datasets
-	totalItems := 0
-
-	for {
-		var reqURL string
-		if filter != "" {
-			reqURL = fmt.Sprintf("%s/api/collections/%s/records?filter=%s&sort=-created&page=%d&perPage=%d",
-				p.baseURL, p.targetColl, filter, page, perPage)
-		} else {
-			reqURL = fmt.Sprintf("%s/api/collections/%s/records?sort=-created&page=%d&perPage=%d",
-				p.baseURL, p.targetColl, page, perPage)
-		}
-
-		req, err := http.NewRequestWithContext(ctx, http.MethodGet, reqURL, nil)
-		if err != nil {
-			return nil, err
-		}
-		req.Header.Set("Authorization", "Bearer "+p.token)
-
-		resp, err := p.http.Do(req)
-		if err != nil {
-			return nil, err
-		}
-
-		var result struct {
-			Items      []TelemetryRecord `json:"items"`
-			TotalItems int               `json:"totalItems"`
-		}
-		if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-			resp.Body.Close()
-			return nil, err
-		}
-		resp.Body.Close()
-
-		// Store total on first page
-		if page == 1 {
-			totalItems = result.TotalItems
-		}
-
-		allRecords = append(allRecords, result.Items...)
-
-		// Stop if we have enough records or reached the end
-		if len(allRecords) >= maxRecords || len(allRecords) >= result.TotalItems {
-			break
-		}
-		page++
-	}
-
-	return &fetchRecordsResult{
-		Records:    allRecords,
-		TotalItems: totalItems,
-	}, nil
-}
-
-func topN(m map[string]int, n int) []AppCount {
-	result := make([]AppCount, 0, len(m))
-	for k, v := range m {
-		result = append(result, AppCount{App: k, Count: v})
-	}
-	// Simple bubble sort for small datasets
-	for i := 0; i < len(result)-1; i++ {
-		for j := i + 1; j < len(result); j++ {
-			if result[j].Count > result[i].Count {
-				result[i], result[j] = result[j], result[i]
-			}
-		}
-	}
-	if len(result) > n {
-		return result[:n]
-	}
-	return result
-}
-
-func topNOs(m map[string]int, n int) []OsCount {
-	result := make([]OsCount, 0, len(m))
-	for k, v := range m {
-		result = append(result, OsCount{Os: k, Count: v})
-	}
-	for i := 0; i < len(result)-1; i++ {
-		for j := i + 1; j < len(result); j++ {
-			if result[j].Count > result[i].Count {
-				result[i], result[j] = result[j], result[i]
-			}
-		}
-	}
-	if len(result) > n {
-		return result[:n]
-	}
-	return result
-}
-
-func topNMethod(m map[string]int, n int) []MethodCount {
-	result := make([]MethodCount, 0, len(m))
-	for k, v := range m {
-		result = append(result, MethodCount{Method: k, Count: v})
-	}
-	for i := 0; i < len(result)-1; i++ {
-		for j := i + 1; j < len(result); j++ {
-			if result[j].Count > result[i].Count {
-				result[i], result[j] = result[j], result[i]
-			}
-		}
-	}
-	if len(result) > n {
-		return result[:n]
-	}
-	return result
-}
-
-func topNPve(m map[string]int, n int) []PveCount {
-	result := make([]PveCount, 0, len(m))
-	for k, v := range m {
-		result = append(result, PveCount{Version: k, Count: v})
-	}
-	for i := 0; i < len(result)-1; i++ {
-		for j := i + 1; j < len(result); j++ {
-			if result[j].Count > result[i].Count {
-				result[i], result[j] = result[j], result[i]
-			}
-		}
-	}
-	if len(result) > n {
-		return result[:n]
-	}
-	return result
-}
-
-func topNType(m map[string]int, n int) []TypeCount {
-	result := make([]TypeCount, 0, len(m))
-	for k, v := range m {
-		result = append(result, TypeCount{Type: k, Count: v})
-	}
-	for i := 0; i < len(result)-1; i++ {
-		for j := i + 1; j < len(result); j++ {
-			if result[j].Count > result[i].Count {
-				result[i], result[j] = result[j], result[i]
-			}
-		}
-	}
-	if len(result) > n {
-		return result[:n]
-	}
-	return result
-}
-
-// normalizeError simplifies error messages into patterns for grouping
-func normalizeError(err string) string {
-	err = strings.TrimSpace(err)
-	if err == "" {
-		return "unknown"
-	}
-
-	// Normalize common patterns
-	err = strings.ToLower(err)
-
-	// Remove specific numbers, IPs, paths that vary
-	// Keep it simple for now - just truncate and normalize
-	if len(err) > 60 {
-		err = err[:60]
-	}
-
-	// Common error pattern replacements
-	patterns := map[string]string{
-		"connection refused":  "connection refused",
-		"timeout":             "timeout",
-		"no space left":       "disk full",
-		"permission denied":   "permission denied",
-		"not found":           "not found",
-		"failed to download":  "download failed",
-		"apt":                 "apt error",
-		"dpkg":                "dpkg error",
-		"curl":                "network error",
-		"wget":                "network error",
-		"docker":              "docker error",
-		"systemctl":           "systemd error",
-		"service":             "service error",
-	}
-
-	for pattern, label := range patterns {
-		if strings.Contains(err, pattern) {
-			return label
-		}
-	}
-
-	// If no pattern matches, return first 40 chars
-	if len(err) > 40 {
-		return err[:40] + "..."
-	}
-	return err
-}
-
-func buildErrorAnalysis(patterns map[string]map[string]bool, n int) []ErrorGroup {
-	result := make([]ErrorGroup, 0, len(patterns))
-
-	for pattern, apps := range patterns {
-		appList := make([]string, 0, len(apps))
-		for app := range apps {
-			appList = append(appList, app)
-		}
-
-		// Limit app list display
-		appsStr := strings.Join(appList, ", ")
-		if len(appsStr) > 50 {
-			appsStr = appsStr[:47] + "..."
-		}
-
-		result = append(result, ErrorGroup{
-			Pattern: pattern,
-			Count:   len(apps), // Number of unique apps with this error
-			Apps:    appsStr,
-		})
-	}
-
-	// Sort by count descending
-	for i := 0; i < len(result)-1; i++ {
-		for j := i + 1; j < len(result); j++ {
-			if result[j].Count > result[i].Count {
-				result[i], result[j] = result[j], result[i]
-			}
-		}
-	}
-
-	if len(result) > n {
-		return result[:n]
-	}
-	return result
-}
-
-func buildFailedApps(total, failed map[string]int, n int) []AppFailure {
-	result := make([]AppFailure, 0)
-	minInstalls := 10 // Minimum installations to be considered (avoid noise from rare apps)
-
-	for app, failCount := range failed {
-		totalCount := total[app]
-		if totalCount < minInstalls {
-			continue // Skip apps with too few installations
-		}
-
-		rate := float64(failCount) / float64(totalCount) * 100
-		result = append(result, AppFailure{
-			App:         app,
-			TotalCount:  totalCount,
-			FailedCount: failCount,
-			FailureRate: rate,
-		})
-	}
-
-	// Sort by failure rate descending
-	for i := 0; i < len(result)-1; i++ {
-		for j := i + 1; j < len(result); j++ {
-			if result[j].FailureRate > result[i].FailureRate {
-				result[i], result[j] = result[j], result[i]
-			}
-		}
-	}
-
-	if len(result) > n {
-		return result[:n]
-	}
-	return result
-}
-
-func buildDailyStats(success, failed map[string]int, days int) []DailyStat {
-	result := make([]DailyStat, 0, days)
-	for i := days - 1; i >= 0; i-- {
-		date := time.Now().AddDate(0, 0, -i).Format("2006-01-02")
-		result = append(result, DailyStat{
-			Date:    date,
-			Success: success[date],
-			Failed:  failed[date],
-		})
-	}
-	return result
-}
-
-// === Extended metrics helper functions ===
-
-func buildGPUStats(gpuCounts map[string]int) []GPUCount {
-	result := make([]GPUCount, 0, len(gpuCounts))
-	for key, count := range gpuCounts {
-		parts := strings.Split(key, "|")
-		vendor := parts[0]
-		passthrough := ""
-		if len(parts) > 1 {
-			passthrough = parts[1]
-		}
-		result = append(result, GPUCount{
-			Vendor:      vendor,
-			Passthrough: passthrough,
-			Count:       count,
-		})
-	}
-	// Sort by count descending
-	for i := 0; i < len(result)-1; i++ {
-		for j := i + 1; j < len(result); j++ {
-			if result[j].Count > result[i].Count {
-				result[i], result[j] = result[j], result[i]
-			}
-		}
-	}
-	return result
-}
-
-func buildErrorCategories(catCounts map[string]int) []ErrorCatCount {
-	result := make([]ErrorCatCount, 0, len(catCounts))
-	for cat, count := range catCounts {
-		result = append(result, ErrorCatCount{
-			Category: cat,
-			Count:    count,
-		})
-	}
-	// Sort by count descending
-	for i := 0; i < len(result)-1; i++ {
-		for j := i + 1; j < len(result); j++ {
-			if result[j].Count > result[i].Count {
-				result[i], result[j] = result[j], result[i]
-			}
-		}
-	}
-	return result
-}
-
-func buildToolStats(toolCounts map[string]int, n int) []ToolCount {
-	result := make([]ToolCount, 0, len(toolCounts))
-	for tool, count := range toolCounts {
-		result = append(result, ToolCount{
-			Tool:  tool,
-			Count: count,
-		})
-	}
-	// Sort by count descending
-	for i := 0; i < len(result)-1; i++ {
-		for j := i + 1; j < len(result); j++ {
-			if result[j].Count > result[i].Count {
-				result[i], result[j] = result[j], result[i]
-			}
-		}
-	}
-	if len(result) > n {
-		return result[:n]
-	}
-	return result
-}
-
-func buildAddonStats(addonCounts map[string]int, n int) []AddonCount {
-	result := make([]AddonCount, 0, len(addonCounts))
-	for addon, count := range addonCounts {
-		result = append(result, AddonCount{
-			Addon: addon,
-			Count: count,
-		})
-	}
-	// Sort by count descending
-	for i := 0; i < len(result)-1; i++ {
-		for j := i + 1; j < len(result); j++ {
-			if result[j].Count > result[i].Count {
-				result[i], result[j] = result[j], result[i]
-			}
-		}
-	}
-	if len(result) > n {
-		return result[:n]
-	}
-	return result
-}
-
-// DashboardHTML returns the embedded dashboard HTML
-func DashboardHTML() string {
-	return `<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Analytics - Proxmox VE Helper-Scripts</title>
-    <meta name="description" content="Installation analytics and telemetry for Proxmox VE Helper Scripts">
-    <link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>📊</text></svg>">
-    <script src="https://cdn.jsdelivr.net/npm/chart.js"></script>
-    <link rel="preconnect" href="https://fonts.googleapis.com">
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet">
-    <style>
-        :root {
-            --bg-primary: #0a0e14;
-            --bg-secondary: #131920;
-            --bg-tertiary: #1a2029;
-            --bg-card: #151b23;
-            --border-color: #2d3748;
-            --text-primary: #e2e8f0;
-            --text-secondary: #8b949e;
-            --text-muted: #64748b;
-            --accent-blue: #3b82f6;
-            --accent-cyan: #22d3ee;
-            --accent-green: #22c55e;
-            --accent-red: #ef4444;
-            --accent-yellow: #eab308;
-            --accent-orange: #f97316;
-            --accent-purple: #a855f7;
-            --accent-pink: #ec4899;
-            --accent-lime: #84cc16;
-            --gradient-blue: linear-gradient(135deg, #3b82f6 0%, #1d4ed8 100%);
-            --gradient-green: linear-gradient(135deg, #22c55e 0%, #16a34a 100%);
-            --gradient-red: linear-gradient(135deg, #ef4444 0%, #dc2626 100%);
-            --shadow-sm: 0 1px 2px 0 rgb(0 0 0 / 0.05);
-            --shadow-md: 0 4px 6px -1px rgb(0 0 0 / 0.1), 0 2px 4px -2px rgb(0 0 0 / 0.1);
-            --shadow-lg: 0 10px 15px -3px rgb(0 0 0 / 0.1), 0 4px 6px -4px rgb(0 0 0 / 0.1);
-        }
-        
-        [data-theme="light"] {
-            --bg-primary: #f8fafc;
-            --bg-secondary: #ffffff;
-            --bg-tertiary: #f1f5f9;
-            --bg-card: #ffffff;
-            --border-color: #e2e8f0;
-            --text-primary: #1e293b;
-            --text-secondary: #64748b;
-            --text-muted: #94a3b8;
-        }
-        
-        * {
-            margin: 0;
-            padding: 0;
-            box-sizing: border-box;
-        }
-        
-        body {
-            font-family: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
-            background: var(--bg-primary);
-            color: var(--text-primary);
-            min-height: 100vh;
-            line-height: 1.5;
-        }
-        
-        /* Top Navigation Bar */
-        .navbar {
-            background: var(--bg-secondary);
-            border-bottom: 1px solid var(--border-color);
-            padding: 0 24px;
-            height: 64px;
-            display: flex;
-            align-items: center;
-            justify-content: space-between;
-            position: sticky;
-            top: 0;
-            z-index: 100;
-            backdrop-filter: blur(10px);
-        }
-        
-        .navbar-brand {
-            display: flex;
-            align-items: center;
-            gap: 12px;
-            text-decoration: none;
-            color: var(--text-primary);
-            font-weight: 600;
-            font-size: 16px;
-        }
-        
-        .navbar-brand svg {
-            color: var(--accent-cyan);
-        }
-        
-        .navbar-center {
-            flex: 1;
-            display: flex;
-            justify-content: center;
-            padding: 0 40px;
-        }
-        
-        .search-box {
-            position: relative;
-            width: 100%;
-            max-width: 320px;
-        }
-        
-        .search-box input {
-            width: 100%;
-            background: var(--bg-tertiary);
-            border: 1px solid var(--border-color);
-            color: var(--text-primary);
-            padding: 10px 16px 10px 40px;
-            border-radius: 8px;
-            font-size: 14px;
-            outline: none;
-            transition: border-color 0.2s, box-shadow 0.2s;
-        }
-        
-        .search-box input::placeholder {
-            color: var(--text-muted);
-        }
-        
-        .search-box input:focus {
-            border-color: var(--accent-blue);
-            box-shadow: 0 0 0 3px rgba(59, 130, 246, 0.1);
-        }
-        
-        .search-box svg {
-            position: absolute;
-            left: 12px;
-            top: 50%;
-            transform: translateY(-50%);
-            color: var(--text-muted);
-        }
-        
-        .search-box .shortcut {
-            position: absolute;
-            right: 12px;
-            top: 50%;
-            transform: translateY(-50%);
-            background: var(--bg-primary);
-            border: 1px solid var(--border-color);
-            padding: 2px 8px;
-            border-radius: 4px;
-            font-size: 11px;
-            color: var(--text-muted);
-        }
-        
-        .navbar-actions {
-            display: flex;
-            align-items: center;
-            gap: 12px;
-        }
-        
-        .github-stars {
-            display: flex;
-            align-items: center;
-            gap: 6px;
-            background: var(--accent-yellow);
-            color: #000;
-            padding: 6px 14px;
-            border-radius: 20px;
-            font-size: 13px;
-            font-weight: 600;
-            text-decoration: none;
-            transition: transform 0.2s;
-        }
-        
-        .github-stars:hover {
-            transform: scale(1.05);
-        }
-        
-        .nav-icon {
-            width: 40px;
-            height: 40px;
-            display: flex;
-            align-items: center;
-            justify-content: center;
-            border-radius: 8px;
-            color: var(--text-secondary);
-            transition: background 0.2s, color 0.2s;
-            cursor: pointer;
-            border: none;
-            background: transparent;
-        }
-        
-        .nav-icon:hover {
-            background: var(--bg-tertiary);
-            color: var(--text-primary);
-        }
-        
-        /* Main Content */
-        .main-content {
-            padding: 32px;
-            max-width: 1600px;
-            margin: 0 auto;
-        }
-        
-        /* Page Header */
-        .page-header {
-            margin-bottom: 32px;
-        }
-        
-        .page-header h1 {
-            font-size: 28px;
-            font-weight: 700;
-            margin-bottom: 8px;
-        }
-        
-        .page-header p {
-            color: var(--text-secondary);
-            font-size: 15px;
-        }
-        
-        /* Stat Cards Grid */
-        .stats-grid {
-            display: grid;
-            grid-template-columns: repeat(4, 1fr);
-            gap: 20px;
-            margin-bottom: 32px;
-        }
-        
-        @media (max-width: 1200px) {
-            .stats-grid {
-                grid-template-columns: repeat(2, 1fr);
-            }
-        }
-        
-        @media (max-width: 640px) {
-            .stats-grid {
-                grid-template-columns: 1fr;
-            }
-        }
-        
-        .stat-card {
-            background: var(--bg-card);
-            border: 1px solid var(--border-color);
-            border-radius: 12px;
-            padding: 24px;
-            position: relative;
-            overflow: hidden;
-        }
-        
-        .stat-card-header {
-            display: flex;
-            justify-content: space-between;
-            align-items: flex-start;
-            margin-bottom: 16px;
-        }
-        
-        .stat-card-label {
-            font-size: 14px;
-            color: var(--text-secondary);
-            font-weight: 500;
-        }
-        
-        .stat-card-icon {
-            width: 36px;
-            height: 36px;
-            display: flex;
-            align-items: center;
-            justify-content: center;
-            border-radius: 8px;
-            color: var(--text-secondary);
-        }
-        
-        .stat-card-value {
-            font-size: 36px;
-            font-weight: 700;
-            line-height: 1;
-            margin-bottom: 6px;
-        }
-        
-        .stat-card-subtitle {
-            font-size: 13px;
-            color: var(--text-muted);
-        }
-        
-        .stat-card.success .stat-card-icon { color: var(--accent-green); }
-        .stat-card.success .stat-card-value { color: var(--accent-green); }
-        .stat-card.failed .stat-card-icon { color: var(--accent-red); }
-        .stat-card.failed .stat-card-value { color: var(--accent-red); }
-        .stat-card.popular .stat-card-icon { color: var(--accent-yellow); }
-        .stat-card.popular .stat-card-value { font-size: 24px; }
-        
-        /* Section Cards */
-        .section-card {
-            background: var(--bg-card);
-            border: 1px solid var(--border-color);
-            border-radius: 12px;
-            margin-bottom: 24px;
-            overflow: hidden;
-        }
-        
-        .section-header {
-            display: flex;
-            justify-content: space-between;
-            align-items: center;
-            padding: 20px 24px;
-            border-bottom: 1px solid var(--border-color);
-        }
-        
-        .section-header h2 {
-            font-size: 18px;
-            font-weight: 600;
-        }
-        
-        .section-header p {
-            font-size: 13px;
-            color: var(--text-secondary);
-            margin-top: 2px;
-        }
-        
-        .section-actions {
-            display: flex;
-            gap: 8px;
-        }
-        
-        .btn {
-            display: inline-flex;
-            align-items: center;
-            gap: 6px;
-            padding: 8px 16px;
-            border-radius: 8px;
-            font-size: 13px;
-            font-weight: 500;
-            cursor: pointer;
-            transition: all 0.2s;
-            border: 1px solid var(--border-color);
-            background: var(--bg-tertiary);
-            color: var(--text-primary);
-        }
-        
-        .btn:hover {
-            background: var(--bg-primary);
-            border-color: var(--accent-blue);
-        }
-        
-        .btn-primary {
-            background: var(--accent-blue);
-            border-color: var(--accent-blue);
-            color: #fff;
-        }
-        
-        .btn-primary:hover {
-            background: #2563eb;
-        }
-        
-        /* Top Applications Chart */
-        .chart-container {
-            padding: 24px;
-            height: 420px;
-        }
-        
-        /* Filters Section */
-        .filters-bar {
-            display: flex;
-            align-items: center;
-            gap: 16px;
-            padding: 16px 24px;
-            background: var(--bg-tertiary);
-            border-bottom: 1px solid var(--border-color);
-            flex-wrap: wrap;
-        }
-        
-        .filter-group {
-            display: flex;
-            align-items: center;
-            gap: 8px;
-        }
-        
-        .filter-group label {
-            font-size: 13px;
-            color: var(--text-secondary);
-            white-space: nowrap;
-        }
-        
-        .quickfilter {
-            display: flex;
-            gap: 4px;
-            background: var(--bg-secondary);
-            padding: 4px;
-            border-radius: 8px;
-            border: 1px solid var(--border-color);
-        }
-        
-        .filter-btn {
-            background: transparent;
-            border: none;
-            color: var(--text-secondary);
-            padding: 6px 14px;
-            border-radius: 6px;
-            font-size: 13px;
-            font-weight: 500;
-            cursor: pointer;
-            transition: all 0.2s;
-        }
-        
-        .filter-btn:hover {
-            background: var(--bg-tertiary);
-            color: var(--text-primary);
-        }
-        
-        .filter-btn.active {
-            background: var(--accent-blue);
-            color: #fff;
-        }
-        
-        /* Custom Select */
-        .custom-select {
-            background: var(--bg-secondary);
-            border: 1px solid var(--border-color);
-            color: var(--text-primary);
-            padding: 8px 32px 8px 12px;
-            border-radius: 8px;
-            font-size: 13px;
-            cursor: pointer;
-            outline: none;
-            appearance: none;
-            background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 24 24' fill='none' stroke='%238b949e' stroke-width='2'%3E%3Cpath d='M6 9l6 6 6-6'/%3E%3C/svg%3E");
-            background-repeat: no-repeat;
-            background-position: right 10px center;
-        }
-        
-        .custom-select:focus {
-            border-color: var(--accent-blue);
-        }
-        
-        .search-input {
-            background: var(--bg-secondary);
-            border: 1px solid var(--border-color);
-            color: var(--text-primary);
-            padding: 8px 12px;
-            border-radius: 8px;
-            font-size: 13px;
-            outline: none;
-            min-width: 200px;
-        }
-        
-        .search-input:focus {
-            border-color: var(--accent-blue);
-        }
-        
-        .search-input::placeholder {
-            color: var(--text-muted);
-        }
-        
-        /* Table Styles */
-        .table-wrapper {
-            overflow-x: auto;
-        }
-        
-        table {
-            width: 100%;
-            border-collapse: collapse;
-        }
-        
-        th, td {
-            padding: 14px 20px;
-            text-align: left;
-        }
-        
-        th {
-            font-size: 12px;
-            font-weight: 600;
-            color: var(--text-secondary);
-            text-transform: uppercase;
-            letter-spacing: 0.5px;
-            background: var(--bg-tertiary);
-            border-bottom: 1px solid var(--border-color);
-            white-space: nowrap;
-        }
-        
-        th.sortable {
-            cursor: pointer;
-            user-select: none;
-            transition: color 0.2s;
-        }
-        
-        th.sortable:hover {
-            color: var(--accent-blue);
-        }
-        
-        th.sort-asc, th.sort-desc {
-            color: var(--accent-blue);
-        }
-        
-        td {
-            font-size: 14px;
-            border-bottom: 1px solid var(--border-color);
-        }
-        
-        tr:hover td {
-            background: rgba(59, 130, 246, 0.05);
-        }
-        
-        tr.clickable-row {
-            cursor: pointer;
-        }
-        
-        /* Status Badge */
-        .status-badge {
-            display: inline-flex;
-            align-items: center;
-            padding: 4px 10px;
-            border-radius: 6px;
-            font-size: 12px;
-            font-weight: 600;
-            text-transform: capitalize;
-            border: 1px solid transparent;
-        }
-        
-        .status-badge.success {
-            background: rgba(34, 197, 94, 0.15);
-            color: var(--accent-green);
-            border-color: rgba(34, 197, 94, 0.3);
-        }
-        
-        .status-badge.failed {
-            background: rgba(239, 68, 68, 0.15);
-            color: var(--accent-red);
-            border-color: rgba(239, 68, 68, 0.3);
-        }
-        
-        .status-badge.installing {
-            background: rgba(234, 179, 8, 0.15);
-            color: var(--accent-yellow);
-            border-color: rgba(234, 179, 8, 0.3);
-        }
-        
-        .status-badge.unknown {
-            background: rgba(100, 116, 139, 0.15);
-            color: var(--text-muted);
-            border-color: rgba(100, 116, 139, 0.3);
-        }
-        
-        /* Type Badge */
-        .type-badge {
-            display: inline-flex;
-            align-items: center;
-            padding: 4px 10px;
-            border-radius: 6px;
-            font-size: 11px;
-            font-weight: 700;
-            text-transform: uppercase;
-            letter-spacing: 0.5px;
-        }
-        
-        .type-badge.lxc {
-            background: rgba(34, 211, 238, 0.15);
-            color: var(--accent-cyan);
-            border: 1px solid rgba(34, 211, 238, 0.3);
-        }
-        
-        .type-badge.vm {
-            background: rgba(168, 85, 247, 0.15);
-            color: var(--accent-purple);
-            border: 1px solid rgba(168, 85, 247, 0.3);
-        }
-        
-        .type-badge.tool {
-            background: rgba(249, 115, 22, 0.15);
-            color: var(--accent-orange);
-            border: 1px solid rgba(249, 115, 22, 0.3);
-        }
-        
-        .type-badge.addon {
-            background: rgba(236, 72, 153, 0.15);
-            color: var(--accent-pink);
-            border: 1px solid rgba(236, 72, 153, 0.3);
-        }
-        
-        /* Pagination */
-        .table-footer {
-            display: flex;
-            justify-content: space-between;
-            align-items: center;
-            padding: 16px 24px;
-            background: var(--bg-tertiary);
-            border-top: 1px solid var(--border-color);
-        }
-        
-        .pagination {
-            display: flex;
-            align-items: center;
-            gap: 8px;
-        }
-        
-        .pagination button {
-            padding: 8px 14px;
-            border-radius: 6px;
-            font-size: 13px;
-            border: 1px solid var(--border-color);
-            background: var(--bg-secondary);
-            color: var(--text-primary);
-            cursor: pointer;
-            transition: all 0.2s;
-        }
-        
-        .pagination button:hover:not(:disabled) {
-            border-color: var(--accent-blue);
-            background: var(--bg-primary);
-        }
-        
-        .pagination button:disabled {
-            opacity: 0.5;
-            cursor: not-allowed;
-        }
-        
-        .pagination-info {
-            font-size: 13px;
-            color: var(--text-secondary);
-        }
-        
-        .per-page-select {
-            display: flex;
-            align-items: center;
-            gap: 8px;
-        }
-        
-        .per-page-select label {
-            font-size: 13px;
-            color: var(--text-secondary);
-        }
-        
-        /* Loading & Error States */
-        .loading {
-            display: flex;
-            flex-direction: column;
-            justify-content: center;
-            align-items: center;
-            padding: 60px 20px;
-            color: var(--text-secondary);
-        }
-        
-        .loading-spinner {
-            width: 40px;
-            height: 40px;
-            border: 3px solid var(--border-color);
-            border-top-color: var(--accent-blue);
-            border-radius: 50%;
-            animation: spin 1s linear infinite;
-            margin-bottom: 16px;
-        }
-        
-        @keyframes spin {
-            to { transform: rotate(360deg); }
-        }
-        
-        .error-banner {
-            background: rgba(239, 68, 68, 0.1);
-            border: 1px solid rgba(239, 68, 68, 0.3);
-            color: var(--accent-red);
-            padding: 16px 24px;
-            border-radius: 8px;
-            margin-bottom: 24px;
-            display: flex;
-            align-items: center;
-            gap: 12px;
-        }
-        
-        /* Modal Styles */
-        .modal-overlay {
-            position: fixed;
-            top: 0;
-            left: 0;
-            right: 0;
-            bottom: 0;
-            background: rgba(0, 0, 0, 0.75);
-            display: flex;
-            justify-content: center;
-            align-items: center;
-            z-index: 1000;
-            opacity: 0;
-            visibility: hidden;
-            transition: opacity 0.2s, visibility 0.2s;
-            backdrop-filter: blur(4px);
-        }
-        
-        .modal-overlay.active {
-            opacity: 1;
-            visibility: visible;
-        }
-        
-        .modal-content {
-            background: var(--bg-card);
-            border: 1px solid var(--border-color);
-            border-radius: 16px;
-            width: 90%;
-            max-width: 700px;
-            max-height: 90vh;
-            overflow-y: auto;
-            transform: scale(0.95) translateY(10px);
-            transition: transform 0.2s;
-            box-shadow: var(--shadow-lg);
-        }
-        
-        .modal-overlay.active .modal-content {
-            transform: scale(1) translateY(0);
-        }
-        
-        .modal-header {
-            display: flex;
-            justify-content: space-between;
-            align-items: center;
-            padding: 20px 24px;
-            border-bottom: 1px solid var(--border-color);
-            position: sticky;
-            top: 0;
-            background: var(--bg-card);
-            z-index: 10;
-        }
-        
-        .modal-header h2 {
-            font-size: 18px;
-            font-weight: 600;
-            display: flex;
-            align-items: center;
-            gap: 10px;
-        }
-        
-        .modal-close {
-            width: 36px;
-            height: 36px;
-            display: flex;
-            align-items: center;
-            justify-content: center;
-            border-radius: 8px;
-            background: transparent;
-            border: none;
-            color: var(--text-secondary);
-            font-size: 20px;
-            cursor: pointer;
-            transition: background 0.2s;
-        }
-        
-        .modal-close:hover {
-            background: var(--bg-tertiary);
-            color: var(--text-primary);
-        }
-        
-        .modal-body {
-            padding: 24px;
-        }
-        
-        /* Detail Modal Sections */
-        .detail-section {
-            margin-bottom: 24px;
-        }
-        
-        .detail-section:last-child {
-            margin-bottom: 0;
-        }
-        
-        .detail-section-header {
-            display: flex;
-            align-items: center;
-            gap: 8px;
-            font-size: 12px;
-            font-weight: 600;
-            color: var(--text-secondary);
-            text-transform: uppercase;
-            letter-spacing: 0.5px;
-            margin-bottom: 12px;
-            padding-bottom: 8px;
-            border-bottom: 1px solid var(--border-color);
-        }
-        
-        .detail-grid {
-            display: grid;
-            grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
-            gap: 12px;
-        }
-        
-        .detail-item {
-            background: var(--bg-tertiary);
-            border-radius: 8px;
-            padding: 12px 16px;
-        }
-        
-        .detail-item .label {
-            font-size: 11px;
-            color: var(--text-muted);
-            text-transform: uppercase;
-            letter-spacing: 0.3px;
-            margin-bottom: 4px;
-        }
-        
-        .detail-item .value {
-            font-size: 14px;
-            font-weight: 500;
-            word-break: break-word;
-        }
-        
-        .detail-item .value.mono {
-            font-family: 'SF Mono', 'Consolas', monospace;
-            font-size: 12px;
-        }
-        
-        .detail-item .value.status-success { color: var(--accent-green); }
-        .detail-item .value.status-failed { color: var(--accent-red); }
-        .detail-item .value.status-installing { color: var(--accent-yellow); }
-        
-        .error-box {
-            background: rgba(239, 68, 68, 0.1);
-            border: 1px solid rgba(239, 68, 68, 0.3);
-            border-radius: 8px;
-            padding: 16px;
-            font-family: 'SF Mono', 'Consolas', monospace;
-            font-size: 12px;
-            color: var(--accent-red);
-            white-space: pre-wrap;
-            word-break: break-word;
-            max-height: 200px;
-            overflow-y: auto;
-        }
-        
-        /* Health Modal */
-        .health-modal {
-            max-width: 420px;
-        }
-        
-        .health-status {
-            display: flex;
-            align-items: center;
-            gap: 16px;
-            padding: 20px;
-            border-radius: 12px;
-            margin-bottom: 16px;
-        }
-        
-        .health-status.ok {
-            background: rgba(34, 197, 94, 0.1);
-            border: 1px solid rgba(34, 197, 94, 0.3);
-        }
-        
-        .health-status.error {
-            background: rgba(239, 68, 68, 0.1);
-            border: 1px solid rgba(239, 68, 68, 0.3);
-        }
-        
-        .health-status .icon {
-            font-size: 36px;
-        }
-        
-        .health-status .details .title {
-            font-weight: 600;
-            font-size: 16px;
-        }
-        
-        .health-status .details .subtitle {
-            font-size: 13px;
-            color: var(--text-secondary);
-            margin-top: 4px;
-        }
-        
-        .health-info {
-            background: var(--bg-tertiary);
-            border-radius: 8px;
-            padding: 16px;
-        }
-        
-        .health-info div {
-            display: flex;
-            justify-content: space-between;
-            padding: 8px 0;
-            font-size: 13px;
-            border-bottom: 1px solid var(--border-color);
-        }
-        
-        .health-info div:last-child {
-            border-bottom: none;
-        }
-        
-        /* Secondary Charts Section */
-        .charts-grid {
-            display: grid;
-            grid-template-columns: repeat(3, 1fr);
-            gap: 20px;
-            margin-bottom: 24px;
-        }
-        
-        @media (max-width: 1200px) {
-            .charts-grid {
-                grid-template-columns: repeat(2, 1fr);
-            }
-        }
-        
-        @media (max-width: 768px) {
-            .charts-grid {
-                grid-template-columns: 1fr;
-            }
-        }
-        
-        .chart-card {
-            background: var(--bg-card);
-            border: 1px solid var(--border-color);
-            border-radius: 12px;
-            padding: 20px;
-        }
-        
-        .chart-card h3 {
-            font-size: 14px;
-            font-weight: 600;
-            margin-bottom: 16px;
-            color: var(--text-secondary);
-        }
-        
-        .chart-card .chart-wrapper {
-            height: 200px;
-            font-size: 12px;
-            font-weight: 600;
-        }
-        
-        .failed-apps-grid {
-            display: grid;
-            grid-template-columns: repeat(auto-fill, minmax(200px, 1fr));
-            gap: 12px;
-            margin-top: 12px;
-        }
-        
-        .failed-app-card {
-            background: var(--bg-tertiary);
-            border-radius: 6px;
-            padding: 12px;
-        }
-        
-        .failed-app-card .app-name {
-            font-weight: 600;
-            margin-bottom: 4px;
-        }
-        
-        .failed-app-card .failure-rate {
-            font-size: 20px;
-            font-weight: 600;
-            color: var(--accent-red);
-        }
-        
-        .failed-app-card .details {
-            font-size: 11px;
-            color: var(--text-secondary);
-        }
-        
-        .pagination {
-            display: flex;
-            justify-content: center;
-            align-items: center;
-            gap: 8px;
-            padding: 16px;
-        }
-        
-        .pagination button {
-            padding: 6px 12px;
-        }
-        
-        .pagination span {
-            color: var(--text-secondary);
-            font-size: 14px;
-        }
-        
-        /* Detail Modal Styles */
-        .modal-overlay {
-            position: fixed;
-            top: 0;
-            left: 0;
-            right: 0;
-            bottom: 0;
-            background: rgba(0, 0, 0, 0.7);
-            display: flex;
-            justify-content: center;
-            align-items: center;
-            z-index: 1000;
-            opacity: 0;
-            visibility: hidden;
-            transition: opacity 0.2s, visibility 0.2s;
-        }
-        
-        .modal-overlay.active {
-            opacity: 1;
-            visibility: visible;
-        }
-        
-        .modal-content {
-            background: var(--bg-secondary);
-            border: 1px solid var(--border-color);
-            border-radius: 12px;
-            width: 90%;
-            max-width: 700px;
-            max-height: 90vh;
-            overflow-y: auto;
-            transform: scale(0.9);
-            transition: transform 0.2s;
-        }
-        
-        .modal-overlay.active .modal-content {
-            transform: scale(1);
-        }
-        
-        .modal-header {
-            display: flex;
-            justify-content: space-between;
-            align-items: center;
-            padding: 20px 24px;
-            border-bottom: 1px solid var(--border-color);
-            position: sticky;
-            top: 0;
-            background: var(--bg-secondary);
-            z-index: 10;
-        }
-        
-        .modal-header h2 {
-            font-size: 20px;
-            font-weight: 600;
-            display: flex;
-            align-items: center;
-            gap: 10px;
-        }
-        
-        .modal-close {
-            background: none;
-            border: none;
-            color: var(--text-secondary);
-            font-size: 24px;
-            cursor: pointer;
-            padding: 4px 8px;
-            border-radius: 4px;
-        }
-        
-        .modal-close:hover {
-            background: var(--bg-tertiary);
-            color: var(--text-primary);
-        }
-        
-        .modal-body {
-            padding: 24px;
-        }
-        
-        .detail-section {
-            margin-bottom: 24px;
-        }
-        
-        .detail-section:last-child {
-            margin-bottom: 0;
-        }
-        
-        .detail-section-header {
-            display: flex;
-            align-items: center;
-            gap: 8px;
-            font-size: 12px;
-            font-weight: 600;
-            color: var(--text-secondary);
-            text-transform: uppercase;
-            letter-spacing: 0.5px;
-            margin-bottom: 12px;
-            padding-bottom: 8px;
-            border-bottom: 1px solid var(--border-color);
-        }
-        
-        .detail-section-header svg {
-            opacity: 0.7;
-        }
-        
-        .detail-grid {
-            display: grid;
-            grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
-            gap: 16px;
-        }
-        
-        .detail-item {
-            background: var(--bg-tertiary);
-            border-radius: 8px;
-            padding: 12px 16px;
-        }
-        
-        .detail-item .label {
-            font-size: 11px;
-            color: var(--text-secondary);
-            text-transform: uppercase;
-            letter-spacing: 0.3px;
-            margin-bottom: 4px;
-        }
-        
-        .detail-item .value {
-            font-size: 15px;
-            font-weight: 500;
-            word-break: break-word;
-        }
-        
-        .detail-item .value.mono {
-            font-family: 'SF Mono', 'Consolas', monospace;
-            font-size: 13px;
-        }
-        
-        .detail-item.full-width {
-            grid-column: 1 / -1;
-        }
-        
-        .detail-item .value.status-success { color: var(--accent-green); }
-        .detail-item .value.status-failed { color: var(--accent-red); }
-        .detail-item .value.status-installing { color: var(--accent-yellow); }
-        
-        .error-box {
-            background: rgba(248, 81, 73, 0.1);
-            border: 1px solid rgba(248, 81, 73, 0.3);
-            border-radius: 8px;
-            padding: 16px;
-            font-family: 'SF Mono', 'Consolas', monospace;
-            font-size: 13px;
-            color: var(--accent-red);
-            white-space: pre-wrap;
-            word-break: break-word;
-            max-height: 200px;
-            overflow-y: auto;
-        }
-        
-        tr.clickable-row {
-            cursor: pointer;
-            transition: background 0.15s;
-        }
-        
-        tr.clickable-row:hover {
-            background: rgba(88, 166, 255, 0.1) !important;
-        }
-    </style>
-</head>
-<body>
-    <!-- Navigation Bar -->
-    <nav class="navbar">
-        <a href="https://community-scripts.github.io/ProxmoxVE/" class="navbar-brand" target="_blank">
-            <svg width="28" height="28" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5">
-                <polyline points="4 17 10 11 4 5"/>
-                <line x1="12" y1="19" x2="20" y2="19"/>
-            </svg>
-            Proxmox VE Helper-Scripts
-        </a>
-        
-        <div class="navbar-center">
-            <div style="display: flex; align-items: center; gap: 12px;">
-                <span id="loadingIndicator" style="display: none; color: var(--accent-cyan); font-size: 14px;">
-                    <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" style="animation: spin 1s linear infinite; margin-right: 6px;">
-                        <circle cx="12" cy="12" r="10" stroke-opacity="0.3"/>
-                        <path d="M12 2a10 10 0 0 1 10 10"/>
-                    </svg>
-                    Loading data...
-                </span>
-                <span id="cacheStatus" style="font-size: 12px; color: var(--text-muted);"></span>
-            </div>
-        </div>
-        
-        <div class="navbar-actions">
-            <a href="https://github.com/community-scripts/ProxmoxVE" target="_blank" class="github-stars" id="githubStars">
-                <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-                    <polygon points="12 2 15.09 8.26 22 9.27 17 14.14 18.18 21.02 12 17.77 5.82 21.02 7 14.14 2 9.27 8.91 8.26 12 2"/>
-                </svg>
-                <span id="starCount">-</span>
-            </a>
-            <a href="https://github.com/community-scripts/ProxmoxVE" target="_blank" class="nav-icon" title="GitHub">
-                <svg width="20" height="20" viewBox="0 0 24 24" fill="currentColor">
-                    <path d="M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z"/>
-                </svg>
-            </a>
-            <a href="https://discord.gg/2wvnMDgeFz" target="_blank" class="nav-icon" title="Discord">
-                <svg width="20" height="20" viewBox="0 0 24 24" fill="currentColor">
-                    <path d="M20.317 4.37a19.79 19.79 0 00-4.885-1.515.074.074 0 00-.079.037c-.21.375-.444.865-.608 1.25a18.27 18.27 0 00-5.487 0 12.64 12.64 0 00-.617-1.25.077.077 0 00-.079-.037A19.74 19.74 0 003.677 4.37a.07.07 0 00-.032.028C.533 9.046-.32 13.58.099 18.057a.082.082 0 00.031.057 19.9 19.9 0 005.993 3.03.078.078 0 00.084-.028c.462-.63.873-1.295 1.226-1.994a.076.076 0 00-.041-.106 13.11 13.11 0 01-1.872-.892.077.077 0 01-.008-.128c.126-.094.252-.192.372-.291a.074.074 0 01.078-.01c3.928 1.793 8.18 1.793 12.062 0a.074.074 0 01.078.009c.12.1.246.198.373.292a.077.077 0 01-.006.127 12.3 12.3 0 01-1.873.892.076.076 0 00-.041.107c.36.698.772 1.363 1.225 1.993a.076.076 0 00.084.029 19.84 19.84 0 006.002-3.03.077.077 0 00.032-.054c.5-5.177-.838-9.674-3.549-13.66a.06.06 0 00-.031-.03zM8.02 15.33c-1.183 0-2.157-1.086-2.157-2.419s.955-2.419 2.157-2.419c1.21 0 2.176 1.096 2.157 2.42 0 1.332-.956 2.418-2.157 2.418zm7.975 0c-1.183 0-2.157-1.086-2.157-2.419s.955-2.419 2.157-2.419c1.21 0 2.176 1.096 2.157 2.42 0 1.332-.946 2.418-2.157 2.418z"/>
-                </svg>
-            </a>
-            <button class="theme-toggle" onclick="toggleTheme()" title="Toggle theme">
-                <span id="themeIcon">🌙</span>
-            </button>
-        </div>
-    </nav>
-    
-    <!-- Main Content -->
-    <div class="main-content">
-        <!-- Page Header -->
-        <div class="page-header">
-            <h1>Analytics</h1>
-            <p>Overview of container installations and system statistics.</p>
-        </div>
-        
-        <!-- Filters Bar -->
-        <div class="filters-bar" style="background: var(--bg-card); border: 1px solid var(--border-color); border-radius: 12px; margin-bottom: 24px;">
-            <div class="filter-group">
-                <label>Source:</label>
-                <select id="repoFilter" class="custom-select" onchange="refreshData()">
-                    <option value="ProxmoxVE" selected>ProxmoxVE</option>
-                    <option value="ProxmoxVED">ProxmoxVED</option>
-                    <option value="Proxmox VE">Proxmox VE (Legacy)</option>
-                    <option value="external">External</option>
-                    <option value="all">All Sources</option>
-                </select>
-            </div>
-            <div class="filter-group">
-                <label>Period:</label>
-                <div class="quickfilter">
-                    <button class="filter-btn active" data-days="7">7 Days</button>
-                    <button class="filter-btn" data-days="30">30 Days</button>
-                    <button class="filter-btn" data-days="90">90 Days</button>
-                    <button class="filter-btn" data-days="365">1 Year</button>
-                    <button class="filter-btn" data-days="0">All</button>
-                </div>
-            </div>
-            <div style="margin-left: auto; display: flex; gap: 8px;">
-                <button class="btn" onclick="refreshData()">
-                    <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-                        <path d="M23 4v6h-6"/><path d="M1 20v-6h6"/>
-                        <path d="M3.51 9a9 9 0 0114.85-3.36L23 10M1 14l4.64 4.36A9 9 0 0020.49 15"/>
-                    </svg>
-                    Refresh
-                </button>
-                <span class="last-updated" id="lastUpdated" style="align-self: center; font-size: 12px; color: var(--text-muted);"></span>
-            </div>
-        </div>
-        
-        <!-- Error Banner -->
-        <div id="error" class="error-banner" style="display: none;">
-            <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-                <circle cx="12" cy="12" r="10"/>
-                <line x1="12" y1="8" x2="12" y2="12"/>
-                <line x1="12" y1="16" x2="12.01" y2="16"/>
-            </svg>
-            <span id="errorText"></span>
-        </div>
-        
-        <!-- Stats Cards -->
-        <div class="stats-grid">
-            <div class="stat-card">
-                <div class="stat-card-header">
-                    <span class="stat-card-label">Total Created</span>
-                    <div class="stat-card-icon">
-                        <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-                            <rect x="3" y="3" width="18" height="18" rx="2" ry="2"/>
-                            <line x1="9" y1="9" x2="15" y2="9"/>
-                            <line x1="9" y1="13" x2="15" y2="13"/>
-                            <line x1="9" y1="17" x2="11" y2="17"/>
-                        </svg>
-                    </div>
-                </div>
-                <div class="stat-card-value" id="totalInstalls">-</div>
-                <div class="stat-card-subtitle">Total LXC/VM entries found</div>
-            </div>
-            
-            <div class="stat-card success">
-                <div class="stat-card-header">
-                    <span class="stat-card-label">Success Rate</span>
-                    <div class="stat-card-icon">
-                        <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-                            <path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"/>
-                            <polyline points="22 4 12 14.01 9 11.01"/>
-                        </svg>
-                    </div>
-                </div>
-                <div class="stat-card-value" id="successRate">-</div>
-                <div class="stat-card-subtitle" id="successSubtitle">successful installations</div>
-            </div>
-            
-            <div class="stat-card failed">
-                <div class="stat-card-header">
-                    <span class="stat-card-label">Failures</span>
-                    <div class="stat-card-icon">
-                        <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-                            <circle cx="12" cy="12" r="10"/>
-                            <line x1="15" y1="9" x2="9" y2="15"/>
-                            <line x1="9" y1="9" x2="15" y2="15"/>
-                        </svg>
-                    </div>
-                </div>
-                <div class="stat-card-value" id="failedCount">-</div>
-                <div class="stat-card-subtitle">Installations encountered errors</div>
-            </div>
-            
-            <div class="stat-card popular">
-                <div class="stat-card-header">
-                    <span class="stat-card-label">Most Popular</span>
-                    <div class="stat-card-icon">
-                        <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-                            <path d="M12 2L15.09 8.26 22 9.27 17 14.14 18.18 21.02 12 17.77 5.82 21.02 7 14.14 2 9.27 8.91 8.26 12 2z"/>
-                        </svg>
-                    </div>
-                </div>
-                <div class="stat-card-value" id="mostPopular">-</div>
-                <div class="stat-card-subtitle" id="popularSubtitle">installations</div>
-            </div>
-        </div>
-        
-        <!-- Top Applications Section -->
-        <div class="section-card">
-            <div class="section-header">
-                <div>
-                    <h2>Top Applications</h2>
-                    <p>The most frequently installed applications.</p>
-                </div>
-                <div class="section-actions">
-                    <button class="btn" id="viewAllAppsBtn" onclick="toggleAllApps()">
-                        <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-                            <line x1="8" y1="6" x2="21" y2="6"/>
-                            <line x1="8" y1="12" x2="21" y2="12"/>
-                            <line x1="8" y1="18" x2="21" y2="18"/>
-                            <line x1="3" y1="6" x2="3.01" y2="6"/>
-                            <line x1="3" y1="12" x2="3.01" y2="12"/>
-                            <line x1="3" y1="18" x2="3.01" y2="18"/>
-                        </svg>
-                        View All
-                    </button>
-                </div>
-            </div>
-            <div class="chart-container" id="appsChartContainer">
-                <canvas id="appsChart"></canvas>
-            </div>
-        </div>
-        
-        <!-- Secondary Charts -->
-        <div class="charts-grid">
-            <div class="chart-card">
-                <h3>Installations Over Time</h3>
-                <div class="chart-wrapper">
-                    <canvas id="dailyChart"></canvas>
-                </div>
-            </div>
-            <div class="chart-card">
-                <h3>OS Distribution</h3>
-                <div class="chart-wrapper">
-                    <canvas id="osChart"></canvas>
-                </div>
-            </div>
-            <div class="chart-card">
-                <h3>Status Distribution</h3>
-                <div class="chart-wrapper">
-                    <canvas id="statusChart"></canvas>
-                </div>
-            </div>
-        </div>
-        
-        <!-- Error Analysis Section -->
-        <div class="section-card">
-            <div class="section-header">
-                <div>
-                    <h2>Error Analysis</h2>
-                    <p>Common error patterns and affected applications.</p>
-                </div>
-            </div>
-            <div class="error-list" id="errorList">
-                <div class="loading"><div class="loading-spinner"></div>Loading...</div>
-            </div>
-        </div>
-        
-        <!-- Failed Apps Section -->
-        <div class="section-card">
-            <div class="section-header">
-                <div>
-                    <h2>Apps with Highest Failure Rates</h2>
-                    <p>Applications that need attention.</p>
-                </div>
-            </div>
-            <div class="failed-apps-grid" id="failedAppsGrid">
-                <div class="loading"><div class="loading-spinner"></div>Loading...</div>
-            </div>
-        </div>
-        
-        <!-- Installation Log Section -->
-        <div class="section-card">
-            <div class="section-header">
-                <div>
-                    <h2>Installation Log</h2>
-                    <p>Detailed records of all container creation attempts.</p>
-                </div>
-                <div class="section-actions">
-                    <button class="btn" onclick="exportCSV()">
-                        <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-                            <path d="M21 15v4a2 2 0 01-2 2H5a2 2 0 01-2-2v-4"/>
-                            <polyline points="7 10 12 15 17 10"/>
-                            <line x1="12" y1="15" x2="12" y2="3"/>
-                        </svg>
-                        Export CSV
-                    </button>
-                </div>
-            </div>
-            <div class="filters-bar">
-                <input type="text" class="search-input" id="filterApp" placeholder="Filter by application..." oninput="filterTable()">
-                <select id="filterStatus" class="custom-select" onchange="filterTable()">
-                    <option value="">All Status</option>
-                    <option value="success">Success</option>
-                    <option value="failed">Failed</option>
-                    <option value="installing">Installing</option>
-                    <option value="unknown">Unknown</option>
-                </select>
-                <select id="filterOs" class="custom-select" onchange="filterTable()">
-                    <option value="">All OS</option>
-                </select>
-                <select id="filterType" class="custom-select" onchange="filterTable()">
-                    <option value="">All Types</option>
-                    <option value="lxc">LXC</option>
-                    <option value="vm">VM</option>
-                </select>
-            </div>
-            <div class="table-wrapper">
-                <table id="installTable">
-                    <thead>
-                        <tr>
-                            <th data-sort="status" class="sortable">Status</th>
-                            <th data-sort="type" class="sortable">Type</th>
-                            <th data-sort="nsapp" class="sortable">Application</th>
-                            <th data-sort="os_type" class="sortable">OS</th>
-                            <th>Disk Size</th>
-                            <th>Core Count</th>
-                            <th>RAM Size</th>
-                            <th data-sort="created" class="sortable sort-desc">Created At</th>
-                        </tr>
-                    </thead>
-                    <tbody id="recordsTable">
-                        <tr><td colspan="8"><div class="loading"><div class="loading-spinner"></div>Loading...</div></td></tr>
-                    </tbody>
-                </table>
-            </div>
-            <div class="table-footer">
-                <div class="per-page-select">
-                    <label>Show:</label>
-                    <select id="perPageSelect" class="custom-select" onchange="changePerPage()">
-                        <option value="25" selected>25</option>
-                        <option value="50">50</option>
-                        <option value="100">100</option>
-                    </select>
-                </div>
-                <div class="pagination">
-                    <button onclick="prevPage()" id="prevBtn" disabled>Previous</button>
-                    <span class="pagination-info" id="pageInfo">Page 1</span>
-                    <button onclick="nextPage()" id="nextBtn">Next</button>
-                </div>
-            </div>
-        </div>
-    </div>
-    
-    <!-- Health Check Modal -->
-    <div class="modal-overlay" id="healthModal" onclick="closeHealthModal(event)">
-        <div class="modal-content health-modal" onclick="event.stopPropagation()">
-            <div class="modal-header">
-                <h2>Health Check</h2>
-                <button class="modal-close" onclick="closeHealthModal()">&times;</button>
-            </div>
-            <div class="modal-body" id="healthModalBody">
-                <div class="loading"><div class="loading-spinner"></div>Checking...</div>
-            </div>
-        </div>
-    </div>
-    
-    <!-- Detail Modal -->
-    <div class="modal-overlay" id="detailModal" onclick="closeModalOutside(event)">
-        <div class="modal-content" onclick="event.stopPropagation()">
-            <div class="modal-header">
-                <h2 id="modalTitle">
-                    <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-                        <rect x="3" y="3" width="18" height="18" rx="2" ry="2"/>
-                        <line x1="9" y1="9" x2="15" y2="9"/>
-                        <line x1="9" y1="13" x2="15" y2="13"/>
-                        <line x1="9" y1="17" x2="11" y2="17"/>
-                    </svg>
-                    <span>Record Details</span>
-                </h2>
-                <button class="modal-close" onclick="closeModal()">&times;</button>
-            </div>
-            <div class="modal-body" id="modalBody">
-                <!-- Content filled by JavaScript -->
-            </div>
-        </div>
-    </div>
-    
-    <script>
-        let charts = {};
-        let allRecords = [];
-        let allAppsData = [];
-        let showingAllApps = false;
-        let currentPage = 1;
-        let totalPages = 1;
-        let perPage = 25;
-        let currentTheme = localStorage.getItem('theme') || 'dark';
-        let currentSort = { field: 'created', dir: 'desc' };
-        
-        // Colorful palette for Top Applications chart
-        const appBarColors = [
-            '#3b82f6', '#f97316', '#22c55e', '#a855f7', '#ef4444',
-            '#22d3ee', '#eab308', '#ec4899', '#84cc16', '#6366f1',
-            '#14b8a6', '#f43f5e', '#8b5cf6', '#10b981', '#06b6d4',
-            '#d946ef', '#facc15', '#2dd4bf'
-        ];
-        
-        // Apply saved theme on load
-        if (currentTheme === 'light') {
-            document.documentElement.setAttribute('data-theme', 'light');
-            document.getElementById('themeIcon').textContent = '☀️';
-        }
-        
-        // Fetch GitHub stars
-        async function fetchGitHubStars() {
-            try {
-                const resp = await fetch('https://api.github.com/repos/community-scripts/ProxmoxVE');
-                const data = await resp.json();
-                if (data.stargazers_count) {
-                    document.getElementById('starCount').textContent = data.stargazers_count.toLocaleString();
-                }
-            } catch (e) {
-                console.log('Could not fetch GitHub stars');
-            }
-        }
-        fetchGitHubStars();
-        
-        function toggleTheme() {
-            if (currentTheme === 'dark') {
-                document.documentElement.setAttribute('data-theme', 'light');
-                document.getElementById('themeIcon').textContent = '☀️';
-                currentTheme = 'light';
-            } else {
-                document.documentElement.removeAttribute('data-theme');
-                document.getElementById('themeIcon').textContent = '🌙';
-                currentTheme = 'dark';
-            }
-            localStorage.setItem('theme', currentTheme);
-            if (Object.keys(charts).length > 0) {
-                refreshData();
-            }
-        }
-        
-        function handleGlobalSearch(event) {
-            if (event.key === 'Enter') {
-                const query = event.target.value.trim();
-                if (query) {
-                    document.getElementById('filterApp').value = query;
-                    filterTable();
-                    document.querySelector('.section-card:last-of-type').scrollIntoView({ behavior: 'smooth' });
-                }
-            }
-        }
-        
-        // Keyboard shortcut for search
-        document.addEventListener('keydown', function(e) {
-            if ((e.ctrlKey || e.metaKey) && e.key === 'k') {
-                e.preventDefault();
-                document.getElementById('globalSearch').focus();
-            }
-        });
-        
-        const chartDefaults = {
-            responsive: true,
-            maintainAspectRatio: false,
-            plugins: {
-                legend: {
-                    labels: { color: '#8b949e' }
-                }
-            },
-            scales: {
-                x: {
-                    ticks: { color: '#8b949e' },
-                    grid: { color: '#2d3748' }
-                },
-                y: {
-                    ticks: { color: '#8b949e' },
-                    grid: { color: '#2d3748' }
-                }
-            }
-        };
-        
-        async function fetchData() {
-            const activeBtn = document.querySelector('.filter-btn.active');
-            const days = activeBtn ? activeBtn.dataset.days : '7';
-            const repo = document.getElementById('repoFilter').value;
-            
-            // Show loading indicator
-            document.getElementById('loadingIndicator').style.display = 'flex';
-            document.getElementById('cacheStatus').textContent = '';
-            
-            try {
-                const response = await fetch('/api/dashboard?days=' + days + '&repo=' + repo);
-                if (!response.ok) throw new Error('Failed to fetch data');
-                
-                // Check cache status from header
-                const cacheHit = response.headers.get('X-Cache') === 'HIT';
-                document.getElementById('cacheStatus').textContent = cacheHit ? '(cached)' : '(fresh)';
-                
-                return await response.json();
-            } catch (error) {
-                document.getElementById('error').style.display = 'flex';
-                document.getElementById('errorText').textContent = error.message;
-                throw error;
-            } finally {
-                document.getElementById('loadingIndicator').style.display = 'none';
-            }
-        }
-        
-        function updateStats(data) {
-            // Use total_all_time for display if available, otherwise total_installs
-            const displayTotal = data.total_all_time || data.total_installs;
-            document.getElementById('totalInstalls').textContent = displayTotal.toLocaleString();
-            
-            // Show sample info if data was sampled
-            const sampleInfo = document.getElementById('sampleInfo');
-            if (sampleInfo && data.sample_size && data.sample_size < data.total_all_time) {
-                sampleInfo.textContent = '(based on ' + data.sample_size.toLocaleString() + ' recent records)';
-                sampleInfo.style.display = 'block';
-            } else if (sampleInfo) {
-                sampleInfo.style.display = 'none';
-            }
-            
-            document.getElementById('failedCount').textContent = data.failed_count.toLocaleString();
-            document.getElementById('successRate').textContent = data.success_rate.toFixed(1) + '%';
-            document.getElementById('successSubtitle').textContent = data.success_count.toLocaleString() + ' successful installations';
-            document.getElementById('lastUpdated').textContent = 'Updated ' + new Date().toLocaleTimeString();
-            document.getElementById('error').style.display = 'none';
-            
-            // Most Popular App
-            if (data.top_apps && data.top_apps.length > 0) {
-                const topApp = data.top_apps[0];
-                document.getElementById('mostPopular').textContent = topApp.app;
-                document.getElementById('popularSubtitle').textContent = topApp.count.toLocaleString() + ' installations';
-            }
-            
-            // Store all apps data for View All feature
-            allAppsData = data.top_apps || [];
-            
-            // Error Analysis
-            updateErrorAnalysis(data.error_analysis || []);
-            
-            // Failed Apps
-            updateFailedApps(data.failed_apps || []);
-        }
-        
-        function updateErrorAnalysis(errors) {
-            const container = document.getElementById('errorList');
-            if (!errors || errors.length === 0) {
-                container.innerHTML = '<div style="padding: 20px; color: var(--text-muted); text-align: center;">No errors recorded</div>';
-                return;
-            }
-            
-            container.innerHTML = errors.slice(0, 8).map(e => 
-                '<div class="error-item">' +
-                    '<div>' +
-                        '<div class="pattern">' + escapeHtml(e.pattern) + '</div>' +
-                        '<div class="meta">Affects: ' + escapeHtml(e.apps) + '</div>' +
-                    '</div>' +
-                    '<span class="count-badge">' + e.count + '</span>' +
-                '</div>'
-            ).join('');
-        }
-        
-        function updateFailedApps(apps) {
-            const container = document.getElementById('failedAppsGrid');
-            if (!apps || apps.length === 0) {
-                container.innerHTML = '<div style="padding: 20px; color: var(--text-muted); text-align: center;">No failures recorded</div>';
-                return;
-            }
-            
-            container.innerHTML = apps.slice(0, 8).map(a => 
-                '<div class="failed-app-card">' +
-                    '<div class="app-name">' + escapeHtml(a.app) + '</div>' +
-                    '<div class="failure-rate">' + a.failure_rate.toFixed(1) + '%</div>' +
-                    '<div class="details">' + a.failed_count + ' / ' + a.total_count + ' failed</div>' +
-                '</div>'
-            ).join('');
-        }
-        
-        function escapeHtml(str) {
-            if (!str) return '';
-            return str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
-        }
-        
-        function formatTimestamp(ts) {
-            if (!ts) return '-';
-            const d = new Date(ts);
-            // Format: "Feb 11, 2026, 4:33 PM"
-            return d.toLocaleDateString('en-US', { 
-                month: 'short', 
-                day: 'numeric', 
-                year: 'numeric',
-                hour: 'numeric',
-                minute: '2-digit',
-                hour12: true
-            });
-        }
-        
-        function initSortableHeaders() {
-            document.querySelectorAll('th.sortable').forEach(th => {
-                th.style.cursor = 'pointer';
-                th.addEventListener('click', () => sortByColumn(th.dataset.sort));
-            });
-        }
-        
-        function sortByColumn(field) {
-            if (currentSort.field === field) {
-                currentSort.dir = currentSort.dir === 'asc' ? 'desc' : 'asc';
-            } else {
-                currentSort.field = field;
-                currentSort.dir = 'desc';
-            }
-            
-            document.querySelectorAll('th.sortable').forEach(th => {
-                th.classList.remove('sort-asc', 'sort-desc');
-                th.textContent = th.textContent.replace(/[▲▼]/g, '').trim();
-            });
-            
-            const activeTh = document.querySelector('th[data-sort=\"' + field + '\"]');
-            if (activeTh) {
-                activeTh.classList.add(currentSort.dir === 'asc' ? 'sort-asc' : 'sort-desc');
-                activeTh.textContent += ' ' + (currentSort.dir === 'asc' ? '▲' : '▼');
-            }
-            
-            currentPage = 1;
-            fetchPaginatedRecords();
-        }
-        
-        function toggleAllApps() {
-            showingAllApps = !showingAllApps;
-            const btn = document.getElementById('viewAllAppsBtn');
-            const container = document.getElementById('appsChartContainer');
-            
-            if (showingAllApps) {
-                btn.innerHTML = '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="4 14 10 14 10 20"/><polyline points="20 10 14 10 14 4"/><line x1="14" y1="10" x2="21" y2="3"/><line x1="3" y1="21" x2="10" y2="14"/></svg> Show Less';
-                container.style.height = '600px';
-            } else {
-                btn.innerHTML = '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><line x1="8" y1="6" x2="21" y2="6"/><line x1="8" y1="12" x2="21" y2="12"/><line x1="8" y1="18" x2="21" y2="18"/><line x1="3" y1="6" x2="3.01" y2="6"/><line x1="3" y1="12" x2="3.01" y2="12"/><line x1="3" y1="18" x2="3.01" y2="18"/></svg> View All';
-                container.style.height = '420px';
-            }
-            
-            updateAppsChart(allAppsData);
-        }
-        
-        function updateAppsChart(topApps) {
-            const displayApps = showingAllApps ? topApps.slice(0, 30) : topApps.slice(0, 15);
-            const colors = displayApps.map((_, i) => appBarColors[i % appBarColors.length]);
-            
-            if (charts.apps) charts.apps.destroy();
-            charts.apps = new Chart(document.getElementById('appsChart'), {
-                type: 'bar',
-                data: {
-                    labels: displayApps.map(a => a.app),
-                    datasets: [{
-                        label: 'Installations',
-                        data: displayApps.map(a => a.count),
-                        backgroundColor: colors,
-                        borderRadius: 6,
-                        borderSkipped: false
-                    }]
-                },
-                options: {
-                    responsive: true,
-                    maintainAspectRatio: false,
-                    indexAxis: 'x',
-                    plugins: { 
-                        legend: { display: false },
-                        tooltip: {
-                            backgroundColor: 'rgba(21, 27, 35, 0.95)',
-                            titleColor: '#e2e8f0',
-                            bodyColor: '#e2e8f0',
-                            borderColor: '#2d3748',
-                            borderWidth: 1,
-                            padding: 12,
-                            displayColors: true,
-                            callbacks: {
-                                label: function(ctx) {
-                                    return ctx.parsed.y.toLocaleString() + ' installations';
-                                }
-                            }
-                        }
-                    },
-                    scales: {
-                        x: {
-                            ticks: { 
-                                color: '#8b949e',
-                                maxRotation: 45,
-                                minRotation: 45
-                            },
-                            grid: { display: false }
-                        },
-                        y: {
-                            beginAtZero: true,
-                            ticks: { 
-                                color: '#8b949e',
-                                callback: function(value) { 
-                                    if (value >= 1000) return (value/1000).toFixed(0) + 'k';
-                                    return value;
-                                }
-                            },
-                            grid: { color: '#2d3748' }
-                        }
-                    }
-                }
-            });
-        }
-        
-        function updateCharts(data) {
-            // Daily chart
-            if (charts.daily) charts.daily.destroy();
-            charts.daily = new Chart(document.getElementById('dailyChart'), {
-                type: 'line',
-                data: {
-                    labels: data.daily_stats.map(d => d.date.slice(5)),
-                    datasets: [
-                        {
-                            label: 'Success',
-                            data: data.daily_stats.map(d => d.success),
-                            borderColor: '#22c55e',
-                            backgroundColor: 'rgba(34, 197, 94, 0.1)',
-                            fill: true,
-                            tension: 0.4,
-                            borderWidth: 2
-                        },
-                        {
-                            label: 'Failed',
-                            data: data.daily_stats.map(d => d.failed),
-                            borderColor: '#ef4444',
-                            backgroundColor: 'rgba(239, 68, 68, 0.1)',
-                            fill: true,
-                            tension: 0.4,
-                            borderWidth: 2
-                        }
-                    ]
-                },
-                options: {
-                    ...chartDefaults,
-                    plugins: { legend: { display: true, position: 'top', labels: { color: '#8b949e', usePointStyle: true } } }
-                }
-            });
-            
-            // OS distribution pie chart
-            if (charts.os) charts.os.destroy();
-            charts.os = new Chart(document.getElementById('osChart'), {
-                type: 'doughnut',
-                data: {
-                    labels: data.os_distribution.map(o => o.os),
-                    datasets: [{
-                        data: data.os_distribution.map(o => o.count),
-                        backgroundColor: appBarColors.slice(0, data.os_distribution.length),
-                        borderWidth: 0
-                    }]
-                },
-                options: {
-                    responsive: true,
-                    maintainAspectRatio: false,
-                    plugins: {
-                        legend: { position: 'right', labels: { color: '#8b949e', padding: 12 } }
-                    }
-                }
-            });
-            
-            // Status pie chart
-            if (charts.status) charts.status.destroy();
-            charts.status = new Chart(document.getElementById('statusChart'), {
-                type: 'doughnut',
-                data: {
-                    labels: ['Success', 'Failed', 'Installing'],
-                    datasets: [{
-                        data: [data.success_count, data.failed_count, data.installing_count],
-                        backgroundColor: ['#22c55e', '#ef4444', '#eab308'],
-                        borderWidth: 0
-                    }]
-                },
-                options: {
-                    responsive: true,
-                    maintainAspectRatio: false,
-                    plugins: {
-                        legend: { position: 'right', labels: { color: '#8b949e', padding: 12 } }
-                    }
-                }
-            });
-            
-            // Top apps chart
-            updateAppsChart(data.top_apps || []);
-        }
-        
-        function updateTable(records) {
-            allRecords = records || [];
-            
-            // Populate OS filter
-            const osFilter = document.getElementById('filterOs');
-            const uniqueOs = [...new Set(allRecords.map(r => r.os_type).filter(Boolean))];
-            osFilter.innerHTML = '<option value="">All OS</option>' + 
-                uniqueOs.map(os => '<option value="' + os + '">' + os + '</option>').join('');
-            
-            filterTable();
-        }
-        
-        function changePerPage() {
-            perPage = parseInt(document.getElementById('perPageSelect').value);
-            currentPage = 1;
-            fetchPaginatedRecords();
-        }
-        
-        async function fetchPaginatedRecords() {
-            const status = document.getElementById('filterStatus').value;
-            const app = document.getElementById('filterApp').value;
-            const os = document.getElementById('filterOs').value;
-            const type = document.getElementById('filterType').value;
-            
-            try {
-                let url = '/api/records?page=' + currentPage + '&limit=' + perPage;
-                if (status) url += '&status=' + encodeURIComponent(status);
-                if (app) url += '&app=' + encodeURIComponent(app);
-                if (os) url += '&os=' + encodeURIComponent(os);
-                if (type) url += '&type=' + encodeURIComponent(type);
-                if (currentSort.field) {
-                    url += '&sort=' + (currentSort.dir === 'desc' ? '-' : '') + currentSort.field;
-                }
-                
-                const response = await fetch(url);
-                if (!response.ok) throw new Error('Failed to fetch records');
-                const data = await response.json();
-                
-                totalPages = data.total_pages || 1;
-                document.getElementById('pageInfo').textContent = 'Page ' + currentPage + ' of ' + totalPages + ' (' + data.total + ' total)';
-                document.getElementById('prevBtn').disabled = currentPage <= 1;
-                document.getElementById('nextBtn').disabled = currentPage >= totalPages;
-                
-                renderTableRows(data.records || []);
-            } catch (e) {
-                console.error('Pagination error:', e);
-            }
-        }
-        
-        function prevPage() {
-            if (currentPage > 1) {
-                currentPage--;
-                fetchPaginatedRecords();
-            }
-        }
-        
-        function nextPage() {
-            if (currentPage < totalPages) {
-                currentPage++;
-                fetchPaginatedRecords();
-            }
-        }
-        
-        // Store current records for detail view
-        let currentRecords = [];
-        
-        function renderTableRows(records) {
-            const tbody = document.getElementById('recordsTable');
-            currentRecords = records;
-            
-            if (records.length === 0) {
-                tbody.innerHTML = '<tr><td colspan="8"><div class="loading" style="padding: 40px;">No records found</div></td></tr>';
-                return;
-            }
-            
-            tbody.innerHTML = records.map((r, index) => {
-                const statusClass = r.status || 'unknown';
-                const typeClass = (r.type || '').toLowerCase();
-                const diskSize = r.disk_size ? r.disk_size + 'GB' : '-';
-                const coreCount = r.core_count || '-';
-                const ramSize = r.ram_size ? r.ram_size + 'MB' : '-';
-                const created = r.created ? formatTimestamp(r.created) : '-';
-                const osDisplay = r.os_type ? (r.os_type + (r.os_version ? ' ' + r.os_version : '')) : '-';
-                
-                return '<tr class="clickable-row" onclick="showRecordDetail(' + index + ')">' +
-                    '<td><span class="status-badge ' + statusClass + '">' + escapeHtml(r.status || 'unknown') + '</span></td>' +
-                    '<td><span class="type-badge ' + typeClass + '">' + escapeHtml((r.type || '-').toUpperCase()) + '</span></td>' +
-                    '<td><strong>' + escapeHtml(r.nsapp || '-') + '</strong></td>' +
-                    '<td>' + escapeHtml(osDisplay) + '</td>' +
-                    '<td>' + diskSize + '</td>' +
-                    '<td style="text-align: center;">' + coreCount + '</td>' +
-                    '<td>' + ramSize + '</td>' +
-                    '<td>' + created + '</td>' +
-                '</tr>';
-            }).join('');
-        }
-        
-        function showRecordDetail(index) {
-            const record = currentRecords[index];
-            if (!record) return;
-            
-            const modal = document.getElementById('detailModal');
-            const modalTitle = document.getElementById('modalTitle').querySelector('span');
-            const modalBody = document.getElementById('modalBody');
-            
-            modalTitle.textContent = record.nsapp || 'Record Details';
-            
-            // Build detail content with sections
-            let html = '';
-            
-            // General Information Section
-            html += '<div class="detail-section">';
-            html += '<div class="detail-section-header"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><line x1="12" y1="16" x2="12" y2="12"/><line x1="12" y1="8" x2="12.01" y2="8"/></svg> General Information</div>';
-            html += '<div class="detail-grid">';
-            html += buildDetailItem('App Name', record.nsapp);
-            html += buildDetailItem('Status', record.status, 'status-' + (record.status || 'unknown'));
-            html += buildDetailItem('Type', formatType(record.type));
-            html += buildDetailItem('Method', record.method || 'default');
-            html += buildDetailItem('Random ID', record.random_id, 'mono');
-            html += '</div></div>';
-            
-            // System Resources Section
-            html += '<div class="detail-section">';
-            html += '<div class="detail-section-header"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="4" y="4" width="16" height="16" rx="2" ry="2"/><rect x="9" y="9" width="6" height="6"/><line x1="9" y1="1" x2="9" y2="4"/><line x1="15" y1="1" x2="15" y2="4"/><line x1="9" y1="20" x2="9" y2="23"/><line x1="15" y1="20" x2="15" y2="23"/><line x1="20" y1="9" x2="23" y2="9"/><line x1="20" y1="14" x2="23" y2="14"/><line x1="1" y1="9" x2="4" y2="9"/><line x1="1" y1="14" x2="4" y2="14"/></svg> System Resources</div>';
-            html += '<div class="detail-grid">';
-            html += buildDetailItem('CPU Cores', record.core_count ? record.core_count + ' Cores' : null);
-            html += buildDetailItem('RAM', record.ram_size ? formatBytes(record.ram_size * 1024 * 1024) : null);
-            html += buildDetailItem('Disk Size', record.disk_size ? record.disk_size + ' GB' : null);
-            html += buildDetailItem('CT Type', record.ct_type !== undefined ? (record.ct_type === 1 ? 'Unprivileged' : 'Privileged') : null);
-            html += '</div></div>';
-            
-            // Operating System Section
-            html += '<div class="detail-section">';
-            html += '<div class="detail-section-header"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="2" y="3" width="20" height="14" rx="2" ry="2"/><line x1="8" y1="21" x2="16" y2="21"/><line x1="12" y1="17" x2="12" y2="21"/></svg> Operating System</div>';
-            html += '<div class="detail-grid">';
-            html += buildDetailItem('OS Type', record.os_type);
-            html += buildDetailItem('OS Version', record.os_version);
-            html += buildDetailItem('PVE Version', record.pve_version);
-            html += '</div></div>';
-            
-            // Hardware Section (CPU & GPU)
-            const hasHardwareInfo = record.cpu_vendor || record.cpu_model || record.gpu_vendor || record.gpu_model || record.ram_speed;
-            if (hasHardwareInfo) {
-                html += '<div class="detail-section">';
-                html += '<div class="detail-section-header"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M22 12h-4l-3 9L9 3l-3 9H2"/></svg> Hardware</div>';
-                html += '<div class="detail-grid">';
-                html += buildDetailItem('CPU Vendor', record.cpu_vendor);
-                html += buildDetailItem('CPU Model', record.cpu_model);
-                html += buildDetailItem('RAM Speed', record.ram_speed);
-                html += buildDetailItem('GPU Vendor', record.gpu_vendor);
-                html += buildDetailItem('GPU Model', record.gpu_model);
-                html += buildDetailItem('GPU Passthrough', formatPassthrough(record.gpu_passthrough));
-                html += '</div></div>';
-            }
-            
-            // Installation Details Section
-            html += '<div class="detail-section">';
-            html += '<div class="detail-section-header"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg> Installation</div>';
-            html += '<div class="detail-grid">';
-            html += buildDetailItem('Exit Code', record.exit_code !== undefined ? record.exit_code : null, record.exit_code === 0 ? 'status-success' : (record.exit_code ? 'status-failed' : ''));
-            html += buildDetailItem('Duration', record.install_duration ? formatDuration(record.install_duration) : null);
-            html += buildDetailItem('Error Category', record.error_category);
-            html += '</div></div>';
-            
-            // Error Section (if present)
-            if (record.error) {
-                html += '<div class="detail-section">';
-                html += '<div class="detail-section-header"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><line x1="15" y1="9" x2="9" y2="15"/><line x1="9" y1="9" x2="15" y2="15"/></svg> Error Details</div>';
-                html += '<div class="error-box">' + escapeHtml(record.error) + '</div>';
-                html += '</div>';
-            }
-            
-            // Timestamps Section
-            html += '<div class="detail-section">';
-            html += '<div class="detail-section-header"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><polyline points="12 6 12 12 16 14"/></svg> Timestamps</div>';
-            html += '<div class="detail-grid">';
-            html += buildDetailItem('Created', formatFullTimestamp(record.created));
-            html += buildDetailItem('Updated', formatFullTimestamp(record.updated));
-            html += '</div></div>';
-            
-            modalBody.innerHTML = html;
-            modal.classList.add('active');
-            document.body.style.overflow = 'hidden';
-        }
-        
-        function buildDetailItem(label, value, extraClass) {
-            if (value === null || value === undefined || value === '') {
-                return '<div class="detail-item"><div class="label">' + escapeHtml(label) + '</div><div class="value" style="color: var(--text-secondary);">—</div></div>';
-            }
-            const valueClass = extraClass ? 'value ' + extraClass : 'value';
-            return '<div class="detail-item"><div class="label">' + escapeHtml(label) + '</div><div class="' + valueClass + '">' + escapeHtml(String(value)) + '</div></div>';
-        }
-        
-        function formatType(type) {
-            if (!type) return null;
-            const types = {
-                'lxc': 'LXC Container',
-                'vm': 'Virtual Machine',
-                'addon': 'Add-on',
-                'pve': 'Proxmox VE',
-                'tool': 'Tool'
-            };
-            return types[type.toLowerCase()] || type;
-        }
-        
-        function formatPassthrough(pt) {
-            if (!pt) return null;
-            const modes = {
-                'igpu': 'Integrated GPU',
-                'dgpu': 'Dedicated GPU',
-                'vgpu': 'Virtual GPU',
-                'none': 'None',
-                'unknown': 'Unknown'
-            };
-            return modes[pt.toLowerCase()] || pt;
-        }
-        
-        function formatBytes(bytes) {
-            if (!bytes) return null;
-            const gb = bytes / (1024 * 1024 * 1024);
-            if (gb >= 1) return gb.toFixed(1) + ' GB';
-            const mb = bytes / (1024 * 1024);
-            return mb.toFixed(0) + ' MB';
-        }
-        
-        function formatDuration(seconds) {
-            if (!seconds) return null;
-            if (seconds < 60) return seconds + 's';
-            const mins = Math.floor(seconds / 60);
-            const secs = seconds % 60;
-            if (mins < 60) return mins + 'm ' + secs + 's';
-            const hours = Math.floor(mins / 60);
-            const remainMins = mins % 60;
-            return hours + 'h ' + remainMins + 'm';
-        }
-        
-        function formatFullTimestamp(ts) {
-            if (!ts) return null;
-            const d = new Date(ts);
-            return d.toLocaleDateString() + ' ' + d.toLocaleTimeString();
-        }
-        
-        function closeModal() {
-            const modal = document.getElementById('detailModal');
-            modal.classList.remove('active');
-            document.body.style.overflow = '';
-        }
-        
-        function closeModalOutside(event) {
-            if (event.target === document.getElementById('detailModal')) {
-                closeModal();
-            }
-        }
-        
-        // Close modal with Escape key
-        document.addEventListener('keydown', function(e) {
-            if (e.key === 'Escape') {
-                closeModal();
-                closeHealthModal();
-            }
-        });
-        
-        function filterTable() {
-            currentPage = 1;
-            fetchPaginatedRecords();
-        }
-        
-        function exportCSV() {
-            if (allRecords.length === 0) {
-                alert('No data to export');
-                return;
-            }
-            
-            const headers = ['App', 'Status', 'OS Type', 'OS Version', 'Type', 'Method', 'Cores', 'RAM (MB)', 'Disk (GB)', 'Exit Code', 'Error', 'PVE Version'];
-            const rows = allRecords.map(r => [
-                r.nsapp || '',
-                r.status || '',
-                r.os_type || '',
-                r.os_version || '',
-                r.type || '',
-                r.method || '',
-                r.core_count || '',
-                r.ram_size || '',
-                r.disk_size || '',
-                r.exit_code || '',
-                (r.error || '').replace(/,/g, ';'),
-                r.pve_version || ''
-            ]);
-            
-            const csv = [headers.join(','), ...rows.map(r => r.join(','))].join('\\n');
-            const blob = new Blob([csv], { type: 'text/csv' });
-            const url = URL.createObjectURL(blob);
-            const a = document.createElement('a');
-            a.href = url;
-            a.download = 'telemetry_' + new Date().toISOString().slice(0,10) + '.csv';
-            a.click();
-            URL.revokeObjectURL(url);
-        }
-        
-        async function showHealthCheck() {
-            const modal = document.getElementById('healthModal');
-            const body = document.getElementById('healthModalBody');
-            body.innerHTML = '<div class="loading">Checking...</div>';
-            modal.classList.add('active');
-            document.body.style.overflow = 'hidden';
-            
-            try {
-                const resp = await fetch('/healthz');
-                const data = await resp.json();
-                
-                const isOk = data.status === 'ok';
-                const statusClass = isOk ? 'ok' : 'error';
-                const icon = isOk ? '✅' : '❌';
-                const title = isOk ? 'All Systems Operational' : 'Service Degraded';
-                
-                let html = '<div class="health-status ' + statusClass + '">';
-                html += '<span class="icon">' + icon + '</span>';
-                html += '<div class="details">';
-                html += '<div class="title">' + title + '</div>';
-                html += '<div class="subtitle">Last checked: ' + new Date().toLocaleTimeString() + '</div>';
-                html += '</div></div>';
-                
-                html += '<div class="health-info">';
-                html += '<div><span>Status</span><span>' + data.status + '</span></div>';
-                html += '<div><span>Server Time</span><span>' + new Date(data.time).toLocaleString() + '</span></div>';
-                if (data.pocketbase) {
-                    html += '<div><span>PocketBase</span><span>' + (data.pocketbase === 'connected' ? '🟢 Connected' : '🔴 ' + data.pocketbase) + '</span></div>';
-                }
-                if (data.version) {
-                    html += '<div><span>Version</span><span>' + data.version + '</span></div>';
-                }
-                html += '</div>';
-                
-                body.innerHTML = html;
-            } catch (e) {
-                body.innerHTML = '<div class="health-status error"><span class="icon">❌</span><div class="details"><div class="title">Connection Failed</div><div class="subtitle">' + e.message + '</div></div></div>';
-            }
-        }
-        
-        function closeHealthModal(event) {
-            if (event && event.target !== document.getElementById('healthModal')) return;
-            document.getElementById('healthModal').classList.remove('active');
-            document.body.style.overflow = '';
-        }
-        
-        async function refreshData() {
-            try {
-                const data = await fetchData();
-                updateStats(data);
-                updateCharts(data);
-                updateTable(data.recent_records);
-            } catch (e) {
-                console.error(e);
-            }
-        }
-        
-        // Initial load
-        refreshData();
-        initSortableHeaders();
-        
-        // Quickfilter button clicks
-        document.querySelectorAll('.filter-btn').forEach(btn => {
-            btn.addEventListener('click', function() {
-                document.querySelectorAll('.filter-btn').forEach(b => b.classList.remove('active'));
-                this.classList.add('active');
-                refreshData();
-            });
-        });
-        
-        // Auto-refresh every 60 seconds
-        setInterval(refreshData, 60000);
-    </script>
-</body>
-</html>`
-}
\ No newline at end of file
diff --git a/misc/data/entrypoint.sh b/misc/data/entrypoint.sh
deleted file mode 100644
index 67c09b28..00000000
--- a/misc/data/entrypoint.sh
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/bin/sh
-set -e
-
-echo "============================================="
-echo "   ProxmoxVED Telemetry Service"
-echo "============================================="
-
-# Map Coolify ENV names to migration script names
-# Coolify uses PB_URL, PB_TARGET_COLLECTION
-export POCKETBASE_URL="${POCKETBASE_URL:-$PB_URL}"
-export POCKETBASE_COLLECTION="${POCKETBASE_COLLECTION:-$PB_TARGET_COLLECTION}"
-
-# Run migration if enabled
-if [ "$RUN_MIGRATION" = "true" ]; then
-    echo ""
-    echo "🔄 Migration mode enabled"
-    echo "   Source: $MIGRATION_SOURCE_URL"
-    echo "   Target: $POCKETBASE_URL"
-    echo "   Collection: $POCKETBASE_COLLECTION"
-    echo ""
-    
-    # Wait for PocketBase to be ready
-    echo "⏳ Waiting for PocketBase to be ready..."
-    RETRIES=30
-    until wget -q --spider "$POCKETBASE_URL/api/health" 2>/dev/null; do
-        RETRIES=$((RETRIES - 1))
-        if [ $RETRIES -le 0 ]; then
-            echo "❌ PocketBase not reachable after 30 attempts"
-            if [ "$MIGRATION_REQUIRED" = "true" ]; then
-                exit 1
-            fi
-            echo "⚠️  Continuing without migration..."
-            break
-        fi
-        echo "   Waiting... ($RETRIES attempts left)"
-        sleep 2
-    done
-    
-    if wget -q --spider "$POCKETBASE_URL/api/health" 2>/dev/null; then
-        echo "✅ PocketBase is ready"
-        echo ""
-        echo "🚀 Starting migration..."
-        /app/migrate || {
-            if [ "$MIGRATION_REQUIRED" = "true" ]; then
-                echo "❌ Migration failed!"
-                exit 1
-            fi
-            echo "⚠️  Migration failed, but continuing..."
-        }
-        echo ""
-    fi
-fi
-
-echo "🚀 Starting telemetry service..."
-exec /app/telemetry-service
diff --git a/misc/data/go.mod b/misc/data/go.mod
deleted file mode 100644
index e97c3bf8..00000000
--- a/misc/data/go.mod
+++ /dev/null
@@ -1,10 +0,0 @@
-module github.com/community-scripts/telemetry-service
-
-go 1.25.5
-
-require github.com/redis/go-redis/v9 v9.17.3
-
-require (
-	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
-)
diff --git a/misc/data/go.sum b/misc/data/go.sum
deleted file mode 100644
index d0bd1abd..00000000
--- a/misc/data/go.sum
+++ /dev/null
@@ -1,10 +0,0 @@
-github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
-github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
-github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
-github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
-github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
-github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
-github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
-github.com/redis/go-redis/v9 v9.17.3 h1:fN29NdNrE17KttK5Ndf20buqfDZwGNgoUr9qjl1DQx4=
-github.com/redis/go-redis/v9 v9.17.3/go.mod h1:u410H11HMLoB+TP67dz8rL9s6QW2j76l0//kSOd3370=
diff --git a/misc/data/migrate.go b/misc/data/migrate.go
deleted file mode 100644
index e9b16101..00000000
--- a/misc/data/migrate.go
+++ /dev/null
@@ -1,366 +0,0 @@
-// +build ignore
-
-// Migration script to import data from the old API to PocketBase
-// Run with: go run migrate.go
-package main
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"time"
-)
-
-const (
-	defaultSourceAPI = "https://api.htl-braunau.at/dev/data"
-	defaultPBURL     = "http://localhost:8090"
-	batchSize        = 100
-)
-
-var (
-	sourceAPI  string
-	summaryAPI string
-	authToken  string // PocketBase auth token
-)
-
-// OldDataModel represents the data structure from the old API
-type OldDataModel struct {
-	ID         string `json:"id"`
-	CtType     int    `json:"ct_type"`
-	DiskSize   int    `json:"disk_size"`
-	CoreCount  int    `json:"core_count"`
-	RamSize    int    `json:"ram_size"`
-	OsType     string `json:"os_type"`
-	OsVersion  string `json:"os_version"`
-	DisableIP6 string `json:"disableip6"`
-	NsApp      string `json:"nsapp"`
-	Method     string `json:"method"`
-	CreatedAt  string `json:"created_at"`
-	PveVersion string `json:"pve_version"`
-	Status     string `json:"status"`
-	RandomID   string `json:"random_id"`
-	Type       string `json:"type"`
-	Error      string `json:"error"`
-}
-
-// PBRecord represents the PocketBase record format
-type PBRecord struct {
-	CtType     int    `json:"ct_type"`
-	DiskSize   int    `json:"disk_size"`
-	CoreCount  int    `json:"core_count"`
-	RamSize    int    `json:"ram_size"`
-	OsType     string `json:"os_type"`
-	OsVersion  string `json:"os_version"`
-	DisableIP6 string `json:"disableip6"`
-	NsApp      string `json:"nsapp"`
-	Method     string `json:"method"`
-	PveVersion string `json:"pve_version"`
-	Status     string `json:"status"`
-	RandomID   string `json:"random_id"`
-	Type       string `json:"type"`
-	Error      string `json:"error"`
-	// created_at will be set automatically by PocketBase
-}
-
-type Summary struct {
-	TotalEntries int `json:"total_entries"`
-}
-
-func main() {
-	// Setup source URLs
-	baseURL := os.Getenv("MIGRATION_SOURCE_URL")
-	if baseURL == "" {
-		baseURL = defaultSourceAPI
-	}
-	sourceAPI = baseURL + "/paginated"
-	summaryAPI = baseURL + "/summary"
-
-	// Support both POCKETBASE_URL and PB_URL (Coolify uses PB_URL)
-	pbURL := os.Getenv("POCKETBASE_URL")
-	if pbURL == "" {
-		pbURL = os.Getenv("PB_URL")
-	}
-	if pbURL == "" {
-		pbURL = defaultPBURL
-	}
-
-	// Support both POCKETBASE_COLLECTION and PB_TARGET_COLLECTION
-	pbCollection := os.Getenv("POCKETBASE_COLLECTION")
-	if pbCollection == "" {
-		pbCollection = os.Getenv("PB_TARGET_COLLECTION")
-	}
-	if pbCollection == "" {
-		pbCollection = "telemetry"
-	}
-
-	// Auth collection
-	authCollection := os.Getenv("PB_AUTH_COLLECTION")
-	if authCollection == "" {
-		authCollection = "telemetry_service_user"
-	}
-
-	// Credentials
-	pbIdentity := os.Getenv("PB_IDENTITY")
-	pbPassword := os.Getenv("PB_PASSWORD")
-
-	fmt.Println("===========================================")
-	fmt.Println("   Data Migration to PocketBase")
-	fmt.Println("===========================================")
-	fmt.Printf("Source API:       %s\n", baseURL)
-	fmt.Printf("PocketBase URL:   %s\n", pbURL)
-	fmt.Printf("Collection:       %s\n", pbCollection)
-	fmt.Printf("Auth Collection:  %s\n", authCollection)
-	fmt.Println("-------------------------------------------")
-
-	// Authenticate with PocketBase
-	if pbIdentity != "" && pbPassword != "" {
-		fmt.Println("🔐 Authenticating with PocketBase...")
-		err := authenticate(pbURL, authCollection, pbIdentity, pbPassword)
-		if err != nil {
-			fmt.Printf("❌ Authentication failed: %v\n", err)
-			os.Exit(1)
-		}
-		fmt.Println("✅ Authentication successful")
-	} else {
-		fmt.Println("⚠️  No credentials provided, trying without auth...")
-	}
-	fmt.Println("-------------------------------------------")
-
-	// Get total count
-	summary, err := getSummary()
-	if err != nil {
-		fmt.Printf("❌ Failed to get summary: %v\n", err)
-		os.Exit(1)
-	}
-	fmt.Printf("📊 Total entries to migrate: %d\n", summary.TotalEntries)
-	fmt.Println("-------------------------------------------")
-
-	// Calculate pages
-	totalPages := (summary.TotalEntries + batchSize - 1) / batchSize
-
-	var totalMigrated, totalFailed, totalSkipped int
-
-	for page := 1; page <= totalPages; page++ {
-		fmt.Printf("📦 Fetching page %d/%d (items %d-%d)...\n",
-			page, totalPages,
-			(page-1)*batchSize+1,
-			min(page*batchSize, summary.TotalEntries))
-
-		data, err := fetchPage(page, batchSize)
-		if err != nil {
-			fmt.Printf("   ❌ Failed to fetch page %d: %v\n", page, err)
-			totalFailed += batchSize
-			continue
-		}
-
-		for i, record := range data {
-			err := importRecord(pbURL, pbCollection, record)
-			if err != nil {
-				if isUniqueViolation(err) {
-					totalSkipped++
-					continue
-				}
-				fmt.Printf("   ❌ Failed to import record %d: %v\n", (page-1)*batchSize+i+1, err)
-				totalFailed++
-				continue
-			}
-			totalMigrated++
-		}
-
-		fmt.Printf("   ✅ Page %d complete (migrated: %d, skipped: %d, failed: %d)\n",
-			page, len(data), totalSkipped, totalFailed)
-
-		// Small delay to avoid overwhelming the server
-		time.Sleep(100 * time.Millisecond)
-	}
-
-	fmt.Println("===========================================")
-	fmt.Println("   Migration Complete")
-	fmt.Println("===========================================")
-	fmt.Printf("✅ Successfully migrated: %d\n", totalMigrated)
-	fmt.Printf("⏭️  Skipped (duplicates):  %d\n", totalSkipped)
-	fmt.Printf("❌ Failed:                 %d\n", totalFailed)
-	fmt.Println("===========================================")
-}
-
-func getSummary() (*Summary, error) {
-	resp, err := http.Get(summaryAPI)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	var summary Summary
-	if err := json.NewDecoder(resp.Body).Decode(&summary); err != nil {
-		return nil, err
-	}
-
-	return &summary, nil
-}
-
-func authenticate(pbURL, authCollection, identity, password string) error {
-	body := map[string]string{
-		"identity": identity,
-		"password": password,
-	}
-	jsonData, _ := json.Marshal(body)
-
-	url := fmt.Sprintf("%s/api/collections/%s/auth-with-password", pbURL, authCollection)
-	req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/json")
-
-	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		body, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
-	}
-
-	var result struct {
-		Token string `json:"token"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return err
-	}
-	if result.Token == "" {
-		return fmt.Errorf("no token in response")
-	}
-
-	authToken = result.Token
-	return nil
-}
-
-func fetchPage(page, limit int) ([]OldDataModel, error) {
-	url := fmt.Sprintf("%s?page=%d&limit=%d", sourceAPI, page, limit)
-
-	resp, err := http.Get(url)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		return nil, fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
-	}
-
-	var data []OldDataModel
-	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
-		return nil, err
-	}
-
-	return data, nil
-}
-
-func importRecord(pbURL, collection string, old OldDataModel) error {
-	// Map status: "done" -> "success"
-	status := old.Status
-	switch status {
-	case "done":
-		status = "success"
-	case "installing", "failed", "unknown", "success":
-		// keep as-is
-	default:
-		status = "unknown"
-	}
-
-	// Ensure ct_type is not 0 (required field)
-	ctType := old.CtType
-	if ctType == 0 {
-		ctType = 1 // default to unprivileged
-	}
-
-	// Ensure type is set
-	recordType := old.Type
-	if recordType == "" {
-		recordType = "lxc"
-	}
-
-	record := PBRecord{
-		CtType:     ctType,
-		DiskSize:   old.DiskSize,
-		CoreCount:  old.CoreCount,
-		RamSize:    old.RamSize,
-		OsType:     old.OsType,
-		OsVersion:  old.OsVersion,
-		DisableIP6: old.DisableIP6,
-		NsApp:      old.NsApp,
-		Method:     old.Method,
-		PveVersion: old.PveVersion,
-		Status:     status,
-		RandomID:   old.RandomID,
-		Type:       recordType,
-		Error:      old.Error,
-	}
-
-	jsonData, err := json.Marshal(record)
-	if err != nil {
-		return err
-	}
-
-	url := fmt.Sprintf("%s/api/collections/%s/records", pbURL, collection)
-	req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/json")
-	if authToken != "" {
-		req.Header.Set("Authorization", "Bearer "+authToken)
-	}
-
-	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
-		body, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
-	}
-
-	return nil
-}
-
-func isUniqueViolation(err error) bool {
-	if err == nil {
-		return false
-	}
-	errStr := err.Error()
-	return contains(errStr, "UNIQUE constraint failed") ||
-		contains(errStr, "duplicate") ||
-		contains(errStr, "already exists") ||
-		contains(errStr, "validation_not_unique")
-}
-
-func contains(s, substr string) bool {
-	return len(s) >= len(substr) && (s == substr || len(s) > 0 && containsHelper(s, substr))
-}
-
-func containsHelper(s, substr string) bool {
-	for i := 0; i <= len(s)-len(substr); i++ {
-		if s[i:i+len(substr)] == substr {
-			return true
-		}
-	}
-	return false
-}
-
-func min(a, b int) int {
-	if a < b {
-		return a
-	}
-	return b
-}
diff --git a/misc/data/migrate.sh b/misc/data/migrate.sh
deleted file mode 100755
index 09d086cc..00000000
--- a/misc/data/migrate.sh
+++ /dev/null
@@ -1,67 +0,0 @@
-#!/bin/bash
-# Migration script to import data from the old API to PocketBase
-# Usage: ./migrate.sh [POCKETBASE_URL] [COLLECTION_NAME]
-#
-# Examples:
-#   ./migrate.sh                                    # Uses defaults
-#   ./migrate.sh http://localhost:8090              # Custom PB URL
-#   ./migrate.sh http://localhost:8090 my_telemetry # Custom URL and collection
-
-set -e
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
-# Default values
-POCKETBASE_URL="${1:-http://localhost:8090}"
-POCKETBASE_COLLECTION="${2:-telemetry}"
-
-echo "============================================="
-echo "   ProxmoxVED Data Migration Tool"
-echo "============================================="
-echo ""
-echo "This script will migrate telemetry data from:"
-echo "  Source: https://api.htl-braunau.at/dev/data"
-echo "  Target: $POCKETBASE_URL"
-echo "  Collection: $POCKETBASE_COLLECTION"
-echo ""
-
-# Check if PocketBase is reachable
-echo "🔍 Checking PocketBase connection..."
-if ! curl -sf "$POCKETBASE_URL/api/health" >/dev/null 2>&1; then
-  echo "❌ Cannot reach PocketBase at $POCKETBASE_URL"
-  echo "   Make sure PocketBase is running and the URL is correct."
-  exit 1
-fi
-echo "✅ PocketBase is reachable"
-echo ""
-
-# Check source API
-echo "🔍 Checking source API..."
-SUMMARY=$(curl -sf "https://api.htl-braunau.at/dev/data/summary" 2>/dev/null || echo "")
-if [ -z "$SUMMARY" ]; then
-  echo "❌ Cannot reach source API"
-  exit 1
-fi
-
-TOTAL=$(echo "$SUMMARY" | grep -o '"total_entries":[0-9]*' | cut -d: -f2)
-echo "✅ Source API is reachable ($TOTAL entries available)"
-echo ""
-
-# Confirm migration
-read -p "⚠️  Do you want to start the migration? [y/N] " -n 1 -r
-echo ""
-if [[ ! $REPLY =~ ^[Yy]$ ]]; then
-  echo "Migration cancelled."
-  exit 0
-fi
-
-echo ""
-echo "Starting migration..."
-echo ""
-
-# Run the Go migration script
-cd "$SCRIPT_DIR"
-POCKETBASE_URL="$POCKETBASE_URL" POCKETBASE_COLLECTION="$POCKETBASE_COLLECTION" go run migrate.go
-
-echo ""
-echo "Migration complete!"
diff --git a/misc/data/migration/fix-timestamps.sh b/misc/data/migration/fix-timestamps.sh
deleted file mode 100644
index a3af395d..00000000
--- a/misc/data/migration/fix-timestamps.sh
+++ /dev/null
@@ -1,106 +0,0 @@
-#!/bin/bash
-# Post-migration script to fix timestamps in PocketBase
-# Run this INSIDE the PocketBase container after migration completes
-#
-# Usage: ./fix-timestamps.sh
-
-set -e
-
-DB_PATH="/app/pb_data/data.db"
-
-echo "==========================================================="
-echo "   Fix Timestamps in PocketBase"
-echo "==========================================================="
-echo ""
-
-# Check if sqlite3 is available
-if ! command -v sqlite3 &> /dev/null; then
-    echo "sqlite3 not found. Installing..."
-    apk add sqlite 2>/dev/null || apt-get update && apt-get install -y sqlite3
-fi
-
-# Check if database exists
-if [ ! -f "$DB_PATH" ]; then
-    echo "Database not found at $DB_PATH"
-    echo "Trying alternative paths..."
-    
-    if [ -f "/pb_data/data.db" ]; then
-        DB_PATH="/pb_data/data.db"
-    elif [ -f "/pb/pb_data/data.db" ]; then
-        DB_PATH="/pb/pb_data/data.db"
-    else
-        DB_PATH=$(find / -name "data.db" 2>/dev/null | head -1)
-    fi
-    
-    if [ -z "$DB_PATH" ] || [ ! -f "$DB_PATH" ]; then
-        echo "Could not find PocketBase database!"
-        exit 1
-    fi
-fi
-
-echo "Database: $DB_PATH"
-echo ""
-
-# List tables
-echo "Tables in database:"
-sqlite3 "$DB_PATH" ".tables"
-echo ""
-
-# Find the telemetry table (usually matches collection name)
-echo "Looking for telemetry/installations table..."
-TABLE_NAME=$(sqlite3 "$DB_PATH" ".tables" | tr ' ' '\n' | grep -E "telemetry|installations" | head -1)
-
-if [ -z "$TABLE_NAME" ]; then
-    echo "Could not auto-detect table. Available tables:"
-    sqlite3 "$DB_PATH" ".tables"
-    echo ""
-    read -p "Enter table name: " TABLE_NAME
-fi
-
-echo "Using table: $TABLE_NAME"
-echo ""
-
-# Check if old_created column exists
-HAS_OLD_CREATED=$(sqlite3 "$DB_PATH" "PRAGMA table_info($TABLE_NAME);" | grep -c "old_created" || echo "0")
-
-if [ "$HAS_OLD_CREATED" -eq "0" ]; then
-    echo "Column 'old_created' not found in table $TABLE_NAME"
-    echo "Migration may not have been run with timestamp preservation."
-    exit 1
-fi
-
-# Show sample data before update
-echo "Sample data BEFORE update:"
-sqlite3 "$DB_PATH" "SELECT id, created, old_created FROM $TABLE_NAME WHERE old_created IS NOT NULL AND old_created != '' LIMIT 3;"
-echo ""
-
-# Count records to update
-COUNT=$(sqlite3 "$DB_PATH" "SELECT COUNT(*) FROM $TABLE_NAME WHERE old_created IS NOT NULL AND old_created != '';")
-echo "Records to update: $COUNT"
-echo ""
-
-read -p "Proceed with timestamp update? [y/N] " -n 1 -r
-echo ""
-if [[ ! $REPLY =~ ^[Yy]$ ]]; then
-    echo "Aborted."
-    exit 0
-fi
-
-# Perform the update
-echo "Updating timestamps..."
-sqlite3 "$DB_PATH" "UPDATE $TABLE_NAME SET created = old_created, updated = old_created WHERE old_created IS NOT NULL AND old_created != '';"
-
-# Show sample data after update
-echo ""
-echo "Sample data AFTER update:"
-sqlite3 "$DB_PATH" "SELECT id, created, old_created FROM $TABLE_NAME LIMIT 3;"
-echo ""
-
-echo "==========================================================="
-echo "   Timestamp Update Complete!"
-echo "==========================================================="
-echo ""
-echo "Next steps:"
-echo "1. Verify data in PocketBase Admin UI"
-echo "2. Remove the 'old_created' field from the collection schema"
-echo ""
diff --git a/misc/data/migration/import-direct.sh b/misc/data/migration/import-direct.sh
deleted file mode 100644
index 63854838..00000000
--- a/misc/data/migration/import-direct.sh
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/bin/sh
-# Direct SQLite Import - Pure Shell, FAST batch mode!
-# Imports MongoDB Extended JSON directly into PocketBase SQLite
-#
-# Usage:
-#   docker cp import-direct.sh pocketbase:/tmp/
-#   docker cp data.json pocketbase:/tmp/
-#   docker exec -it pocketbase sh -c "cd /tmp && chmod +x import-direct.sh && ./import-direct.sh"
-
-set -e
-
-JSON_FILE="${1:-/tmp/data.json}"
-TABLE="${2:-telemetry}"
-REPO="${3:-Proxmox VE}"
-DB="${4:-/app/pb_data/data.db}"
-BATCH=5000
-
-echo "========================================================="
-echo "     Direct SQLite Import (Batch Mode)"
-echo "========================================================="
-echo "JSON:  $JSON_FILE"
-echo "Table: $TABLE"
-echo "Repo:  $REPO"
-echo "Batch: $BATCH"
-echo "---------------------------------------------------------"
-
-# Install jq if missing
-command -v jq >/dev/null || apk add --no-cache jq
-
-# Optimize SQLite for bulk
-sqlite3 "$DB" "PRAGMA journal_mode=WAL; PRAGMA synchronous=OFF; PRAGMA cache_size=100000;"
-
-SQL_FILE="/tmp/batch.sql"
-echo "[INFO] Converting JSON to SQL..."
-START=$(date +%s)
-
-# Convert entire JSON to SQL file (much faster than line-by-line sqlite3 calls)
-{
-    echo "BEGIN TRANSACTION;"
-    jq -r '.[] | @json' "$JSON_FILE" | while read -r r; do
-        CT=$(echo "$r" | jq -r 'if .ct_type|type=="object" then .ct_type["$numberLong"] else .ct_type end // 0')
-        DISK=$(echo "$r" | jq -r 'if .disk_size|type=="object" then .disk_size["$numberLong"] else .disk_size end // 0')
-        CORE=$(echo "$r" | jq -r 'if .core_count|type=="object" then .core_count["$numberLong"] else .core_count end // 0')
-        RAM=$(echo "$r" | jq -r 'if .ram_size|type=="object" then .ram_size["$numberLong"] else .ram_size end // 0')
-        OS=$(echo "$r" | jq -r '.os_type // ""' | sed "s/'/''/g")
-        OSVER=$(echo "$r" | jq -r '.os_version // ""' | sed "s/'/''/g")
-        DIS6=$(echo "$r" | jq -r '.disable_ip6 // "no"' | sed "s/'/''/g")
-        APP=$(echo "$r" | jq -r '.nsapp // "unknown"' | sed "s/'/''/g")
-        METH=$(echo "$r" | jq -r '.method // ""' | sed "s/'/''/g")
-        PVE=$(echo "$r" | jq -r '.pveversion // ""' | sed "s/'/''/g")
-        STAT=$(echo "$r" | jq -r '.status // "unknown"')
-        [ "$STAT" = "done" ] && STAT="success"
-        RID=$(echo "$r" | jq -r '.random_id // ""' | sed "s/'/''/g")
-        TYPE=$(echo "$r" | jq -r '.type // "lxc"' | sed "s/'/''/g")
-        ERR=$(echo "$r" | jq -r '.error // ""' | sed "s/'/''/g")
-        DATE=$(echo "$r" | jq -r 'if .created_at|type=="object" then .created_at["$date"] else .created_at end // ""')
-        ID=$(head -c 100 /dev/urandom | tr -dc 'a-z0-9' | head -c 15)
-        REPO_ESC=$(echo "$REPO" | sed "s/'/''/g")
-
-        echo "INSERT OR IGNORE INTO $TABLE (id,created,updated,ct_type,disk_size,core_count,ram_size,os_type,os_version,disableip6,nsapp,method,pve_version,status,random_id,type,error,repo_source) VALUES ('$ID','$DATE','$DATE',$CT,$DISK,$CORE,$RAM,'$OS','$OSVER','$DIS6','$APP','$METH','$PVE','$STAT','$RID','$TYPE','$ERR','$REPO_ESC');"
-    done
-    echo "COMMIT;"
-} > "$SQL_FILE"
-
-MID=$(date +%s)
-echo "[INFO] SQL generated in $((MID - START))s"
-echo "[INFO] Importing into SQLite..."
-
-sqlite3 "$DB" < "$SQL_FILE"
-
-END=$(date +%s)
-COUNT=$(wc -l < "$SQL_FILE")
-rm -f "$SQL_FILE"
-
-echo "========================================================="
-echo "Done! ~$((COUNT - 2)) records in $((END - START)) seconds"
-echo "========================================================="
diff --git a/misc/data/migration/migrate-linux.sh b/misc/data/migration/migrate-linux.sh
deleted file mode 100644
index 17b39eba..00000000
--- a/misc/data/migration/migrate-linux.sh
+++ /dev/null
@@ -1,89 +0,0 @@
-#!/bin/bash
-# Migration script for Proxmox VE data
-# Run directly on the server machine
-#
-# Usage: ./migrate-linux.sh
-#
-# Prerequisites:
-# - Go installed (apt install golang-go)
-# - Network access to source API and PocketBase
-
-set -e
-
-echo "==========================================================="
-echo "   Proxmox VE Data Migration to PocketBase"
-echo "==========================================================="
-
-# Configuration - EDIT THESE VALUES
-export MIGRATION_SOURCE_URL="https://api.htl-braunau.at/data"
-export POCKETBASE_URL="http://db.community-scripts.org"
-export POCKETBASE_COLLECTION="telemetry"
-export PB_AUTH_COLLECTION="_superusers"
-export PB_IDENTITY="db_admin@community-scripts.org"
-export PB_PASSWORD="YOUR_PASSWORD_HERE"  # <-- CHANGE THIS!
-export REPO_SOURCE="Proxmox VE"
-export DATE_UNTIL="2026-02-10"
-export BATCH_SIZE="500"
-
-# Optional: Resume from specific page
-# export START_PAGE="100"
-
-# Optional: Only import records after this date
-# export DATE_FROM="2020-01-01"
-
-echo ""
-echo "Configuration:"
-echo "  Source:     $MIGRATION_SOURCE_URL"
-echo "  Target:     $POCKETBASE_URL"
-echo "  Collection: $POCKETBASE_COLLECTION"
-echo "  Repo:       $REPO_SOURCE"
-echo "  Until:      $DATE_UNTIL"
-echo "  Batch:      $BATCH_SIZE"
-echo ""
-
-# Check if Go is installed
-if ! command -v go &> /dev/null; then
-    echo "Go is not installed. Installing..."
-    apt-get update && apt-get install -y golang-go
-fi
-
-# Download migrate.go if not present
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-MIGRATE_GO="$SCRIPT_DIR/migrate.go"
-
-if [ ! -f "$MIGRATE_GO" ]; then
-    echo "migrate.go not found in $SCRIPT_DIR"
-    echo "Please copy migrate.go to this directory first."
-    exit 1
-fi
-
-echo "Building migration tool..."
-cd "$SCRIPT_DIR"
-go build -o migrate migrate.go
-
-echo ""
-echo "Starting migration..."
-echo "Press Ctrl+C to stop (you can resume later with START_PAGE)"
-echo ""
-
-./migrate
-
-echo ""
-echo "==========================================================="
-echo "   Post-Migration Steps"
-echo "==========================================================="
-echo ""
-echo "1. Connect to PocketBase container:"
-echo "   docker exec -it <pocketbase-container> sh"
-echo ""
-echo "2. Find the table name:"
-echo "   sqlite3 /app/pb_data/data.db '.tables'"
-echo ""
-echo "3. Update timestamps (replace <table> with actual name):"
-echo "   sqlite3 /app/pb_data/data.db \"UPDATE <table> SET created = old_created, updated = old_created WHERE old_created IS NOT NULL AND old_created != ''\""
-echo ""
-echo "4. Verify timestamps:"
-echo "   sqlite3 /app/pb_data/data.db \"SELECT created, old_created FROM <table> LIMIT 5\""
-echo ""
-echo "5. Remove old_created field in PocketBase Admin UI"
-echo ""
diff --git a/misc/data/migration/migrate.go b/misc/data/migration/migrate.go
deleted file mode 100644
index 157d622f..00000000
--- a/misc/data/migration/migrate.go
+++ /dev/null
@@ -1,1295 +0,0 @@
-// +build ignore
-
-// Migration script to import data from the old API or JSON file to PocketBase
-// Run with: go run migrate.go
-//
-// Environment variables:
-//   JSON_FILE             - Path to JSON file to import (if set, skips API fetch)
-//   SQL_OUTPUT            - Path to output SQL file (direct SQLite import, fastest!)
-//   MIGRATION_SOURCE_URL  - Base URL of source API (default: https://api.htl-braunau.at/data)
-//   POCKETBASE_URL        - PocketBase URL (default: http://localhost:8090)
-//   POCKETBASE_COLLECTION - Target collection (default: telemetry)
-//   PB_IDENTITY           - Auth username
-//   PB_PASSWORD           - Auth password
-//   REPO_SOURCE           - Value for repo_source field (e.g., "community-scripts" or "Proxmox VE")
-//   DATE_UNTIL            - Only import records created before this date (format: YYYY-MM-DD)
-//   DATE_FROM             - Only import records created after this date (format: YYYY-MM-DD)
-//   START_PAGE            - Resume from this page (default: 1, API mode only)
-//   BATCH_SIZE            - Records per batch (default: 500)
-//   SKIP_RECORDS          - Skip first N records (JSON file mode, for resuming)
-//   WORKERS               - Number of parallel HTTP workers (default: 50)
-//
-// SQL Output Mode (fastest - seconds for millions of records):
-//   $env:JSON_FILE = "data.json"
-//   $env:SQL_OUTPUT = "import.sql"
-//   $env:REPO_SOURCE = "Proxmox VE"
-//   .\migrate.exe
-//   # Then on server: sqlite3 /app/pb_data/data.db < import.sql
-//
-// JSON file format (array of objects):
-//   [{"id": "...", "ct_type": 1, "nsapp": "...", ...}, ...]
-package main
-
-import (
-	"bufio"
-	"bytes"
-	cryptoRand "crypto/rand"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"strconv"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
-)
-
-const (
-	defaultSourceAPI = "https://api.htl-braunau.at/data"
-	defaultPBURL     = "http://localhost:8090"
-	defaultBatchSize = 500
-	defaultWorkers   = 50 // Parallel workers for importing
-)
-
-var (
-	sourceAPI      string
-	summaryAPI     string
-	authToken      string
-	repoSource     string
-	dateUntil      time.Time
-	dateFrom       time.Time
-	hasDateUntil   bool
-	hasDateFrom    bool
-	workerCount    int = defaultWorkers
-)
-
-// OldDataModel represents the data structure from the old API
-type OldDataModel struct {
-	ID         string `json:"id"`
-	CtType     int    `json:"ct_type"`
-	DiskSize   int    `json:"disk_size"`
-	CoreCount  int    `json:"core_count"`
-	RamSize    int    `json:"ram_size"`
-	OsType     string `json:"os_type"`
-	OsVersion  string `json:"os_version"`
-	DisableIP6 string `json:"disableip6"`
-	NsApp      string `json:"nsapp"`
-	Method     string `json:"method"`
-	CreatedAt  string `json:"created_at"`
-	PveVersion string `json:"pve_version"`
-	Status     string `json:"status"`
-	RandomID   string `json:"random_id"`
-	Type       string `json:"type"`
-	Error      string `json:"error"`
-} 
-
-// MongoNumberLong represents MongoDB's $numberLong type
-type MongoNumberLong struct {
-	Value string `json:"$numberLong"`
-}
-
-// MongoDate represents MongoDB's $date type
-type MongoDate struct {
-	Value string `json:"$date"`
-}
-
-// MongoOID represents MongoDB's $oid type
-type MongoOID struct {
-	Value string `json:"$oid"`
-}
-
-// MongoDataModel represents MongoDB Extended JSON export format
-type MongoDataModel struct {
-	MongoID    MongoOID        `json:"_id"`
-	ID         json.RawMessage `json:"id"`
-	CtType     json.RawMessage `json:"ct_type"`
-	DiskSize   json.RawMessage `json:"disk_size"`
-	CoreCount  json.RawMessage `json:"core_count"`
-	RamSize    json.RawMessage `json:"ram_size"`
-	OsType     string          `json:"os_type"`
-	OsVersion  string          `json:"os_version"`
-	DisableIP6 string          `json:"disable_ip6"`
-	NsApp      string          `json:"nsapp"`
-	Method     string          `json:"method"`
-	CreatedAt  json.RawMessage `json:"created_at"`
-	PveVersion string          `json:"pveversion"`
-	Status     string          `json:"status"`
-	RandomID   string          `json:"random_id"`
-	Type       string          `json:"type"`
-	Error      *string         `json:"error"`
-}
-
-// parseMongoInt extracts int from MongoDB $numberLong or plain number
-func parseMongoInt(raw json.RawMessage) int {
-	if len(raw) == 0 {
-		return 0
-	}
-	// Try $numberLong first
-	var numLong MongoNumberLong
-	if err := json.Unmarshal(raw, &numLong); err == nil && numLong.Value != "" {
-		if n, err := strconv.Atoi(numLong.Value); err == nil {
-			return n
-		}
-	}
-	// Try plain number
-	var n int
-	if err := json.Unmarshal(raw, &n); err == nil {
-		return n
-	}
-	return 0
-}
-
-// parseMongoDate extracts date string from MongoDB $date or plain string
-func parseMongoDate(raw json.RawMessage) string {
-	if len(raw) == 0 {
-		return ""
-	}
-	// Try $date first
-	var mongoDate MongoDate
-	if err := json.Unmarshal(raw, &mongoDate); err == nil && mongoDate.Value != "" {
-		return mongoDate.Value
-	}
-	// Try plain string
-	var s string
-	if err := json.Unmarshal(raw, &s); err == nil {
-		return s
-	}
-	return ""
-}
-
-// parseMongoString extracts string from MongoDB $numberLong or plain string/number
-func parseMongoString(raw json.RawMessage) string {
-	if len(raw) == 0 {
-		return ""
-	}
-	// Try $numberLong first (MongoDB exports IDs as numbers sometimes)
-	var numLong MongoNumberLong
-	if err := json.Unmarshal(raw, &numLong); err == nil && numLong.Value != "" {
-		return numLong.Value
-	}
-	// Try plain string
-	var s string
-	if err := json.Unmarshal(raw, &s); err == nil {
-		return s
-	}
-	// Try plain number
-	var n int64
-	if err := json.Unmarshal(raw, &n); err == nil {
-		return strconv.FormatInt(n, 10)
-	}
-	return ""
-}
-
-// convertMongoToOld converts MongoDB format to OldDataModel
-func convertMongoToOld(m MongoDataModel) OldDataModel {
-	errorStr := ""
-	if m.Error != nil {
-		errorStr = *m.Error
-	}
-	return OldDataModel{
-		CtType:     parseMongoInt(m.CtType),
-		DiskSize:   parseMongoInt(m.DiskSize),
-		CoreCount:  parseMongoInt(m.CoreCount),
-		RamSize:    parseMongoInt(m.RamSize),
-		OsType:     m.OsType,
-		OsVersion:  m.OsVersion,
-		DisableIP6: m.DisableIP6,
-		NsApp:      m.NsApp,
-		Method:     m.Method,
-		CreatedAt:  parseMongoDate(m.CreatedAt),
-		PveVersion: m.PveVersion,
-		Status:     m.Status,
-		RandomID:   m.RandomID,
-		Type:       m.Type,
-		Error:      errorStr,
-	}
-}
-
-// PBRecord represents the PocketBase record format
-type PBRecord struct {
-	CtType     int    `json:"ct_type"`
-	DiskSize   int    `json:"disk_size"`
-	CoreCount  int    `json:"core_count"`
-	RamSize    int    `json:"ram_size"`
-	OsType     string `json:"os_type"`
-	OsVersion  string `json:"os_version"`
-	DisableIP6 string `json:"disableip6"`
-	NsApp      string `json:"nsapp"`
-	Method     string `json:"method"`
-	PveVersion string `json:"pve_version"`
-	Status     string `json:"status"`
-	RandomID   string `json:"random_id"`
-	Type       string `json:"type"`
-	Error      string `json:"error"`
-	RepoSource string `json:"repo_source,omitempty"`
-	OldCreated string `json:"old_created,omitempty"`
-}
-
-type Summary struct {
-	TotalEntries int `json:"total_entries"`
-}
-
-type ImportJob struct {
-	Record OldDataModel
-	Index  int
-}
-
-type ImportResult struct {
-	Success bool
-	Skipped bool
-	Error   error
-}
-
-func main() {
-	// Setup source URLs
-	baseURL := os.Getenv("MIGRATION_SOURCE_URL")
-	if baseURL == "" {
-		baseURL = defaultSourceAPI
-	}
-	sourceAPI = baseURL + "/paginated"
-	summaryAPI = baseURL + "/summary"
-
-	// Repo source (to distinguish data origins)
-	repoSource = os.Getenv("REPO_SOURCE")
-
-	// Date filters
-	if dateStr := os.Getenv("DATE_UNTIL"); dateStr != "" {
-		parsed, err := time.Parse("2006-01-02", dateStr)
-		if err != nil {
-			fmt.Printf("[ERROR] Invalid DATE_UNTIL format (use YYYY-MM-DD): %v\n", err)
-			os.Exit(1)
-		}
-		dateUntil = parsed.Add(24*time.Hour - time.Second) // End of day
-		hasDateUntil = true
-	}
-
-	if dateStr := os.Getenv("DATE_FROM"); dateStr != "" {
-		parsed, err := time.Parse("2006-01-02", dateStr)
-		if err != nil {
-			fmt.Printf("[ERROR] Invalid DATE_FROM format (use YYYY-MM-DD): %v\n", err)
-			os.Exit(1)
-		}
-		dateFrom = parsed // Start of day
-		hasDateFrom = true
-	}
-
-	// Batch size
-	batchSize := defaultBatchSize
-	if bs := os.Getenv("BATCH_SIZE"); bs != "" {
-		if n, err := strconv.Atoi(bs); err == nil && n > 0 {
-			batchSize = n
-		}
-	}
-
-	// Start page (for resuming)
-	startPage := 1
-	if sp := os.Getenv("START_PAGE"); sp != "" {
-		if n, err := strconv.Atoi(sp); err == nil && n > 0 {
-			startPage = n
-		}
-	}
-
-	// PocketBase URL
-	pbURL := os.Getenv("POCKETBASE_URL")
-	if pbURL == "" {
-		pbURL = os.Getenv("PB_URL")
-	}
-	if pbURL == "" {
-		pbURL = defaultPBURL
-	}
-
-	// Collection
-	pbCollection := os.Getenv("POCKETBASE_COLLECTION")
-	if pbCollection == "" {
-		pbCollection = os.Getenv("PB_TARGET_COLLECTION")
-	}
-	if pbCollection == "" {
-		pbCollection = "telemetry"
-	}
-
-	// Auth collection
-	authCollection := os.Getenv("PB_AUTH_COLLECTION")
-	if authCollection == "" {
-		authCollection = "telemetry_service_user"
-	}
-
-	// Credentials
-	pbIdentity := os.Getenv("PB_IDENTITY")
-	pbPassword := os.Getenv("PB_PASSWORD")
-
-	// Workers count
-	if wc := os.Getenv("WORKERS"); wc != "" {
-		if n, err := strconv.Atoi(wc); err == nil && n > 0 {
-			workerCount = n
-		}
-	}
-
-	// Check for SQL output mode (fastest - no network!)
-	jsonFile := os.Getenv("JSON_FILE")
-	sqlOutput := os.Getenv("SQL_OUTPUT")
-	if jsonFile != "" && sqlOutput != "" {
-		runSQLExport(jsonFile, sqlOutput, pbCollection)
-		return
-	}
-
-	// Check for JSON file import mode (via HTTP API)
-	if jsonFile != "" {
-		// Authenticate first
-		if pbIdentity != "" && pbPassword != "" {
-			fmt.Println("[AUTH] Authenticating with PocketBase...")
-			err := authenticate(pbURL, authCollection, pbIdentity, pbPassword)
-			if err != nil {
-				fmt.Printf("[ERROR] Authentication failed: %v\n", err)
-				os.Exit(1)
-			}
-			fmt.Println("[OK] Authentication successful")
-		}
-
-		// Skip records (for resuming)
-		var skipRecords int64
-		if sr := os.Getenv("SKIP_RECORDS"); sr != "" {
-			if n, err := strconv.ParseInt(sr, 10, 64); err == nil && n > 0 {
-				skipRecords = n
-			}
-		}
-
-		runJSONFileImport(jsonFile, pbURL, pbCollection, batchSize, skipRecords)
-		return
-	}
-
-	fmt.Println("=========================================================")
-	fmt.Println("        Data Migration to PocketBase")
-	fmt.Println("=========================================================")
-	fmt.Printf("Source API:       %s\n", baseURL)
-	fmt.Printf("PocketBase URL:   %s\n", pbURL)
-	fmt.Printf("Collection:       %s\n", pbCollection)
-	fmt.Printf("Batch Size:       %d\n", batchSize)
-	fmt.Printf("Workers:          %d\n", workerCount)
-	if repoSource != "" {
-		fmt.Printf("Repo Source:      %s\n", repoSource)
-	}
-	if hasDateFrom {
-		fmt.Printf("Date From:        >= %s\n", dateFrom.Format("2006-01-02"))
-	}
-	if hasDateUntil {
-		fmt.Printf("Date Until:       <= %s\n", dateUntil.Format("2006-01-02"))
-	}
-	if startPage > 1 {
-		fmt.Printf("Starting Page:    %d\n", startPage)
-	}
-	fmt.Println("---------------------------------------------------------")
-
-	// Authenticate with PocketBase
-	if pbIdentity != "" && pbPassword != "" {
-		fmt.Println("[AUTH] Authenticating with PocketBase...")
-		err := authenticate(pbURL, authCollection, pbIdentity, pbPassword)
-		if err != nil {
-			fmt.Printf("[ERROR] Authentication failed: %v\n", err)
-			os.Exit(1)
-		}
-		fmt.Println("[OK] Authentication successful")
-	} else {
-		fmt.Println("[WARN] No credentials provided, trying without auth...")
-	}
-	fmt.Println("---------------------------------------------------------")
-
-	// Get total count
-	summary, err := getSummary()
-	if err != nil {
-		fmt.Printf("[ERROR] Failed to get summary: %v\n", err)
-		os.Exit(1)
-	}
-	fmt.Printf("[INFO] Total entries in source: %d\n", summary.TotalEntries)
-	fmt.Println("---------------------------------------------------------")
-
-	// Calculate pages
-	totalPages := (summary.TotalEntries + batchSize - 1) / batchSize
-
-	fmt.Printf("Starting migration (%d pages to process)...\n", totalPages)
-	fmt.Println()
-
-	var totalMigrated, totalFailed, totalSkipped, totalFiltered int64
-	startTime := time.Now()
-
-	// Progress tracking
-	processedRecords := int64(0)
-
-	for page := startPage; page <= totalPages; page++ {
-		pageStart := time.Now()
-
-		data, err := fetchPage(page, batchSize)
-		if err != nil {
-			fmt.Printf("[Page %d] ERROR: Failed to fetch: %v\n", page, err)
-			atomic.AddInt64(&totalFailed, int64(batchSize))
-			continue
-		}
-
-		// Filter by date if needed
-		var filteredData []OldDataModel
-		var lastTimestamp string
-		pageFiltered := 0
-
-		for _, record := range data {
-			recordDate, err := parseTimestamp(record.CreatedAt)
-			if err != nil {
-				// Skip records with unparseable dates
-				atomic.AddInt64(&totalFiltered, 1)
-				pageFiltered++
-				continue
-			}
-
-			// Check DATE_FROM (skip if before)
-			if hasDateFrom && recordDate.Before(dateFrom) {
-				atomic.AddInt64(&totalFiltered, 1)
-				pageFiltered++
-				continue
-			}
-
-			// Check DATE_UNTIL (skip if after)
-			if hasDateUntil && recordDate.After(dateUntil) {
-				atomic.AddInt64(&totalFiltered, 1)
-				pageFiltered++
-				continue
-			}
-
-			filteredData = append(filteredData, record)
-			lastTimestamp = record.CreatedAt
-		}
-
-		atomic.AddInt64(&processedRecords, int64(len(data)))
-
-		// Show progress even if all filtered
-		if len(filteredData) == 0 {
-			if page <= 5 || page%100 == 0 {
-				fmt.Printf("[Page %d/%d] All %d filtered (after DATE_UNTIL) | Total filtered: %d\n",
-					page, totalPages, pageFiltered, atomic.LoadInt64(&totalFiltered))
-			}
-			continue
-		}
-
-		// Worker pool for importing
-		jobs := make(chan ImportJob, len(filteredData))
-		results := make(chan ImportResult, len(filteredData))
-		var wg sync.WaitGroup
-
-		// Start workers
-		for w := 0; w < workerCount; w++ {
-			wg.Add(1)
-			go func() {
-				defer wg.Done()
-				for job := range jobs {
-					result := importRecordWithRetry(pbURL, pbCollection, job.Record, 3)
-					results <- result
-				}
-			}()
-		}
-
-		// Send jobs
-		for i, record := range filteredData {
-			jobs <- ImportJob{Record: record, Index: i}
-		}
-		close(jobs)
-
-		// Wait for workers to finish
-		go func() {
-			wg.Wait()
-			close(results)
-		}()
-
-		// Collect results
-		pageMigrated, pageSkipped, pageFailed := 0, 0, 0
-		var lastError error
-		for result := range results {
-			if result.Skipped {
-				pageSkipped++
-			} else if result.Success {
-				pageMigrated++
-			} else {
-				pageFailed++
-				if lastError == nil && result.Error != nil {
-					lastError = result.Error
-				}
-			}
-		}
-
-		// Log first error on the page
-		if pageFailed > 0 && lastError != nil && page <= 3 {
-			fmt.Printf("[Page %d] Sample error: %v\n", page, lastError)
-		}
-
-		atomic.AddInt64(&totalMigrated, int64(pageMigrated))
-		atomic.AddInt64(&totalSkipped, int64(pageSkipped))
-		atomic.AddInt64(&totalFailed, int64(pageFailed))
-
-		// Progress display (first 5 pages, then every 10 pages)
-		if page <= 5 || page%10 == 0 || page == totalPages {
-			elapsed := time.Since(startTime)
-			processed := atomic.LoadInt64(&processedRecords)
-			rate := float64(processed) / elapsed.Seconds()
-			remaining := float64(summary.TotalEntries-int(processed)) / rate
-			eta := time.Duration(remaining) * time.Second
-
-			// Format last timestamp for display
-			lastDate := ""
-			if lastTimestamp != "" {
-				if t, err := parseTimestamp(lastTimestamp); err == nil {
-					lastDate = t.Format("2006-01-02")
-				}
-			}
-
-			fmt.Printf("[Page %d/%d] Migrated: %d | Skipped: %d | Failed: %d | Filtered: %d | %.0f rec/s | Last: %s | ETA: %s\n",
-				page, totalPages,
-				atomic.LoadInt64(&totalMigrated),
-				atomic.LoadInt64(&totalSkipped),
-				atomic.LoadInt64(&totalFailed),
-				atomic.LoadInt64(&totalFiltered),
-				rate,
-				lastDate,
-				formatDuration(eta))
-		}
-
-		// Adaptive delay based on page processing time
-		pageTime := time.Since(pageStart)
-		if pageTime < 500*time.Millisecond {
-			time.Sleep(100 * time.Millisecond)
-		}
-	}
-
-	fmt.Println()
-	fmt.Println("=========================================================")
-	fmt.Println("        Migration Complete")
-	fmt.Println("=========================================================")
-	fmt.Printf("Successfully migrated: %d\n", atomic.LoadInt64(&totalMigrated))
-	fmt.Printf("Skipped (duplicates):  %d\n", atomic.LoadInt64(&totalSkipped))
-	fmt.Printf("Filtered (date):       %d\n", atomic.LoadInt64(&totalFiltered))
-	fmt.Printf("Failed:                %d\n", atomic.LoadInt64(&totalFailed))
-	fmt.Printf("Duration:              %s\n", formatDuration(time.Since(startTime)))
-	fmt.Println("=========================================================")
-
-	if atomic.LoadInt64(&totalMigrated) > 0 {
-		fmt.Println()
-		fmt.Println("Next steps for timestamp migration:")
-		fmt.Printf("   1. SSH into your PocketBase server\n")
-		fmt.Printf("   2. Run: sqlite3 /app/pb_data/data.db \".tables\"\n")
-		fmt.Printf("   3. Find your collection table name\n")
-		fmt.Printf("   4. Run: sqlite3 /app/pb_data/data.db \"UPDATE <table_name> SET created = old_created, updated = old_created WHERE old_created IS NOT NULL AND old_created != ''\"\n")
-		fmt.Printf("   5. Remove the old_created field from the collection in PocketBase Admin UI\n")
-	}
-}
-
-func formatDuration(d time.Duration) string {
-	if d < 0 {
-		return "calculating..."
-	}
-	h := d / time.Hour
-	d -= h * time.Hour
-	m := d / time.Minute
-	d -= m * time.Minute
-	s := d / time.Second
-	if h > 0 {
-		return fmt.Sprintf("%dh %dm %ds", h, m, s)
-	}
-	if m > 0 {
-		return fmt.Sprintf("%dm %ds", m, s)
-	}
-	return fmt.Sprintf("%ds", s)
-}
-
-func parseTimestamp(ts string) (time.Time, error) {
-	if ts == "" {
-		return time.Time{}, fmt.Errorf("empty timestamp")
-	}
-
-	formats := []string{
-		time.RFC3339,
-		time.RFC3339Nano,
-		"2006-01-02T15:04:05.000Z",
-		"2006-01-02T15:04:05Z",
-		"2006-01-02T15:04:05",
-		"2006-01-02 15:04:05",
-		"2006-01-02 15:04:05.000",
-		"2006-01-02 15:04:05.000 UTC",
-		"2006-01-02T15:04:05.000+00:00",
-	}
-
-	for _, format := range formats {
-		if t, err := time.Parse(format, ts); err == nil {
-			return t, nil
-		}
-	}
-
-	return time.Time{}, fmt.Errorf("cannot parse: %s", ts)
-}
-
-func convertTimestamp(ts string) string {
-	if ts == "" {
-		return ""
-	}
-
-	t, err := parseTimestamp(ts)
-	if err != nil {
-		return ""
-	}
-
-	return t.UTC().Format("2006-01-02 15:04:05.000Z")
-}
-
-func getSummary() (*Summary, error) {
-	resp, err := http.Get(summaryAPI)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	var summary Summary
-	if err := json.NewDecoder(resp.Body).Decode(&summary); err != nil {
-		return nil, err
-	}
-
-	return &summary, nil
-}
-
-func authenticate(pbURL, authCollection, identity, password string) error {
-	body := map[string]string{
-		"identity": identity,
-		"password": password,
-	}
-	jsonData, _ := json.Marshal(body)
-
-	url := fmt.Sprintf("%s/api/collections/%s/auth-with-password", pbURL, authCollection)
-	req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/json")
-
-	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		body, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
-	}
-
-	var result struct {
-		Token string `json:"token"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return err
-	}
-	if result.Token == "" {
-		return fmt.Errorf("no token in response")
-	}
-
-	authToken = result.Token
-	return nil
-}
-
-func fetchPage(page, limit int) ([]OldDataModel, error) {
-	url := fmt.Sprintf("%s?page=%d&limit=%d", sourceAPI, page, limit)
-
-	client := &http.Client{Timeout: 60 * time.Second}
-	resp, err := client.Get(url)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		return nil, fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
-	}
-
-	var data []OldDataModel
-	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
-		return nil, err
-	}
-
-	return data, nil
-}
-
-func importRecordWithRetry(pbURL, collection string, old OldDataModel, maxRetries int) ImportResult {
-	var lastErr error
-	for i := 0; i < maxRetries; i++ {
-		err := importRecord(pbURL, collection, old)
-		if err == nil {
-			return ImportResult{Success: true}
-		}
-		if isUniqueViolation(err) {
-			return ImportResult{Skipped: true}
-		}
-		lastErr = err
-		time.Sleep(time.Duration(i+1) * 100 * time.Millisecond)
-	}
-	return ImportResult{Error: lastErr}
-}
-
-func importRecord(pbURL, collection string, old OldDataModel) error {
-	// Map status: "done" -> "success"
-	status := old.Status
-	switch status {
-	case "done":
-		status = "success"
-	case "installing", "failed", "unknown", "success":
-		// keep as-is
-	default:
-		status = "unknown"
-	}
-
-	// Map ct_type: 1=unprivileged (0), 2=privileged (1)
-	// PocketBase schema: 0 = unprivileged, 1 = privileged
-	ctType := 0 // default: unprivileged
-	if old.CtType == 2 {
-		ctType = 1 // privileged
-	}
-
-	// Ensure type is set
-	recordType := old.Type
-	if recordType == "" {
-		recordType = "lxc"
-	}
-
-	// Ensure nsapp is set (required field)
-	nsapp := old.NsApp
-	if nsapp == "" {
-		nsapp = "unknown"
-	}
-
-	record := PBRecord{
-		CtType:     ctType,
-		DiskSize:   old.DiskSize,
-		CoreCount:  old.CoreCount,
-		RamSize:    old.RamSize,
-		OsType:     old.OsType,
-		OsVersion:  old.OsVersion,
-		DisableIP6: old.DisableIP6,
-		NsApp:      nsapp,
-		Method:     old.Method,
-		PveVersion: old.PveVersion,
-		Status:     status,
-		RandomID:   old.RandomID,
-		Type:       recordType,
-		Error:      old.Error,
-		RepoSource: repoSource,
-		OldCreated: convertTimestamp(old.CreatedAt),
-	}
-
-	jsonData, err := json.Marshal(record)
-	if err != nil {
-		return err
-	}
-
-	url := fmt.Sprintf("%s/api/collections/%s/records", pbURL, collection)
-	req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/json")
-	if authToken != "" {
-		req.Header.Set("Authorization", "Bearer "+authToken)
-	}
-
-	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
-		body, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
-	}
-
-	return nil
-}
-
-func isUniqueViolation(err error) bool {
-	if err == nil {
-		return false
-	}
-	errStr := err.Error()
-	return strings.Contains(errStr, "UNIQUE constraint failed") ||
-		strings.Contains(errStr, "duplicate") ||
-		strings.Contains(errStr, "already exists") ||
-		strings.Contains(errStr, "validation_not_unique")
-}
-
-// runJSONFileImport handles importing from a JSON file using streaming
-func runJSONFileImport(jsonFile, pbURL, pbCollection string, batchSize int, skipRecords int64) {
-	fmt.Println("=========================================================")
-	fmt.Println("        JSON File Import to PocketBase")
-	fmt.Println("=========================================================")
-	fmt.Printf("JSON File:        %s\n", jsonFile)
-	fmt.Printf("PocketBase URL:   %s\n", pbURL)
-	fmt.Printf("Collection:       %s\n", pbCollection)
-	fmt.Printf("Batch Size:       %d\n", batchSize)
-	fmt.Printf("Workers:          %d\n", workerCount)
-	if repoSource != "" {
-		fmt.Printf("Repo Source:      %s\n", repoSource)
-	}
-	if hasDateFrom {
-		fmt.Printf("Date From:        >= %s\n", dateFrom.Format("2006-01-02"))
-	}
-	if hasDateUntil {
-		fmt.Printf("Date Until:       <= %s\n", dateUntil.Format("2006-01-02"))
-	}
-	if skipRecords > 0 {
-		fmt.Printf("Skip Records:     %d\n", skipRecords)
-	}
-	fmt.Println("---------------------------------------------------------")
-
-	// Open file
-	file, err := os.Open(jsonFile)
-	if err != nil {
-		fmt.Printf("[ERROR] Cannot open file: %v\n", err)
-		os.Exit(1)
-	}
-	defer file.Close()
-
-	// Get file size for progress
-	fileInfo, _ := file.Stat()
-	fileSize := fileInfo.Size()
-	fmt.Printf("[INFO] File size: %.2f GB\n", float64(fileSize)/(1024*1024*1024))
-
-	// Auto-detect MongoDB Extended JSON format by peeking at the first 2KB
-	peekBuf := make([]byte, 2048)
-	n, _ := file.Read(peekBuf)
-	peekStr := string(peekBuf[:n])
-	isMongoFormat := strings.Contains(peekStr, `"$oid"`) ||
-		strings.Contains(peekStr, `"$numberLong"`) ||
-		strings.Contains(peekStr, `"$date"`)
-
-	// Reset file to beginning
-	file.Seek(0, 0)
-
-	if isMongoFormat {
-		fmt.Println("[INFO] Detected MongoDB Extended JSON format")
-	} else {
-		fmt.Println("[INFO] Detected standard JSON format")
-	}
-
-	// Use buffered reader for better performance
-	reader := bufio.NewReaderSize(file, 64*1024*1024) // 64MB buffer
-
-	// Create JSON decoder for streaming
-	decoder := json.NewDecoder(reader)
-
-	// Expect array start
-	token, err := decoder.Token()
-	if err != nil {
-		fmt.Printf("[ERROR] Cannot read JSON: %v\n", err)
-		os.Exit(1)
-	}
-	if delim, ok := token.(json.Delim); !ok || delim != '[' {
-		fmt.Printf("[ERROR] JSON file must be an array (expected '[', got %v)\n", token)
-		os.Exit(1)
-	}
-
-	fmt.Println("[OK] JSON array detected, starting streaming import...")
-	fmt.Println("---------------------------------------------------------")
-
-	var totalMigrated, totalFailed, totalSkipped, totalFiltered int64
-	var recordCount int64
-	startTime := time.Now()
-
-	// Batch processing
-	batch := make([]OldDataModel, 0, batchSize)
-	batchNum := 0
-
-	for decoder.More() {
-		var record OldDataModel
-
-		if isMongoFormat {
-			// Decode as MongoDB Extended JSON
-			var mongoRecord MongoDataModel
-			if err := decoder.Decode(&mongoRecord); err != nil {
-				fmt.Printf("[WARN] Failed to decode record %d: %v\n", recordCount+1, err)
-				atomic.AddInt64(&totalFailed, 1)
-				recordCount++
-				continue
-			}
-			record = convertMongoToOld(mongoRecord)
-		} else {
-			// Decode as standard JSON
-			if err := decoder.Decode(&record); err != nil {
-				fmt.Printf("[WARN] Failed to decode record %d: %v\n", recordCount+1, err)
-				atomic.AddInt64(&totalFailed, 1)
-				recordCount++
-				continue
-			}
-		}
-		recordCount++
-
-		// Skip records (for resuming)
-		if recordCount <= skipRecords {
-			if recordCount%100000 == 0 {
-				fmt.Printf("[SKIP] Skipped %d / %d records...\n", recordCount, skipRecords)
-			}
-			continue
-		}
-
-		// Date filter
-		if hasDateFrom || hasDateUntil {
-			recordDate, err := parseTimestamp(record.CreatedAt)
-			if err != nil {
-				atomic.AddInt64(&totalFiltered, 1)
-				continue
-			}
-			if hasDateFrom && recordDate.Before(dateFrom) {
-				atomic.AddInt64(&totalFiltered, 1)
-				continue
-			}
-			if hasDateUntil && recordDate.After(dateUntil) {
-				atomic.AddInt64(&totalFiltered, 1)
-				continue
-			}
-		}
-
-		batch = append(batch, record)
-
-		// Process batch when full
-		if len(batch) >= batchSize {
-			batchNum++
-			migrated, skipped, failed := processBatch(pbURL, pbCollection, batch, batchNum, recordCount, startTime)
-			atomic.AddInt64(&totalMigrated, int64(migrated))
-			atomic.AddInt64(&totalSkipped, int64(skipped))
-			atomic.AddInt64(&totalFailed, int64(failed))
-			batch = batch[:0] // Reset batch
-		}
-	}
-
-	// Process remaining batch
-	if len(batch) > 0 {
-		batchNum++
-		migrated, skipped, failed := processBatch(pbURL, pbCollection, batch, batchNum, recordCount, startTime)
-		atomic.AddInt64(&totalMigrated, int64(migrated))
-		atomic.AddInt64(&totalSkipped, int64(skipped))
-		atomic.AddInt64(&totalFailed, int64(failed))
-	}
-
-	fmt.Println()
-	fmt.Println("=========================================================")
-	fmt.Println("        JSON File Import Complete")
-	fmt.Println("=========================================================")
-	fmt.Printf("Total records read:    %d\n", recordCount)
-	fmt.Printf("Successfully imported: %d\n", atomic.LoadInt64(&totalMigrated))
-	fmt.Printf("Skipped (duplicates):  %d\n", atomic.LoadInt64(&totalSkipped))
-	fmt.Printf("Filtered (date):       %d\n", atomic.LoadInt64(&totalFiltered))
-	fmt.Printf("Failed:                %d\n", atomic.LoadInt64(&totalFailed))
-	fmt.Printf("Duration:              %s\n", formatDuration(time.Since(startTime)))
-	fmt.Println("=========================================================")
-
-	if atomic.LoadInt64(&totalMigrated) > 0 {
-		fmt.Println()
-		fmt.Println("Next steps for timestamp migration:")
-		fmt.Printf("   1. SSH into your PocketBase server\n")
-		fmt.Printf("   2. Run: sqlite3 /app/pb_data/data.db \".tables\"\n")
-		fmt.Printf("   3. Find your collection table name\n")
-		fmt.Printf("   4. Run: sqlite3 /app/pb_data/data.db \"UPDATE <table_name> SET created = old_created, updated = old_created WHERE old_created IS NOT NULL AND old_created != ''\"\n")
-		fmt.Printf("   5. Remove the old_created field from the collection in PocketBase Admin UI\n")
-	}
-}
-
-func processBatch(pbURL, pbCollection string, records []OldDataModel, batchNum int, totalRead int64, startTime time.Time) (migrated, skipped, failed int) {
-	batchStart := time.Now()
-
-	// Worker pool
-	jobs := make(chan ImportJob, len(records))
-	results := make(chan ImportResult, len(records))
-	var wg sync.WaitGroup
-
-	// Start workers
-	for w := 0; w < workerCount; w++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			for job := range jobs {
-				result := importRecordWithRetry(pbURL, pbCollection, job.Record, 3)
-				results <- result
-			}
-		}()
-	}
-
-	// Send jobs
-	for i, record := range records {
-		jobs <- ImportJob{Record: record, Index: i}
-	}
-	close(jobs)
-
-	// Wait and close results
-	go func() {
-		wg.Wait()
-		close(results)
-	}()
-
-	// Collect results
-	var firstError error
-	for result := range results {
-		if result.Skipped {
-			skipped++
-		} else if result.Success {
-			migrated++
-		} else {
-			failed++
-			if firstError == nil && result.Error != nil {
-				firstError = result.Error
-			}
-		}
-	}
-
-	// Progress display
-	elapsed := time.Since(startTime)
-	rate := float64(totalRead) / elapsed.Seconds()
-
-	var lastDate string
-	if len(records) > 0 {
-		if t, err := parseTimestamp(records[len(records)-1].CreatedAt); err == nil {
-			lastDate = t.Format("2006-01-02")
-		}
-	}
-
-	fmt.Printf("[Batch %d] Read: %d | Migrated: %d | Skipped: %d | Failed: %d | %.0f rec/s | Last: %s | Batch: %v\n",
-		batchNum, totalRead, migrated, skipped, failed, rate, lastDate, time.Since(batchStart).Round(time.Millisecond))
-
-	// Show first error for debugging
-	if firstError != nil && batchNum <= 3 {
-		fmt.Printf("         [ERROR] Sample error: %v\n", firstError)
-	}
-
-	return migrated, skipped, failed
-}
-
-// runSQLExport generates a SQL file for direct SQLite import (fastest method!)
-func runSQLExport(jsonFile, sqlOutput, tableName string) {
-	fmt.Println("=========================================================")
-	fmt.Println("        SQL Export Mode (Direct SQLite Import)")
-	fmt.Println("=========================================================")
-	fmt.Printf("JSON File:   %s\n", jsonFile)
-	fmt.Printf("SQL Output:  %s\n", sqlOutput)
-	fmt.Printf("Table:       %s\n", tableName)
-	fmt.Printf("Repo Source: %s\n", repoSource)
-	fmt.Println("---------------------------------------------------------")
-
-	// Open JSON file
-	file, err := os.Open(jsonFile)
-	if err != nil {
-		fmt.Printf("[ERROR] Cannot open JSON file: %v\n", err)
-		os.Exit(1)
-	}
-	defer file.Close()
-
-	// Get file size for progress
-	fileInfo, _ := file.Stat()
-	fileSize := fileInfo.Size()
-	fmt.Printf("[INFO] File size: %.2f GB\n", float64(fileSize)/(1024*1024*1024))
-
-	// Open SQL output file stream
-	sqlFile, err := os.Create(sqlOutput)
-	if err != nil {
-		fmt.Printf("[ERROR] Cannot create SQL file: %v\n", err)
-		os.Exit(1)
-	}
-	defer sqlFile.Close()
-
-	writer := bufio.NewWriterSize(sqlFile, 1*1024*1024) // 1MB buffer for faster feedback
-
-	// Write SQL header
-	writer.WriteString("-- Auto-generated SQL import for PocketBase\n")
-	writer.WriteString("-- Generated: " + time.Now().Format(time.RFC3339) + "\n")
-	writer.WriteString("PRAGMA journal_mode=WAL;\n")
-	writer.WriteString("PRAGMA synchronous=OFF;\n")
-	writer.WriteString("PRAGMA cache_size=100000;\n")
-	writer.WriteString("BEGIN TRANSACTION;\n\n")
-	writer.Flush() // Flush header immediately
-	fmt.Println("[INFO] SQL header written, starting record processing...")
-
-	startTime := time.Now()
-	var recordCount int64
-	var filteredCount int64
-	var skippedCount int64
-
-	// Create decoder directly from file (not buffered reader)
-	decoder := json.NewDecoder(file)
-	
-	// Read opening bracket of array
-	fmt.Println("[INFO] Reading JSON array...")
-	token, err := decoder.Token()
-	if err != nil {
-		fmt.Printf("[ERROR] Cannot read JSON: %v\n", err)
-		os.Exit(1)
-	}
-	if delim, ok := token.(json.Delim); !ok || delim != '[' {
-		fmt.Printf("[ERROR] Expected JSON array, got: %v\n", token)
-		os.Exit(1)
-	}
-	fmt.Println("[INFO] Found JSON array, starting decode...")
-
-	// Decode each element
-	for decoder.More() {
-		var mongoRecord MongoDataModel
-		if err := decoder.Decode(&mongoRecord); err != nil {
-			if err == io.EOF {
-				break
-			}
-			skippedCount++
-			// Log first few errors for debugging
-			if skippedCount <= 5 {
-				fmt.Printf("[WARN] Skipping malformed record #%d: %v\n", skippedCount, err)
-			}
-			continue
-		}
-
-		// Convert MongoDB format to normal format
-		record := OldDataModel{
-			ID:         parseMongoString(mongoRecord.ID),
-			CtType:     parseMongoInt(mongoRecord.CtType),
-			DiskSize:   parseMongoInt(mongoRecord.DiskSize),
-			CoreCount:  parseMongoInt(mongoRecord.CoreCount),
-			RamSize:    parseMongoInt(mongoRecord.RamSize),
-			OsType:     mongoRecord.OsType,
-			OsVersion:  mongoRecord.OsVersion,
-			DisableIP6: mongoRecord.DisableIP6,
-			NsApp:      mongoRecord.NsApp,
-			Method:     mongoRecord.Method,
-			CreatedAt:  parseMongoDate(mongoRecord.CreatedAt),
-			PveVersion: mongoRecord.PveVersion,
-			Status:     mongoRecord.Status,
-			RandomID:   mongoRecord.RandomID,
-			Type:       mongoRecord.Type,
-		}
-		if mongoRecord.Error != nil {
-			record.Error = *mongoRecord.Error
-		}
-
-		// Apply date filters
-		if hasDateFrom || hasDateUntil {
-			recordTime, err := parseTimestamp(record.CreatedAt)
-			if err == nil {
-				if hasDateFrom && recordTime.Before(dateFrom) {
-					filteredCount++
-					continue
-				}
-				if hasDateUntil && recordTime.After(dateUntil) {
-					filteredCount++
-					continue
-				}
-			}
-		}
-
-		// Generate unique ID for PocketBase
-		pbID := generatePocketBaseID()
-
-		// Normalize values
-		status := record.Status
-		if status == "done" {
-			status = "success"
-		}
-		if status == "" {
-			status = "unknown"
-		}
-
-		nsapp := record.NsApp
-		if nsapp == "" {
-			nsapp = "unknown"
-		}
-
-		recType := record.Type
-		if recType == "" {
-			recType = "lxc"
-		}
-
-		// Format created date
-		createdAt := record.CreatedAt
-		if createdAt == "" {
-			createdAt = time.Now().UTC().Format("2006-01-02 15:04:05.000Z")
-		}
-
-		// Escape strings for SQL
-		escapeSQLString := func(s string) string {
-			return strings.ReplaceAll(s, "'", "''")
-		}
-
-		// Write INSERT statement (disableip6 removed - column no longer exists)
-		sql := fmt.Sprintf(
-			"INSERT OR IGNORE INTO %s (id,created,updated,ct_type,disk_size,core_count,ram_size,os_type,os_version,nsapp,method,pve_version,status,random_id,type,error,repo_source) VALUES ('%s','%s','%s',%d,%d,%d,%d,'%s','%s','%s','%s','%s','%s','%s','%s','%s','%s');\n",
-			tableName,
-			pbID,
-			escapeSQLString(createdAt),
-			escapeSQLString(createdAt),
-			record.CtType,
-			record.DiskSize,
-			record.CoreCount,
-			record.RamSize,
-			escapeSQLString(record.OsType),
-			escapeSQLString(record.OsVersion),
-			escapeSQLString(nsapp),
-			escapeSQLString(record.Method),
-			escapeSQLString(record.PveVersion),
-			escapeSQLString(status),
-			escapeSQLString(record.RandomID),
-			escapeSQLString(recType),
-			escapeSQLString(record.Error),
-			escapeSQLString(repoSource),
-		)
-
-		writer.WriteString(sql)
-		recordCount++
-
-		// Progress every 10k records (and flush to show file growing)
-		if recordCount%10000 == 0 {
-			writer.Flush()
-			elapsed := time.Since(startTime)
-			rate := float64(recordCount) / elapsed.Seconds()
-			fmt.Printf("[PROGRESS] %d records processed (%.0f rec/s)\n", recordCount, rate)
-		}
-	}
-
-	// Write footer
-	writer.WriteString("\nCOMMIT;\n")
-	writer.Flush()
-
-	elapsed := time.Since(startTime)
-	rate := float64(recordCount) / elapsed.Seconds()
-
-	fmt.Println()
-	fmt.Println("=========================================================")
-	fmt.Println("        SQL Export Complete")
-	fmt.Println("=========================================================")
-	fmt.Printf("Records exported:    %d\n", recordCount)
-	fmt.Printf("Skipped (errors):    %d\n", skippedCount)
-	fmt.Printf("Filtered (date):     %d\n", filteredCount)
-	fmt.Printf("Duration:            %s\n", formatDuration(elapsed))
-	fmt.Printf("Speed:               %.0f records/sec\n", rate)
-	fmt.Printf("Output file:         %s\n", sqlOutput)
-	fmt.Println("---------------------------------------------------------")
-	fmt.Println()
-	fmt.Println("To import into PocketBase:")
-	fmt.Printf("  sqlite3 /app/pb_data/data.db < %s\n", sqlOutput)
-	fmt.Println()
-}
-
-// generatePocketBaseID generates a 15-char alphanumeric ID like PocketBase does
-func generatePocketBaseID() string {
-	const chars = "abcdefghijklmnopqrstuvwxyz0123456789"
-	b := make([]byte, 15)
-	// Use crypto/rand for randomness
-	randBytes := make([]byte, 15)
-	if _, err := io.ReadFull(cryptoRand.Reader, randBytes); err != nil {
-		// Fallback to time-based
-		for i := range b {
-			b[i] = chars[(time.Now().UnixNano()+int64(i))%int64(len(chars))]
-		}
-		return string(b)
-	}
-	for i := range b {
-		b[i] = chars[randBytes[i]%byte(len(chars))]
-	}
-	return string(b)
-}
diff --git a/misc/data/migration/migrate.sh b/misc/data/migration/migrate.sh
deleted file mode 100644
index 09d086cc..00000000
--- a/misc/data/migration/migrate.sh
+++ /dev/null
@@ -1,67 +0,0 @@
-#!/bin/bash
-# Migration script to import data from the old API to PocketBase
-# Usage: ./migrate.sh [POCKETBASE_URL] [COLLECTION_NAME]
-#
-# Examples:
-#   ./migrate.sh                                    # Uses defaults
-#   ./migrate.sh http://localhost:8090              # Custom PB URL
-#   ./migrate.sh http://localhost:8090 my_telemetry # Custom URL and collection
-
-set -e
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
-# Default values
-POCKETBASE_URL="${1:-http://localhost:8090}"
-POCKETBASE_COLLECTION="${2:-telemetry}"
-
-echo "============================================="
-echo "   ProxmoxVED Data Migration Tool"
-echo "============================================="
-echo ""
-echo "This script will migrate telemetry data from:"
-echo "  Source: https://api.htl-braunau.at/dev/data"
-echo "  Target: $POCKETBASE_URL"
-echo "  Collection: $POCKETBASE_COLLECTION"
-echo ""
-
-# Check if PocketBase is reachable
-echo "🔍 Checking PocketBase connection..."
-if ! curl -sf "$POCKETBASE_URL/api/health" >/dev/null 2>&1; then
-  echo "❌ Cannot reach PocketBase at $POCKETBASE_URL"
-  echo "   Make sure PocketBase is running and the URL is correct."
-  exit 1
-fi
-echo "✅ PocketBase is reachable"
-echo ""
-
-# Check source API
-echo "🔍 Checking source API..."
-SUMMARY=$(curl -sf "https://api.htl-braunau.at/dev/data/summary" 2>/dev/null || echo "")
-if [ -z "$SUMMARY" ]; then
-  echo "❌ Cannot reach source API"
-  exit 1
-fi
-
-TOTAL=$(echo "$SUMMARY" | grep -o '"total_entries":[0-9]*' | cut -d: -f2)
-echo "✅ Source API is reachable ($TOTAL entries available)"
-echo ""
-
-# Confirm migration
-read -p "⚠️  Do you want to start the migration? [y/N] " -n 1 -r
-echo ""
-if [[ ! $REPLY =~ ^[Yy]$ ]]; then
-  echo "Migration cancelled."
-  exit 0
-fi
-
-echo ""
-echo "Starting migration..."
-echo ""
-
-# Run the Go migration script
-cd "$SCRIPT_DIR"
-POCKETBASE_URL="$POCKETBASE_URL" POCKETBASE_COLLECTION="$POCKETBASE_COLLECTION" go run migrate.go
-
-echo ""
-echo "Migration complete!"
diff --git a/misc/data/migration/migration.go b/misc/data/migration/migration.go
deleted file mode 100644
index c75095e3..00000000
--- a/misc/data/migration/migration.go
+++ /dev/null
@@ -1,492 +0,0 @@
-// +build ignore
-
-// Migration script to import data from the old API to PocketBase
-// Run with: go run migrate.go
-package main
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"time"
-)
-
-const (
-	defaultSourceAPI = "https://api.htl-braunau.at/dev/data"
-	defaultPBURL     = "http://localhost:8090"
-	batchSize        = 100
-)
-
-var (
-	sourceAPI  string
-	summaryAPI string
-	authToken  string // PocketBase auth token
-)
-
-// OldDataModel represents the data structure from the old API
-type OldDataModel struct {
-	ID         string `json:"id"`
-	CtType     int    `json:"ct_type"`
-	DiskSize   int    `json:"disk_size"`
-	CoreCount  int    `json:"core_count"`
-	RamSize    int    `json:"ram_size"`
-	OsType     string `json:"os_type"`
-	OsVersion  string `json:"os_version"`
-	DisableIP6 string `json:"disableip6"`
-	NsApp      string `json:"nsapp"`
-	Method     string `json:"method"`
-	CreatedAt  string `json:"created_at"`
-	PveVersion string `json:"pve_version"`
-	Status     string `json:"status"`
-	RandomID   string `json:"random_id"`
-	Type       string `json:"type"`
-	Error      string `json:"error"`
-}
-
-// PBRecord represents the PocketBase record format
-type PBRecord struct {
-	CtType     int    `json:"ct_type"`
-	DiskSize   int    `json:"disk_size"`
-	CoreCount  int    `json:"core_count"`
-	RamSize    int    `json:"ram_size"`
-	OsType     string `json:"os_type"`
-	OsVersion  string `json:"os_version"`
-	DisableIP6 string `json:"disableip6"`
-	NsApp      string `json:"nsapp"`
-	Method     string `json:"method"`
-	PveVersion string `json:"pve_version"`
-	Status     string `json:"status"`
-	RandomID   string `json:"random_id"`
-	Type       string `json:"type"`
-	Error      string `json:"error"`
-	// Temporary field for timestamp migration (PocketBase doesn't allow setting created/updated via API)
-	// After migration, run SQL: UPDATE installations SET created = old_created, updated = old_created
-	OldCreated string `json:"old_created,omitempty"`
-}
-
-type Summary struct {
-	TotalEntries int `json:"total_entries"`
-}
-
-func main() {
-	// Setup source URLs
-	baseURL := os.Getenv("MIGRATION_SOURCE_URL")
-	if baseURL == "" {
-		baseURL = defaultSourceAPI
-	}
-	sourceAPI = baseURL + "/paginated"
-	summaryAPI = baseURL + "/summary"
-
-	// Support both POCKETBASE_URL and PB_URL (Coolify uses PB_URL)
-	pbURL := os.Getenv("POCKETBASE_URL")
-	if pbURL == "" {
-		pbURL = os.Getenv("PB_URL")
-	}
-	if pbURL == "" {
-		pbURL = defaultPBURL
-	}
-
-	// Support both POCKETBASE_COLLECTION and PB_TARGET_COLLECTION
-	pbCollection := os.Getenv("POCKETBASE_COLLECTION")
-	if pbCollection == "" {
-		pbCollection = os.Getenv("PB_TARGET_COLLECTION")
-	}
-	if pbCollection == "" {
-		pbCollection = "telemetry"
-	}
-
-	// Auth collection
-	authCollection := os.Getenv("PB_AUTH_COLLECTION")
-	if authCollection == "" {
-		authCollection = "telemetry_service_user"
-	}
-
-	// Credentials - prefer admin auth for timestamp preservation
-	pbAdminEmail := os.Getenv("PB_ADMIN_EMAIL")
-	pbAdminPassword := os.Getenv("PB_ADMIN_PASSWORD")
-	pbIdentity := os.Getenv("PB_IDENTITY")
-	pbPassword := os.Getenv("PB_PASSWORD")
-
-	fmt.Println("===========================================")
-	fmt.Println("   Data Migration to PocketBase")
-	fmt.Println("===========================================")
-	fmt.Printf("Source API:       %s\n", baseURL)
-	fmt.Printf("PocketBase URL:   %s\n", pbURL)
-	fmt.Printf("Collection:       %s\n", pbCollection)
-	fmt.Println("-------------------------------------------")
-
-	// Authenticate with PocketBase - prefer Admin auth for timestamp support
-	if pbAdminEmail != "" && pbAdminPassword != "" {
-		fmt.Println("🔐 Authenticating as PocketBase Admin...")
-		err := authenticateAdmin(pbURL, pbAdminEmail, pbAdminPassword)
-		if err != nil {
-			fmt.Printf("❌ Admin authentication failed: %v\n", err)
-			os.Exit(1)
-		}
-		fmt.Println("✅ Admin authentication successful (timestamps will be preserved)")
-	} else if pbIdentity != "" && pbPassword != "" {
-		fmt.Println("🔐 Authenticating with PocketBase (collection auth)...")
-		fmt.Println("⚠️  Note: Timestamps may not be preserved without admin auth")
-		err := authenticate(pbURL, authCollection, pbIdentity, pbPassword)
-		if err != nil {
-			fmt.Printf("❌ Authentication failed: %v\n", err)
-			os.Exit(1)
-		}
-		fmt.Println("✅ Authentication successful")
-	} else {
-		fmt.Println("⚠️  No credentials provided, trying without auth...")
-	}
-	fmt.Println("-------------------------------------------")
-
-	// Get total count
-	summary, err := getSummary()
-	if err != nil {
-		fmt.Printf("❌ Failed to get summary: %v\n", err)
-		os.Exit(1)
-	}
-	fmt.Printf("📊 Total entries to migrate: %d\n", summary.TotalEntries)
-	fmt.Println("-------------------------------------------")
-
-	// Calculate pages
-	totalPages := (summary.TotalEntries + batchSize - 1) / batchSize
-
-	var totalMigrated, totalFailed, totalSkipped int
-
-	for page := 1; page <= totalPages; page++ {
-		fmt.Printf("📦 Fetching page %d/%d (items %d-%d)...\n",
-			page, totalPages,
-			(page-1)*batchSize+1,
-			min(page*batchSize, summary.TotalEntries))
-
-		data, err := fetchPage(page, batchSize)
-		if err != nil {
-			fmt.Printf("   ❌ Failed to fetch page %d: %v\n", page, err)
-			totalFailed += batchSize
-			continue
-		}
-
-		for i, record := range data {
-			err := importRecord(pbURL, pbCollection, record)
-			if err != nil {
-				if isUniqueViolation(err) {
-					totalSkipped++
-					continue
-				}
-				fmt.Printf("   ❌ Failed to import record %d: %v\n", (page-1)*batchSize+i+1, err)
-				totalFailed++
-				continue
-			}
-			totalMigrated++
-		}
-
-		fmt.Printf("   ✅ Page %d complete (migrated: %d, skipped: %d, failed: %d)\n",
-			page, len(data), totalSkipped, totalFailed)
-
-		// Small delay to avoid overwhelming the server
-		time.Sleep(100 * time.Millisecond)
-	}
-
-	fmt.Println("===========================================")
-	fmt.Println("   Migration Complete")
-	fmt.Println("===========================================")
-	fmt.Printf("✅ Successfully migrated: %d\n", totalMigrated)
-	fmt.Printf("⏭️  Skipped (duplicates):  %d\n", totalSkipped)
-	fmt.Printf("❌ Failed:                 %d\n", totalFailed)
-	fmt.Println("===========================================")
-}
-
-func getSummary() (*Summary, error) {
-	resp, err := http.Get(summaryAPI)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	var summary Summary
-	if err := json.NewDecoder(resp.Body).Decode(&summary); err != nil {
-		return nil, err
-	}
-
-	return &summary, nil
-}
-
-// authenticateAdmin authenticates as PocketBase admin (required for setting timestamps)
-func authenticateAdmin(pbURL, email, password string) error {
-	body := map[string]string{
-		"identity": email,
-		"password": password,
-	}
-	jsonData, _ := json.Marshal(body)
-
-	// Try new PocketBase v0.23+ endpoint first (_superusers collection)
-	endpoints := []string{
-		fmt.Sprintf("%s/api/collections/_superusers/auth-with-password", pbURL),
-		fmt.Sprintf("%s/api/admins/auth-with-password", pbURL), // Legacy endpoint
-	}
-
-	client := &http.Client{Timeout: 10 * time.Second}
-	var lastErr error
-
-	for _, url := range endpoints {
-		req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
-		if err != nil {
-			lastErr = err
-			continue
-		}
-		req.Header.Set("Content-Type", "application/json")
-
-		resp, err := client.Do(req)
-		if err != nil {
-			lastErr = err
-			continue
-		}
-
-		if resp.StatusCode == 404 {
-			resp.Body.Close()
-			continue // Try next endpoint
-		}
-
-		if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-			body, _ := io.ReadAll(resp.Body)
-			resp.Body.Close()
-			lastErr = fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
-			continue
-		}
-
-		var result struct {
-			Token string `json:"token"`
-		}
-		if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-			resp.Body.Close()
-			lastErr = err
-			continue
-		}
-		resp.Body.Close()
-
-		if result.Token == "" {
-			lastErr = fmt.Errorf("no token in response")
-			continue
-		}
-
-		authToken = result.Token
-		return nil
-	}
-
-	return fmt.Errorf("all auth endpoints failed: %v", lastErr)
-}
-
-func authenticate(pbURL, authCollection, identity, password string) error {
-	body := map[string]string{
-		"identity": identity,
-		"password": password,
-	}
-	jsonData, _ := json.Marshal(body)
-
-	url := fmt.Sprintf("%s/api/collections/%s/auth-with-password", pbURL, authCollection)
-	req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/json")
-
-	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		body, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
-	}
-
-	var result struct {
-		Token string `json:"token"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return err
-	}
-	if result.Token == "" {
-		return fmt.Errorf("no token in response")
-	}
-
-	authToken = result.Token
-	return nil
-}
-
-func fetchPage(page, limit int) ([]OldDataModel, error) {
-	url := fmt.Sprintf("%s?page=%d&limit=%d", sourceAPI, page, limit)
-
-	resp, err := http.Get(url)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		return nil, fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
-	}
-
-	var data []OldDataModel
-	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
-		return nil, err
-	}
-
-	return data, nil
-}
-
-func importRecord(pbURL, collection string, old OldDataModel) error {
-	// Map status: "done" -> "success"
-	status := old.Status
-	switch status {
-	case "done":
-		status = "success"
-	case "installing", "failed", "unknown", "success":
-		// keep as-is
-	default:
-		status = "unknown"
-	}
-
-	// ct_type: 1=unprivileged, 2=privileged in old data
-	// PocketBase might expect 0/1, so normalize to 0 (unprivileged) or 1 (privileged)
-	ctType := old.CtType
-	if ctType <= 1 {
-		ctType = 0 // unprivileged (default)
-	} else {
-		ctType = 1 // privileged/VM
-	}
-
-	// Ensure type is set
-	recordType := old.Type
-	if recordType == "" {
-		recordType = "lxc"
-	}
-
-	// Ensure nsapp is set (required field)
-	nsapp := old.NsApp
-	if nsapp == "" {
-		nsapp = "unknown"
-	}
-
-	record := PBRecord{
-		CtType:     ctType,
-		DiskSize:   old.DiskSize,
-		CoreCount:  old.CoreCount,
-		RamSize:    old.RamSize,
-		OsType:     old.OsType,
-		OsVersion:  old.OsVersion,
-		DisableIP6: old.DisableIP6,
-		NsApp:      nsapp,
-		Method:     old.Method,
-		PveVersion: old.PveVersion,
-		Status:     status,
-		RandomID:   old.RandomID,
-		Type:       recordType,
-		Error:      old.Error,
-		OldCreated: convertTimestamp(old.CreatedAt),
-	}
-
-	jsonData, err := json.Marshal(record)
-	if err != nil {
-		return err
-	}
-
-	url := fmt.Sprintf("%s/api/collections/%s/records", pbURL, collection)
-	req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/json")
-	if authToken != "" {
-		req.Header.Set("Authorization", "Bearer "+authToken)
-	}
-
-	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
-		body, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
-	}
-
-	return nil
-}
-
-func isUniqueViolation(err error) bool {
-	if err == nil {
-		return false
-	}
-	errStr := err.Error()
-	return contains(errStr, "UNIQUE constraint failed") ||
-		contains(errStr, "duplicate") ||
-		contains(errStr, "already exists") ||
-		contains(errStr, "validation_not_unique")
-}
-
-func contains(s, substr string) bool {
-	return len(s) >= len(substr) && (s == substr || len(s) > 0 && containsHelper(s, substr))
-}
-
-func containsHelper(s, substr string) bool {
-	for i := 0; i <= len(s)-len(substr); i++ {
-		if s[i:i+len(substr)] == substr {
-			return true
-		}
-	}
-	return false
-}
-
-func min(a, b int) int {
-	if a < b {
-		return a
-	}
-	return b
-}
-
-// convertTimestamp converts various timestamp formats to PocketBase format
-// PocketBase expects: "2006-01-02 15:04:05.000Z" or similar
-func convertTimestamp(ts string) string {
-	if ts == "" {
-		return ""
-	}
-
-	// Try parsing various formats
-	formats := []string{
-		time.RFC3339,                    // "2006-01-02T15:04:05Z07:00"
-		time.RFC3339Nano,                // "2006-01-02T15:04:05.999999999Z07:00"
-		"2006-01-02T15:04:05.000Z",      // ISO with milliseconds
-		"2006-01-02T15:04:05Z",          // ISO without milliseconds
-		"2006-01-02T15:04:05",           // ISO without timezone
-		"2006-01-02 15:04:05",           // SQL format
-		"2006-01-02 15:04:05.000",       // SQL with ms
-		"2006-01-02 15:04:05.000 UTC",   // SQL with UTC
-		"2006-01-02T15:04:05.000+00:00", // ISO with offset
-	}
-
-	var parsed time.Time
-	var err error
-	for _, format := range formats {
-		parsed, err = time.Parse(format, ts)
-		if err == nil {
-			break
-		}
-	}
-
-	if err != nil {
-		// If all parsing fails, return empty (PocketBase will set current time)
-		fmt.Printf("   ⚠️  Could not parse timestamp: %s\n", ts)
-		return ""
-	}
-
-	// Return in PocketBase format (UTC)
-	return parsed.UTC().Format("2006-01-02 15:04:05.000Z")
-}
diff --git a/misc/data/service.go b/misc/data/service.go
deleted file mode 100644
index 3e3e8366..00000000
--- a/misc/data/service.go
+++ /dev/null
@@ -1,1261 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"log"
-	"net"
-	"net/http"
-	"os"
-	"strings"
-	"sync"
-	"time"
-)
-
-type Config struct {
-	ListenAddr         string
-	TrustedProxiesCIDR []string
-
-	// PocketBase
-	PBBaseURL        string
-	PBAuthCollection string // PB auth collection name (from env)
-	PBIdentity       string // email
-	PBPassword       string
-	PBTargetColl     string // PB data collection name (from env)
-
-	// Limits
-	MaxBodyBytes     int64
-	RateLimitRPM     int           // requests per minute per key
-	RateBurst        int           // burst tokens
-	RateKeyMode      string        // "ip" or "header"
-	RateKeyHeader    string        // e.g. "X-Telemetry-Key"
-	RequestTimeout   time.Duration // upstream timeout
-	EnableReqLogging bool          // default false (GDPR-friendly)
-
-	// Cache
-	RedisURL       string
-	EnableRedis    bool
-	CacheTTL       time.Duration
-	CacheEnabled   bool
-
-	// Alerts (SMTP)
-	AlertEnabled          bool
-	SMTPHost              string
-	SMTPPort              int
-	SMTPUser              string
-	SMTPPassword          string
-	SMTPFrom              string
-	SMTPTo                []string
-	SMTPUseTLS            bool
-	AlertFailureThreshold float64
-	AlertCheckInterval    time.Duration
-	AlertCooldown         time.Duration
-}
-
-// TelemetryIn matches payload from api.func (bash client)
-type TelemetryIn struct {
-	// Required
-	RandomID string `json:"random_id"`         // Session UUID
-	Type     string `json:"type"`              // "lxc", "vm", "tool", "addon"
-	NSAPP    string `json:"nsapp"`             // Application name (e.g., "jellyfin")
-	Status   string `json:"status"`            // "installing", "success", "failed", "unknown"
-
-	// Container/VM specs
-	CTType    int `json:"ct_type,omitempty"`    // 1=unprivileged, 2=privileged/VM
-	DiskSize  int `json:"disk_size,omitempty"`  // GB
-	CoreCount int `json:"core_count,omitempty"` // CPU cores
-	RAMSize   int `json:"ram_size,omitempty"`   // MB
-
-	// System info
-	OsType    string `json:"os_type,omitempty"`    // "debian", "ubuntu", "alpine", etc.
-	OsVersion string `json:"os_version,omitempty"` // "12", "24.04", etc.
-	PveVer    string `json:"pve_version,omitempty"`
-
-	// Optional
-	Method   string `json:"method,omitempty"`    // "default", "advanced"
-	Error    string `json:"error,omitempty"`     // Error description (max 120 chars)
-	ExitCode int    `json:"exit_code,omitempty"` // 0-255
-
-	// === EXTENDED FIELDS ===
-
-	// GPU Passthrough stats
-	GPUVendor       string `json:"gpu_vendor,omitempty"`       // "intel", "amd", "nvidia"
-	GPUModel        string `json:"gpu_model,omitempty"`        // e.g., "Intel Arc Graphics"
-	GPUPassthrough  string `json:"gpu_passthrough,omitempty"`  // "igpu", "dgpu", "vgpu", "none"
-
-	// CPU stats
-	CPUVendor string `json:"cpu_vendor,omitempty"` // "intel", "amd", "arm"
-	CPUModel  string `json:"cpu_model,omitempty"`  // e.g., "Intel Core Ultra 7 155H"
-
-	// RAM stats
-	RAMSpeed string `json:"ram_speed,omitempty"` // e.g., "4800" (MT/s)
-
-	// Performance metrics
-	InstallDuration int `json:"install_duration,omitempty"` // Seconds
-
-	// Error categorization
-	ErrorCategory string `json:"error_category,omitempty"` // "network", "storage", "dependency", "permission", "timeout", "unknown"
-
-	// Repository source for collection routing
-	RepoSource string `json:"repo_source,omitempty"` // "ProxmoxVE", "ProxmoxVED", or "external"
-}
-
-// TelemetryOut is sent to PocketBase (matches telemetry collection)
-type TelemetryOut struct {
-	RandomID  string `json:"random_id"`
-	Type      string `json:"type"`
-	NSAPP     string `json:"nsapp"`
-	Status    string `json:"status"`
-	CTType    int    `json:"ct_type,omitempty"`
-	DiskSize  int    `json:"disk_size,omitempty"`
-	CoreCount int    `json:"core_count,omitempty"`
-	RAMSize   int    `json:"ram_size,omitempty"`
-	OsType    string `json:"os_type,omitempty"`
-	OsVersion string `json:"os_version,omitempty"`
-	PveVer    string `json:"pve_version,omitempty"`
-	Method    string `json:"method,omitempty"`
-	Error     string `json:"error,omitempty"`
-	ExitCode  int    `json:"exit_code,omitempty"`
-
-	// Extended fields
-	GPUVendor       string `json:"gpu_vendor,omitempty"`
-	GPUModel        string `json:"gpu_model,omitempty"`
-	GPUPassthrough  string `json:"gpu_passthrough,omitempty"`
-	CPUVendor       string `json:"cpu_vendor,omitempty"`
-	CPUModel        string `json:"cpu_model,omitempty"`
-	RAMSpeed        string `json:"ram_speed,omitempty"`
-	InstallDuration int    `json:"install_duration,omitempty"`
-	ErrorCategory   string `json:"error_category,omitempty"`
-
-	// Repository source: "ProxmoxVE", "ProxmoxVED", or "external"
-	RepoSource string `json:"repo_source,omitempty"`
-}
-
-// TelemetryStatusUpdate contains only fields needed for status updates
-type TelemetryStatusUpdate struct {
-	Status          string `json:"status"`
-	Error           string `json:"error,omitempty"`
-	ExitCode        int    `json:"exit_code"`
-	InstallDuration int    `json:"install_duration,omitempty"`
-	ErrorCategory   string `json:"error_category,omitempty"`
-	GPUVendor       string `json:"gpu_vendor,omitempty"`
-	GPUModel        string `json:"gpu_model,omitempty"`
-	GPUPassthrough  string `json:"gpu_passthrough,omitempty"`
-	CPUVendor       string `json:"cpu_vendor,omitempty"`
-	CPUModel        string `json:"cpu_model,omitempty"`
-	RAMSpeed        string `json:"ram_speed,omitempty"`
-}
-
-// Allowed values for 'repo_source' field
-var allowedRepoSource = map[string]bool{
-	"ProxmoxVE":  true,
-	"ProxmoxVED": true,
-	"external":   true,
-}
-
-type PBClient struct {
-	baseURL        string
-	authCollection string
-	identity       string
-	password       string
-	targetColl     string // single collection for all telemetry data
-
-	mu    sync.Mutex
-	token string
-	exp   time.Time
-	http  *http.Client
-}
-
-func NewPBClient(cfg Config) *PBClient {
-	return &PBClient{
-		baseURL:        strings.TrimRight(cfg.PBBaseURL, "/"),
-		authCollection: cfg.PBAuthCollection,
-		identity:       cfg.PBIdentity,
-		password:       cfg.PBPassword,
-		targetColl:     cfg.PBTargetColl,
-		http: &http.Client{
-			Timeout: cfg.RequestTimeout,
-		},
-	}
-}
-
-func (p *PBClient) ensureAuth(ctx context.Context) error {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	// refresh if token missing or expiring soon
-	if p.token != "" && time.Until(p.exp) > 60*time.Second {
-		return nil
-	}
-
-	body := map[string]string{
-		"identity": p.identity,
-		"password": p.password,
-	}
-	b, _ := json.Marshal(body)
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost,
-		fmt.Sprintf("%s/api/collections/%s/auth-with-password", p.baseURL, p.authCollection),
-		bytes.NewReader(b),
-	)
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/json")
-
-	resp, err := p.http.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		rb, _ := io.ReadAll(io.LimitReader(resp.Body, 4<<10))
-		return fmt.Errorf("pocketbase auth failed: %s: %s", resp.Status, strings.TrimSpace(string(rb)))
-	}
-
-	var out struct {
-		Token string `json:"token"`
-		// record omitted
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
-		return err
-	}
-	if out.Token == "" {
-		return errors.New("pocketbase auth token missing")
-	}
-
-	// PocketBase JWT exp can be parsed, but keep it simple: set 50 min
-	p.token = out.Token
-	p.exp = time.Now().Add(50 * time.Minute)
-	return nil
-}
-
-// FindRecordByRandomID searches for an existing record by random_id
-func (p *PBClient) FindRecordByRandomID(ctx context.Context, randomID string) (string, error) {
-	if err := p.ensureAuth(ctx); err != nil {
-		return "", err
-	}
-
-	// URL encode the filter
-	filter := fmt.Sprintf("random_id='%s'", randomID)
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet,
-		fmt.Sprintf("%s/api/collections/%s/records?filter=%s&fields=id&perPage=1",
-			p.baseURL, p.targetColl, filter),
-		nil,
-	)
-	if err != nil {
-		return "", err
-	}
-	req.Header.Set("Authorization", "Bearer "+p.token)
-
-	resp, err := p.http.Do(req)
-	if err != nil {
-		return "", err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		return "", fmt.Errorf("pocketbase search failed: %s", resp.Status)
-	}
-
-	var result struct {
-		Items []struct {
-			ID string `json:"id"`
-		} `json:"items"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return "", err
-	}
-
-	if len(result.Items) == 0 {
-		return "", nil // Not found
-	}
-	return result.Items[0].ID, nil
-}
-
-// UpdateTelemetryStatus updates only status, error, and exit_code of an existing record
-func (p *PBClient) UpdateTelemetryStatus(ctx context.Context, recordID string, update TelemetryStatusUpdate) error {
-	if err := p.ensureAuth(ctx); err != nil {
-		return err
-	}
-
-	b, _ := json.Marshal(update)
-	req, err := http.NewRequestWithContext(ctx, http.MethodPatch,
-		fmt.Sprintf("%s/api/collections/%s/records/%s", p.baseURL, p.targetColl, recordID),
-		bytes.NewReader(b),
-	)
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Authorization", "Bearer "+p.token)
-
-	resp, err := p.http.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		rb, _ := io.ReadAll(io.LimitReader(resp.Body, 8<<10))
-		return fmt.Errorf("pocketbase update failed: %s: %s", resp.Status, strings.TrimSpace(string(rb)))
-	}
-	return nil
-}
-
-// FetchRecordsPaginated retrieves records with pagination and optional filters.
-func (p *PBClient) FetchRecordsPaginated(ctx context.Context, page, limit int, status, app, osType, typeFilter, sortField, repoSource string) ([]TelemetryRecord, int, error) {
-	if err := p.ensureAuth(ctx); err != nil {
-		return nil, 0, err
-	}
-
-	// Build filter
-	var filters []string
-	if status != "" {
-		filters = append(filters, fmt.Sprintf("status='%s'", status))
-	}
-	if app != "" {
-		filters = append(filters, fmt.Sprintf("nsapp~'%s'", app))
-	}
-	if osType != "" {
-		filters = append(filters, fmt.Sprintf("os_type='%s'", osType))
-	}
-	if typeFilter != "" {
-		filters = append(filters, fmt.Sprintf("type='%s'", typeFilter))
-	}
-	if repoSource != "" {
-		filters = append(filters, fmt.Sprintf("repo_source='%s'", repoSource))
-	}
-
-	filterStr := ""
-	if len(filters) > 0 {
-		filterStr = "&filter=" + strings.Join(filters, "&&")
-	}
-
-	// Handle sort parameter (default: -created)
-	sort := "-created"
-	if sortField != "" {
-		// Validate sort field to prevent injection
-		allowedFields := map[string]bool{
-			"created": true, "-created": true,
-			"nsapp": true, "-nsapp": true,
-			"status": true, "-status": true,
-			"os_type": true, "-os_type": true,
-			"type": true, "-type": true,
-			"method": true, "-method": true,
-			"exit_code": true, "-exit_code": true,
-		}
-		if allowedFields[sortField] {
-			sort = sortField
-		}
-	}
-
-	reqURL := fmt.Sprintf("%s/api/collections/%s/records?sort=%s&page=%d&perPage=%d%s",
-		p.baseURL, p.targetColl, sort, page, limit, filterStr)
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, reqURL, nil)
-	if err != nil {
-		return nil, 0, err
-	}
-	req.Header.Set("Authorization", "Bearer "+p.token)
-
-	resp, err := p.http.Do(req)
-	if err != nil {
-		return nil, 0, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		return nil, 0, fmt.Errorf("pocketbase fetch failed: %s", resp.Status)
-	}
-
-	var result struct {
-		Items      []TelemetryRecord `json:"items"`
-		TotalItems int               `json:"totalItems"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return nil, 0, err
-	}
-
-	return result.Items, result.TotalItems, nil
-}
-
-// UpsertTelemetry handles both creation and updates intelligently.
-// All records go to the same collection; repo_source is stored as a field.
-//
-// For status="installing": always creates a new record.
-// For status!="installing": updates existing record (found by random_id).
-func (p *PBClient) UpsertTelemetry(ctx context.Context, payload TelemetryOut) error {
-	// For "installing" status, always create new record
-	if payload.Status == "installing" {
-		return p.CreateTelemetry(ctx, payload)
-	}
-
-	// For status updates (success/failed/unknown), find and update existing record
-	recordID, err := p.FindRecordByRandomID(ctx, payload.RandomID)
-	if err != nil {
-		// Search failed, log and return error
-		return fmt.Errorf("cannot find record to update: %w", err)
-	}
-
-	if recordID == "" {
-		// Record not found - this shouldn't happen normally
-		// Create a full record as fallback
-		return p.CreateTelemetry(ctx, payload)
-	}
-
-	// Update only status, error, exit_code, and new metrics fields
-	update := TelemetryStatusUpdate{
-		Status:          payload.Status,
-		Error:           payload.Error,
-		ExitCode:        payload.ExitCode,
-		InstallDuration: payload.InstallDuration,
-		ErrorCategory:   payload.ErrorCategory,
-		GPUVendor:       payload.GPUVendor,
-		GPUModel:        payload.GPUModel,
-		GPUPassthrough:  payload.GPUPassthrough,
-		CPUVendor:       payload.CPUVendor,
-		CPUModel:        payload.CPUModel,
-		RAMSpeed:        payload.RAMSpeed,
-	}
-	return p.UpdateTelemetryStatus(ctx, recordID, update)
-}
-
-func (p *PBClient) CreateTelemetry(ctx context.Context, payload TelemetryOut) error {
-	if err := p.ensureAuth(ctx); err != nil {
-		return err
-	}
-
-	b, _ := json.Marshal(payload)
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost,
-		fmt.Sprintf("%s/api/collections/%s/records", p.baseURL, p.targetColl),
-		bytes.NewReader(b),
-	)
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Authorization", "Bearer "+p.token)
-
-	resp, err := p.http.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		rb, _ := io.ReadAll(io.LimitReader(resp.Body, 8<<10))
-		return fmt.Errorf("pocketbase create failed: %s: %s", resp.Status, strings.TrimSpace(string(rb)))
-	}
-	return nil
-}
-
-// -------- Rate limiter (token bucket / minute window, simple) --------
-
-type bucket struct {
-	tokens int
-	reset  time.Time
-}
-
-type RateLimiter struct {
-	mu       sync.Mutex
-	buckets  map[string]*bucket
-	rpm      int
-	burst    int
-	window   time.Duration
-	cleanInt time.Duration
-}
-
-func NewRateLimiter(rpm, burst int) *RateLimiter {
-	rl := &RateLimiter{
-		buckets:  make(map[string]*bucket),
-		rpm:      rpm,
-		burst:    burst,
-		window:   time.Minute,
-		cleanInt: 5 * time.Minute,
-	}
-	go rl.cleanupLoop()
-	return rl
-}
-
-func (r *RateLimiter) cleanupLoop() {
-	t := time.NewTicker(r.cleanInt)
-	defer t.Stop()
-	for range t.C {
-		now := time.Now()
-		r.mu.Lock()
-		for k, b := range r.buckets {
-			if now.After(b.reset.Add(2 * r.window)) {
-				delete(r.buckets, k)
-			}
-		}
-		r.mu.Unlock()
-	}
-}
-
-func (r *RateLimiter) Allow(key string) bool {
-	if r.rpm <= 0 {
-		return true
-	}
-	now := time.Now()
-	r.mu.Lock()
-	defer r.mu.Unlock()
-
-	b, ok := r.buckets[key]
-	if !ok || now.After(b.reset) {
-		r.buckets[key] = &bucket{tokens: min(r.burst, r.rpm), reset: now.Add(r.window)}
-		b = r.buckets[key]
-	}
-	if b.tokens <= 0 {
-		return false
-	}
-	b.tokens--
-	return true
-}
-
-func min(a, b int) int {
-	if a < b {
-		return a
-	}
-	return b
-}
-
-// -------- Utility: GDPR-safe key extraction --------
-
-type ProxyTrust struct {
-	nets []*net.IPNet
-}
-
-func NewProxyTrust(cidrs []string) (*ProxyTrust, error) {
-	var nets []*net.IPNet
-	for _, c := range cidrs {
-		_, n, err := net.ParseCIDR(strings.TrimSpace(c))
-		if err != nil {
-			return nil, err
-		}
-		nets = append(nets, n)
-	}
-	return &ProxyTrust{nets: nets}, nil
-}
-
-func (pt *ProxyTrust) isTrusted(ip net.IP) bool {
-	for _, n := range pt.nets {
-		if n.Contains(ip) {
-			return true
-		}
-	}
-	return false
-}
-
-func getClientIP(r *http.Request, pt *ProxyTrust) net.IP {
-	// If behind reverse proxy, trust X-Forwarded-For only if remote is trusted proxy.
-	host, _, _ := net.SplitHostPort(r.RemoteAddr)
-	remote := net.ParseIP(host)
-	if remote == nil {
-		return nil
-	}
-
-	if pt != nil && pt.isTrusted(remote) {
-		xff := r.Header.Get("X-Forwarded-For")
-		if xff != "" {
-			parts := strings.Split(xff, ",")
-			ip := net.ParseIP(strings.TrimSpace(parts[0]))
-			if ip != nil {
-				return ip
-			}
-		}
-	}
-	return remote
-}
-
-// -------- Validation (strict allowlist) --------
-
-var (
-	// Allowed values for 'type' field
-	allowedType = map[string]bool{"lxc": true, "vm": true, "tool": true, "addon": true}
-
-	// Allowed values for 'status' field
-	allowedStatus = map[string]bool{"installing": true, "success": true, "failed": true, "unknown": true}
-
-	// Allowed values for 'os_type' field
-	allowedOsType = map[string]bool{
-		"debian": true, "ubuntu": true, "alpine": true, "devuan": true,
-		"fedora": true, "rocky": true, "alma": true, "centos": true,
-		"opensuse": true, "gentoo": true, "openeuler": true,
-	}
-
-	// Allowed values for 'gpu_vendor' field
-	allowedGPUVendor = map[string]bool{"intel": true, "amd": true, "nvidia": true, "unknown": true, "": true}
-
-	// Allowed values for 'gpu_passthrough' field
-	allowedGPUPassthrough = map[string]bool{"igpu": true, "dgpu": true, "vgpu": true, "none": true, "unknown": true, "": true}
-
-	// Allowed values for 'cpu_vendor' field
-	allowedCPUVendor = map[string]bool{"intel": true, "amd": true, "arm": true, "apple": true, "qualcomm": true, "unknown": true, "": true}
-
-	// Allowed values for 'error_category' field
-	allowedErrorCategory = map[string]bool{
-		"network": true, "storage": true, "dependency": true, "permission": true,
-		"timeout": true, "config": true, "resource": true, "unknown": true, "": true,
-	}
-)
-
-func sanitizeShort(s string, max int) string {
-	s = strings.TrimSpace(s)
-	if s == "" {
-		return ""
-	}
-	// remove line breaks and high-risk chars
-	s = strings.ReplaceAll(s, "\n", " ")
-	s = strings.ReplaceAll(s, "\r", " ")
-	if len(s) > max {
-		s = s[:max]
-	}
-	return s
-}
-
-func validate(in *TelemetryIn) error {
-	// Sanitize all string fields
-	in.RandomID = sanitizeShort(in.RandomID, 64)
-	in.Type = sanitizeShort(in.Type, 8)
-	in.NSAPP = sanitizeShort(in.NSAPP, 64)
-	in.Status = sanitizeShort(in.Status, 16)
-	in.OsType = sanitizeShort(in.OsType, 32)
-	in.OsVersion = sanitizeShort(in.OsVersion, 32)
-	in.PveVer = sanitizeShort(in.PveVer, 32)
-	in.Method = sanitizeShort(in.Method, 32)
-
-	// Sanitize extended fields
-	in.GPUVendor = strings.ToLower(sanitizeShort(in.GPUVendor, 16))
-	in.GPUModel = sanitizeShort(in.GPUModel, 64)
-	in.GPUPassthrough = strings.ToLower(sanitizeShort(in.GPUPassthrough, 16))
-	in.CPUVendor = strings.ToLower(sanitizeShort(in.CPUVendor, 16))
-	in.CPUModel = sanitizeShort(in.CPUModel, 64)
-	in.RAMSpeed = sanitizeShort(in.RAMSpeed, 16)
-	in.ErrorCategory = strings.ToLower(sanitizeShort(in.ErrorCategory, 32))
-
-	// Sanitize repo_source (routing field)
-	in.RepoSource = sanitizeShort(in.RepoSource, 64)
-
-	// Default empty values to "unknown" for consistency
-	if in.GPUVendor == "" {
-		in.GPUVendor = "unknown"
-	}
-	if in.GPUPassthrough == "" {
-		in.GPUPassthrough = "unknown"
-	}
-	if in.CPUVendor == "" {
-		in.CPUVendor = "unknown"
-	}
-
-	// IMPORTANT: "error" must be short and not contain identifiers/logs
-	in.Error = sanitizeShort(in.Error, 120)
-
-	// Required fields for all requests
-	if in.RandomID == "" || in.Type == "" || in.NSAPP == "" || in.Status == "" {
-		return errors.New("missing required fields: random_id, type, nsapp, status")
-	}
-
-	// Normalize common typos for backwards compatibility
-	if in.Status == "sucess" {
-		in.Status = "success"
-	}
-
-	// Validate enums
-	if !allowedType[in.Type] {
-		return errors.New("invalid type (must be 'lxc', 'vm', 'tool', or 'addon')")
-	}
-	if !allowedStatus[in.Status] {
-		return errors.New("invalid status")
-	}
-
-	// Validate new enum fields
-	if !allowedGPUVendor[in.GPUVendor] {
-		return errors.New("invalid gpu_vendor (must be 'intel', 'amd', 'nvidia', 'unknown')")
-	}
-	if !allowedGPUPassthrough[in.GPUPassthrough] {
-		return errors.New("invalid gpu_passthrough (must be 'igpu', 'dgpu', 'vgpu', 'none', 'unknown')")
-	}
-	if !allowedCPUVendor[in.CPUVendor] {
-		return errors.New("invalid cpu_vendor (must be 'intel', 'amd', 'arm', 'apple', 'qualcomm', 'unknown')")
-	}
-	if !allowedErrorCategory[in.ErrorCategory] {
-		return errors.New("invalid error_category")
-	}
-
-	// For status updates (not installing), skip numeric field validation
-	// These are only required for initial creation
-	isUpdate := in.Status != "installing"
-
-	// os_type is optional but if provided must be valid (only for lxc/vm)
-	if (in.Type == "lxc" || in.Type == "vm") && in.OsType != "" && !allowedOsType[in.OsType] {
-		return errors.New("invalid os_type")
-	}
-
-	// method is optional and flexible - just sanitized, no strict validation
-	// Values like "default", "advanced", "mydefaults-global", "mydefaults-app" are all valid
-
-	// Validate numeric ranges (only strict for new records)
-	if !isUpdate && (in.Type == "lxc" || in.Type == "vm") {
-		if in.CTType < 0 || in.CTType > 2 {
-			return errors.New("invalid ct_type (must be 0, 1, or 2)")
-		}
-	}
-	if in.DiskSize < 0 || in.DiskSize > 100000 {
-		return errors.New("invalid disk_size")
-	}
-	if in.CoreCount < 0 || in.CoreCount > 256 {
-		return errors.New("invalid core_count")
-	}
-	if in.RAMSize < 0 || in.RAMSize > 1048576 {
-		return errors.New("invalid ram_size")
-	}
-	if in.ExitCode < 0 || in.ExitCode > 255 {
-		return errors.New("invalid exit_code")
-	}
-	if in.InstallDuration < 0 || in.InstallDuration > 86400 {
-		return errors.New("invalid install_duration (max 24h)")
-	}
-
-	// Validate repo_source: must be a known value or empty
-	if in.RepoSource != "" && !allowedRepoSource[in.RepoSource] {
-		return fmt.Errorf("rejected repo_source '%s' (must be 'ProxmoxVE', 'ProxmoxVED', or 'external')", in.RepoSource)
-	}
-
-	return nil
-}
-
-// computeHash generates a hash for deduplication (GDPR-safe, no IP)
-func computeHash(out TelemetryOut) string {
-	key := fmt.Sprintf("%s|%s|%s|%s|%d",
-		out.RandomID, out.NSAPP, out.Type, out.Status, out.ExitCode,
-	)
-	sum := sha256.Sum256([]byte(key))
-	return hex.EncodeToString(sum[:])
-}
-
-// -------- HTTP server --------
-
-func main() {
-	cfg := Config{
-		ListenAddr:         env("LISTEN_ADDR", ":8080"),
-		TrustedProxiesCIDR: splitCSV(env("TRUSTED_PROXIES_CIDR", "")),
-
-		PBBaseURL:        mustEnv("PB_URL"),
-		PBAuthCollection: mustEnv("PB_AUTH_COLLECTION"),
-		PBIdentity:       mustEnv("PB_IDENTITY"),
-		PBPassword:       mustEnv("PB_PASSWORD"),
-		PBTargetColl:     mustEnv("PB_TARGET_COLLECTION"),
-
-		MaxBodyBytes:     envInt64("MAX_BODY_BYTES", 1024),
-		RateLimitRPM:     envInt("RATE_LIMIT_RPM", 60),
-		RateBurst:        envInt("RATE_BURST", 20),
-		RateKeyMode:      env("RATE_KEY_MODE", "ip"), // "ip" or "header"
-		RateKeyHeader:    env("RATE_KEY_HEADER", "X-Telemetry-Key"),
-		RequestTimeout:   time.Duration(envInt("UPSTREAM_TIMEOUT_MS", 4000)) * time.Millisecond,
-		EnableReqLogging: envBool("ENABLE_REQUEST_LOGGING", false),
-
-		// Cache config
-		RedisURL:     env("REDIS_URL", ""),
-		EnableRedis:  envBool("ENABLE_REDIS", false),
-		CacheTTL:     time.Duration(envInt("CACHE_TTL_SECONDS", 300)) * time.Second,
-		CacheEnabled: envBool("ENABLE_CACHE", true),
-
-		// Alert config
-		AlertEnabled:          envBool("ALERT_ENABLED", false),
-		SMTPHost:              env("SMTP_HOST", ""),
-		SMTPPort:              envInt("SMTP_PORT", 587),
-		SMTPUser:              env("SMTP_USER", ""),
-		SMTPPassword:          env("SMTP_PASSWORD", ""),
-		SMTPFrom:              env("SMTP_FROM", "telemetry@proxmoxved.local"),
-		SMTPTo:                splitCSV(env("SMTP_TO", "")),
-		SMTPUseTLS:            envBool("SMTP_USE_TLS", false),
-		AlertFailureThreshold: envFloat("ALERT_FAILURE_THRESHOLD", 20.0),
-		AlertCheckInterval:    time.Duration(envInt("ALERT_CHECK_INTERVAL_MIN", 15)) * time.Minute,
-		AlertCooldown:         time.Duration(envInt("ALERT_COOLDOWN_MIN", 60)) * time.Minute,
-	}
-
-	var pt *ProxyTrust
-	if strings.TrimSpace(env("TRUSTED_PROXIES_CIDR", "")) != "" {
-		p, err := NewProxyTrust(cfg.TrustedProxiesCIDR)
-		if err != nil {
-			log.Fatalf("invalid TRUSTED_PROXIES_CIDR: %v", err)
-		}
-		pt = p
-	}
-
-	pb := NewPBClient(cfg)
-	rl := NewRateLimiter(cfg.RateLimitRPM, cfg.RateBurst)
-
-	// Initialize cache
-	cache := NewCache(CacheConfig{
-		RedisURL:    cfg.RedisURL,
-		EnableRedis: cfg.EnableRedis,
-		DefaultTTL:  cfg.CacheTTL,
-	})
-
-	// Initialize alerter
-	alerter := NewAlerter(AlertConfig{
-		Enabled:          cfg.AlertEnabled,
-		SMTPHost:         cfg.SMTPHost,
-		SMTPPort:         cfg.SMTPPort,
-		SMTPUser:         cfg.SMTPUser,
-		SMTPPassword:     cfg.SMTPPassword,
-		SMTPFrom:         cfg.SMTPFrom,
-		SMTPTo:           cfg.SMTPTo,
-		UseTLS:           cfg.SMTPUseTLS,
-		FailureThreshold: cfg.AlertFailureThreshold,
-		CheckInterval:    cfg.AlertCheckInterval,
-		Cooldown:         cfg.AlertCooldown,
-	}, pb)
-	alerter.Start()
-
-	mux := http.NewServeMux()
-
-	mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
-		// Check PocketBase connectivity
-		ctx, cancel := context.WithTimeout(r.Context(), 2*time.Second)
-		defer cancel()
-		
-		status := map[string]interface{}{
-			"status": "ok",
-			"time":   time.Now().UTC().Format(time.RFC3339),
-		}
-		
-		if err := pb.ensureAuth(ctx); err != nil {
-			status["status"] = "degraded"
-			status["pocketbase"] = "disconnected"
-			w.WriteHeader(503)
-		} else {
-			status["pocketbase"] = "connected"
-			w.WriteHeader(200)
-		}
-		
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(status)
-	})
-
-	// Dashboard HTML page - serve on root
-	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/" {
-			http.NotFound(w, r)
-			return
-		}
-		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
-		_, _ = w.Write([]byte(DashboardHTML()))
-	})
-
-	// Redirect /dashboard to / for backwards compatibility
-	mux.HandleFunc("/dashboard", func(w http.ResponseWriter, r *http.Request) {
-		http.Redirect(w, r, "/", http.StatusMovedPermanently)
-	})
-
-	// Prometheus-style metrics endpoint
-	mux.HandleFunc("/metrics", func(w http.ResponseWriter, r *http.Request) {
-		ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
-		defer cancel()
-		
-		data, err := pb.FetchDashboardData(ctx, 1, "ProxmoxVE") // Last 24h, production only for metrics
-		if err != nil {
-			http.Error(w, "failed to fetch metrics", http.StatusInternalServerError)
-			return
-		}
-		
-		w.Header().Set("Content-Type", "text/plain; version=0.0.4")
-		fmt.Fprintf(w, "# HELP telemetry_installs_total Total number of installations\n")
-		fmt.Fprintf(w, "# TYPE telemetry_installs_total counter\n")
-		fmt.Fprintf(w, "telemetry_installs_total %d\n\n", data.TotalInstalls)
-		fmt.Fprintf(w, "# HELP telemetry_installs_success_total Successful installations\n")
-		fmt.Fprintf(w, "# TYPE telemetry_installs_success_total counter\n")
-		fmt.Fprintf(w, "telemetry_installs_success_total %d\n\n", data.SuccessCount)
-		fmt.Fprintf(w, "# HELP telemetry_installs_failed_total Failed installations\n")
-		fmt.Fprintf(w, "# TYPE telemetry_installs_failed_total counter\n")
-		fmt.Fprintf(w, "telemetry_installs_failed_total %d\n\n", data.FailedCount)
-		fmt.Fprintf(w, "# HELP telemetry_installs_pending Current installing count\n")
-		fmt.Fprintf(w, "# TYPE telemetry_installs_pending gauge\n")
-		fmt.Fprintf(w, "telemetry_installs_pending %d\n\n", data.InstallingCount)
-		fmt.Fprintf(w, "# HELP telemetry_success_rate Success rate percentage\n")
-		fmt.Fprintf(w, "# TYPE telemetry_success_rate gauge\n")
-		fmt.Fprintf(w, "telemetry_success_rate %.2f\n", data.SuccessRate)
-	})
-
-	// Dashboard API endpoint (with caching)
-	mux.HandleFunc("/api/dashboard", func(w http.ResponseWriter, r *http.Request) {
-		days := 7 // Default: 7 days
-		if d := r.URL.Query().Get("days"); d != "" {
-			fmt.Sscanf(d, "%d", &days)
-			// days=0 means "all entries", negative values are invalid
-			if days < 0 {
-				days = 7
-			}
-		}
-
-		// repo_source filter (default: ProxmoxVE)
-		repoSource := r.URL.Query().Get("repo")
-		if repoSource == "" {
-			repoSource = "ProxmoxVE"
-		}
-		// "all" means no filter
-		if repoSource == "all" {
-			repoSource = ""
-		}
-
-		// Increase timeout for large datasets (dashboard aggregation takes time)
-		ctx, cancel := context.WithTimeout(r.Context(), 120*time.Second)
-		defer cancel()
-
-		// Try cache first
-		cacheKey := fmt.Sprintf("dashboard:%d:%s", days, repoSource)
-		var data *DashboardData
-		if cfg.CacheEnabled && cache.Get(ctx, cacheKey, &data) {
-			w.Header().Set("Content-Type", "application/json")
-			w.Header().Set("X-Cache", "HIT")
-			json.NewEncoder(w).Encode(data)
-			return
-		}
-
-		data, err := pb.FetchDashboardData(ctx, days, repoSource)
-		if err != nil {
-			log.Printf("dashboard fetch failed: %v", err)
-			http.Error(w, "failed to fetch data", http.StatusInternalServerError)
-			return
-		}
-
-		// Cache the result
-		if cfg.CacheEnabled {
-			_ = cache.Set(ctx, cacheKey, data, cfg.CacheTTL)
-		}
-
-		w.Header().Set("Content-Type", "application/json")
-		w.Header().Set("X-Cache", "MISS")
-		json.NewEncoder(w).Encode(data)
-	})
-
-	// Paginated records API
-	mux.HandleFunc("/api/records", func(w http.ResponseWriter, r *http.Request) {
-		page := 1
-		limit := 50
-		status := r.URL.Query().Get("status")
-		app := r.URL.Query().Get("app")
-		osType := r.URL.Query().Get("os")
-		typeFilter := r.URL.Query().Get("type")
-		sort := r.URL.Query().Get("sort")
-		repoSource := r.URL.Query().Get("repo")
-		if repoSource == "" {
-			repoSource = "ProxmoxVE" // Default filter: production data
-		}
-
-		if p := r.URL.Query().Get("page"); p != "" {
-			fmt.Sscanf(p, "%d", &page)
-			if page < 1 {
-				page = 1
-			}
-		}
-		if l := r.URL.Query().Get("limit"); l != "" {
-			fmt.Sscanf(l, "%d", &limit)
-			if limit < 1 {
-				limit = 1
-			}
-			if limit > 100 {
-				limit = 100
-			}
-		}
-
-		ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-		defer cancel()
-
-		records, total, err := pb.FetchRecordsPaginated(ctx, page, limit, status, app, osType, typeFilter, sort, repoSource)
-		if err != nil {
-			log.Printf("records fetch failed: %v", err)
-			http.Error(w, "failed to fetch records", http.StatusInternalServerError)
-			return
-		}
-
-		response := map[string]interface{}{
-			"records":     records,
-			"page":        page,
-			"limit":       limit,
-			"total":       total,
-			"total_pages": (total + limit - 1) / limit,
-		}
-
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(response)
-	})
-
-	// Alert history and test endpoints
-	mux.HandleFunc("/api/alerts", func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(map[string]interface{}{
-			"enabled": cfg.AlertEnabled,
-			"history": alerter.GetAlertHistory(),
-		})
-	})
-
-	mux.HandleFunc("/api/alerts/test", func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != http.MethodPost {
-			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-			return
-		}
-
-		if err := alerter.TestAlert(); err != nil {
-			http.Error(w, err.Error(), http.StatusInternalServerError)
-			return
-		}
-
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte("test alert sent"))
-	})
-
-	mux.HandleFunc("/telemetry", func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != http.MethodPost {
-			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-			return
-		}
-
-		// rate key: IP or header (header allows non-identifying keys, but header can be abused too)
-		var key string
-		switch cfg.RateKeyMode {
-		case "header":
-			key = strings.TrimSpace(r.Header.Get(cfg.RateKeyHeader))
-			if key == "" {
-				key = "missing"
-			}
-		default:
-			ip := getClientIP(r, pt)
-			if ip == nil {
-				key = "unknown"
-			} else {
-				// GDPR: do NOT store IP anywhere permanent; use it only in-memory for RL key
-				key = ip.String()
-			}
-		}
-		if !rl.Allow(key) {
-			http.Error(w, "rate limited", http.StatusTooManyRequests)
-			return
-		}
-
-		r.Body = http.MaxBytesReader(w, r.Body, cfg.MaxBodyBytes)
-		raw, err := io.ReadAll(r.Body)
-		if err != nil {
-			http.Error(w, "invalid body", http.StatusBadRequest)
-			return
-		}
-
-		// strict JSON decode (no unknown fields)
-		var in TelemetryIn
-		dec := json.NewDecoder(bytes.NewReader(raw))
-		dec.DisallowUnknownFields()
-		if err := dec.Decode(&in); err != nil {
-			http.Error(w, "invalid json", http.StatusBadRequest)
-			return
-		}
-		if err := validate(&in); err != nil {
-			if cfg.EnableReqLogging {
-				log.Printf("telemetry rejected: %v", err)
-			}
-			http.Error(w, "invalid payload", http.StatusBadRequest)
-			return
-		}
-
-		// Map input to PocketBase schema
-		out := TelemetryOut{
-			RandomID:        in.RandomID,
-			Type:            in.Type,
-			NSAPP:           in.NSAPP,
-			Status:          in.Status,
-			CTType:          in.CTType,
-			DiskSize:        in.DiskSize,
-			CoreCount:       in.CoreCount,
-			RAMSize:         in.RAMSize,
-			OsType:          in.OsType,
-			OsVersion:       in.OsVersion,
-			PveVer:          in.PveVer,
-			Method:          in.Method,
-			Error:           in.Error,
-			ExitCode:        in.ExitCode,
-			GPUVendor:       in.GPUVendor,
-			GPUModel:        in.GPUModel,
-			GPUPassthrough:  in.GPUPassthrough,
-			CPUVendor:       in.CPUVendor,
-			CPUModel:        in.CPUModel,
-			RAMSpeed:        in.RAMSpeed,
-			InstallDuration: in.InstallDuration,
-			ErrorCategory:   in.ErrorCategory,
-			RepoSource:      in.RepoSource,
-		}
-		_ = computeHash(out) // For future deduplication
-
-		ctx, cancel := context.WithTimeout(r.Context(), cfg.RequestTimeout)
-		defer cancel()
-
-		// Upsert: Creates new record if random_id doesn't exist, updates if it does
-		// repo_source is stored as a field on the record for filtering
-		if err := pb.UpsertTelemetry(ctx, out); err != nil {
-			// GDPR: don't log raw payload, don't log IPs; log only generic error
-			log.Printf("pocketbase write failed: %v", err)
-			http.Error(w, "upstream error", http.StatusBadGateway)
-			return
-		}
-
-		if cfg.EnableReqLogging {
-			log.Printf("telemetry accepted nsapp=%s status=%s repo=%s", out.NSAPP, out.Status, in.RepoSource)
-		}
-
-		w.WriteHeader(http.StatusAccepted)
-		_, _ = w.Write([]byte("accepted"))
-	})
-
-	srv := &http.Server{
-		Addr:              cfg.ListenAddr,
-		Handler:           securityHeaders(mux),
-		ReadHeaderTimeout: 3 * time.Second,
-	}
-
-	// Background cache warmup job - pre-populates cache for common dashboard queries
-	if cfg.CacheEnabled {
-		go func() {
-			// Initial warmup after startup
-			time.Sleep(10 * time.Second)
-			warmupDashboardCache(pb, cache, cfg)
-			
-			// Periodic refresh (every 4 minutes, before 5-minute TTL expires)
-			ticker := time.NewTicker(4 * time.Minute)
-			for range ticker.C {
-				warmupDashboardCache(pb, cache, cfg)
-			}
-		}()
-		log.Println("background cache warmup enabled")
-	}
-
-	log.Printf("telemetry-ingest listening on %s", cfg.ListenAddr)
-	log.Fatal(srv.ListenAndServe())
-}
-
-func securityHeaders(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Minimal security headers (no cookies anyway)
-		w.Header().Set("X-Content-Type-Options", "nosniff")
-		w.Header().Set("X-Frame-Options", "DENY")
-		w.Header().Set("Referrer-Policy", "no-referrer")
-		next.ServeHTTP(w, r)
-	})
-}
-
-func env(k, def string) string {
-	v := os.Getenv(k)
-	if v == "" {
-		return def
-	}
-	return v
-}
-func mustEnv(k string) string {
-	v := os.Getenv(k)
-	if v == "" {
-		log.Fatalf("missing env %s", k)
-	}
-	return v
-}
-func envInt(k string, def int) int {
-	v := os.Getenv(k)
-	if v == "" {
-		return def
-	}
-	var i int
-	_, _ = fmt.Sscanf(v, "%d", &i)
-	if i == 0 && v != "0" {
-		return def
-	}
-	return i
-}
-func envInt64(k string, def int64) int64 {
-	v := os.Getenv(k)
-	if v == "" {
-		return def
-	}
-	var i int64
-	_, _ = fmt.Sscanf(v, "%d", &i)
-	if i == 0 && v != "0" {
-		return def
-	}
-	return i
-}
-func envBool(k string, def bool) bool {
-	v := strings.ToLower(strings.TrimSpace(os.Getenv(k)))
-	if v == "" {
-		return def
-	}
-	return v == "1" || v == "true" || v == "yes" || v == "on"
-}
-func envFloat(k string, def float64) float64 {
-	v := os.Getenv(k)
-	if v == "" {
-		return def
-	}
-	var f float64
-	_, _ = fmt.Sscanf(v, "%f", &f)
-	if f == 0 && v != "0" {
-		return def
-	}
-	return f
-}
-func splitCSV(s string) []string {
-	s = strings.TrimSpace(s)
-	if s == "" {
-		return nil
-	}
-	parts := strings.Split(s, ",")
-	var out []string
-	for _, p := range parts {
-		p = strings.TrimSpace(p)
-		if p != "" {
-			out = append(out, p)
-		}
-	}
-	return out
-}
-
-// warmupDashboardCache pre-populates the cache with common dashboard queries
-func warmupDashboardCache(pb *PBClient, cache *Cache, cfg Config) {
-	log.Println("[CACHE] Starting dashboard cache warmup...")
-	
-	// Common day ranges and repos to pre-cache
-	dayRanges := []int{7, 30, 90}
-	repos := []string{"ProxmoxVE", ""}  // ProxmoxVE and "all"
-	
-	warmed := 0
-	for _, days := range dayRanges {
-		for _, repo := range repos {
-			ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
-			
-			cacheKey := fmt.Sprintf("dashboard:%d:%s", days, repo)
-			
-			// Check if already cached
-			var existing *DashboardData
-			if cache.Get(ctx, cacheKey, &existing) {
-				cancel()
-				continue // Already cached, skip
-			}
-			
-			// Fetch and cache
-			data, err := pb.FetchDashboardData(ctx, days, repo)
-			cancel()
-			
-			if err != nil {
-				log.Printf("[CACHE] Warmup failed for days=%d repo=%s: %v", days, repo, err)
-				continue
-			}
-			
-			_ = cache.Set(context.Background(), cacheKey, data, cfg.CacheTTL)
-			warmed++
-			log.Printf("[CACHE] Warmed cache for days=%d repo=%s (%d installs)", days, repo, data.TotalAllTime)
-		}
-	}
-	
-	log.Printf("[CACHE] Dashboard cache warmup complete (%d entries)", warmed)
-}
\ No newline at end of file
diff --git a/misc/old_misc/alpine-install.func b/misc/old_misc/alpine-install.func
deleted file mode 100644
index 90a0ff00..00000000
--- a/misc/old_misc/alpine-install.func
+++ /dev/null
@@ -1,172 +0,0 @@
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: tteck (tteckster)
-# Co-Author: MickLesk
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-
-if ! command -v curl >/dev/null 2>&1; then
-  apk update && apk add curl >/dev/null 2>&1
-fi
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
-load_functions
-
-# This function enables IPv6 if it's not disabled and sets verbose mode
-verb_ip6() {
-  set_std_mode # Set STD mode based on VERBOSE
-
-  if [ "$IPV6_METHOD" == "disable" ]; then
-    msg_info "Disabling IPv6 (this may affect some services)"
-    $STD sysctl -w net.ipv6.conf.all.disable_ipv6=1
-    $STD sysctl -w net.ipv6.conf.default.disable_ipv6=1
-    $STD sysctl -w net.ipv6.conf.lo.disable_ipv6=1
-    mkdir -p /etc/sysctl.d
-    $STD tee /etc/sysctl.d/99-disable-ipv6.conf >/dev/null <<EOF
-net.ipv6.conf.all.disable_ipv6 = 1
-net.ipv6.conf.default.disable_ipv6 = 1
-net.ipv6.conf.lo.disable_ipv6 = 1
-EOF
-    $STD rc-update add sysctl default
-    msg_ok "Disabled IPv6"
-  fi
-}
-
-# This function catches errors and handles them with the error handler function
-catch_errors() {
-  set -Eeuo pipefail
-  trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
-}
-
-# This function handles errors
-error_handler() {
-  local exit_code="$?"
-  local line_number="$1"
-  local command="$2"
-  local error_message="${RD}[ERROR]${CL} in line ${RD}$line_number${CL}: exit code ${RD}$exit_code${CL}: while executing command ${YW}$command${CL}"
-  echo -e "\n$error_message\n"
-}
-
-# This function sets up the Container OS by generating the locale, setting the timezone, and checking the network connection
-setting_up_container() {
-  msg_info "Setting up Container OS"
-  while [ $i -gt 0 ]; do
-    if [ "$(ip addr show | grep 'inet ' | grep -v '127.0.0.1' | awk '{print $2}' | cut -d'/' -f1)" != "" ]; then
-      break
-    fi
-    echo 1>&2 -en "${CROSS}${RD} No Network! "
-    sleep $RETRY_EVERY
-    i=$((i - 1))
-  done
-
-  if [ "$(ip addr show | grep 'inet ' | grep -v '127.0.0.1' | awk '{print $2}' | cut -d'/' -f1)" = "" ]; then
-    echo 1>&2 -e "\n${CROSS}${RD} No Network After $RETRY_NUM Tries${CL}"
-    echo -e "${NETWORK}Check Network Settings"
-    exit 1
-  fi
-  msg_ok "Set up Container OS"
-  msg_ok "Network Connected: ${BL}$(ip addr show | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1 | tail -n1)${CL}"
-}
-
-# This function checks the network connection by pinging a known IP address and prompts the user to continue if the internet is not connected
-network_check() {
-  set +e
-  trap - ERR
-  if ping -c 1 -W 1 1.1.1.1 &>/dev/null || ping -c 1 -W 1 8.8.8.8 &>/dev/null || ping -c 1 -W 1 9.9.9.9 &>/dev/null; then
-    msg_ok "Internet Connected"
-  else
-    msg_error "Internet NOT Connected"
-    read -r -p "Would you like to continue anyway? <y/N> " prompt
-    if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
-      echo -e "${INFO}${RD}Expect Issues Without Internet${CL}"
-    else
-      echo -e "${NETWORK}Check Network Settings"
-      exit 1
-    fi
-  fi
-  RESOLVEDIP=$(getent hosts github.com | awk '{ print $1 }')
-  if [[ -z "$RESOLVEDIP" ]]; then msg_error "DNS Lookup Failure"; else msg_ok "DNS Resolved github.com to ${BL}$RESOLVEDIP${CL}"; fi
-  set -e
-  trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
-}
-
-# This function updates the Container OS by running apt-get update and upgrade
-update_os() {
-  msg_info "Updating Container OS"
-  $STD apk -U upgrade
-  source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
-  msg_ok "Updated Container OS"
-}
-
-# This function modifies the message of the day (motd) and SSH settings
-motd_ssh() {
-  echo "export TERM='xterm-256color'" >>/root/.bashrc
-  IP=$(ip -4 addr show eth0 | awk '/inet / {print $2}' | cut -d/ -f1 | head -n 1)
-
-  if [ -f "/etc/os-release" ]; then
-    OS_NAME=$(grep ^NAME /etc/os-release | cut -d= -f2 | tr -d '"')
-    OS_VERSION=$(grep ^VERSION_ID /etc/os-release | cut -d= -f2 | tr -d '"')
-  else
-    OS_NAME="Alpine Linux"
-    OS_VERSION="Unknown"
-  fi
-
-  PROFILE_FILE="/etc/profile.d/00_lxc-details.sh"
-  echo "echo -e \"\"" >"$PROFILE_FILE"
-  echo -e "echo -e \"${BOLD}${APPLICATION} LXC Container${CL}"\" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${TAB}${GATEWAY}${YW} Provided by: ${GN}community-scripts ORG ${YW}| GitHub: ${GN}https://github.com/community-scripts/ProxmoxVE${CL}\"" >>"$PROFILE_FILE"
-  echo "echo \"\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${TAB}${OS}${YW} OS: ${GN}${OS_NAME} - Version: ${OS_VERSION}${CL}\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${TAB}${HOSTNAME}${YW} Hostname: ${GN}\$(hostname)${CL}\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${TAB}${INFO}${YW} IP Address: ${GN}\$(ip -4 addr show eth0 | awk '/inet / {print \$2}' | cut -d/ -f1 | head -n 1)${CL}\"" >>"$PROFILE_FILE"
-
-  # Configure SSH if enabled
-  if [[ "${SSH_ROOT}" == "yes" ]]; then
-    # Enable sshd service
-    $STD rc-update add sshd
-    # Allow root login via SSH
-    sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" /etc/ssh/sshd_config
-    # Start the sshd service
-    $STD /etc/init.d/sshd start
-  fi
-}
-
-# Validate Timezone for some LXC's
-validate_tz() {
-  [[ -f "/usr/share/zoneinfo/$1" ]]
-}
-
-# This function customizes the container and enables passwordless login for the root user
-customize() {
-  if [[ "$PASSWORD" == "" ]]; then
-    msg_info "Customizing Container"
-    passwd -d root >/dev/null 2>&1
-
-    # Ensure agetty is available
-    apk add --no-cache --force-broken-world util-linux >/dev/null 2>&1
-
-    # Create persistent autologin boot script
-    mkdir -p /etc/local.d
-    cat <<'EOF' >/etc/local.d/autologin.start
-#!/bin/sh
-sed -i 's|^tty1::respawn:.*|tty1::respawn:/sbin/agetty --autologin root --noclear tty1 38400 linux|' /etc/inittab
-kill -HUP 1
-EOF
-    touch /root/.hushlogin
-
-    chmod +x /etc/local.d/autologin.start
-    rc-update add local >/dev/null 2>&1
-
-    # Apply autologin immediately for current session
-    /etc/local.d/autologin.start
-
-    msg_ok "Customized Container"
-  fi
-
-  echo "bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/${app}.sh)\"" >/usr/bin/update
-  chmod +x /usr/bin/update
-
-  if [[ -n "${SSH_AUTHORIZED_KEY}" ]]; then
-    mkdir -p /root/.ssh
-    echo "${SSH_AUTHORIZED_KEY}" >/root/.ssh/authorized_keys
-    chmod 700 /root/.ssh
-    chmod 600 /root/.ssh/authorized_keys
-  fi
-}
diff --git a/misc/old_misc/api.func b/misc/old_misc/api.func
deleted file mode 100644
index f4091d55..00000000
--- a/misc/old_misc/api.func
+++ /dev/null
@@ -1,130 +0,0 @@
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: michelroegl-brunner
-# License: MIT | https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/LICENSE
-
-post_to_api() {
-
-  if ! command -v curl &>/dev/null; then
-    return
-  fi
-
-  if [ "$DIAGNOSTICS" = "no" ]; then
-    return
-  fi
-
-  if [ -z "$RANDOM_UUID" ]; then
-    return
-  fi
-
-  local API_URL="http://api.community-scripts.org/upload"
-  local pve_version="not found"
-  pve_version=$(pveversion | awk -F'[/ ]' '{print $2}')
-
-  JSON_PAYLOAD=$(
-    cat <<EOF
-{
-    "ct_type": $CT_TYPE,
-    "type":"lxc",
-    "disk_size": $DISK_SIZE,
-    "core_count": $CORE_COUNT,
-    "ram_size": $RAM_SIZE,
-    "os_type": "$var_os",
-    "os_version": "$var_version",
-    "nsapp": "$NSAPP",
-    "method": "$METHOD",
-    "pve_version": "$pve_version",
-    "status": "installing",
-    "random_id": "$RANDOM_UUID"
-}
-EOF
-  )
-
-  if [[ "$DIAGNOSTICS" == "yes" ]]; then
-    RESPONSE=$(curl -s -w "%{http_code}" -L -X POST "$API_URL" --post301 --post302 \
-      -H "Content-Type: application/json" \
-      -d "$JSON_PAYLOAD") || true
-  fi
-}
-
-post_to_api_vm() {
-
-  if [[ ! -f /usr/local/community-scripts/diagnostics ]]; then
-    return
-  fi
-  DIAGNOSTICS=$(grep -i "^DIAGNOSTICS=" /usr/local/community-scripts/diagnostics | awk -F'=' '{print $2}')
-  if ! command -v curl &>/dev/null; then
-    return
-  fi
-
-  if [ "$DIAGNOSTICS" = "no" ]; then
-    return
-  fi
-
-  if [ -z "$RANDOM_UUID" ]; then
-    return
-  fi
-
-  local API_URL="http://api.community-scripts.org/upload"
-  local pve_version="not found"
-  pve_version=$(pveversion | awk -F'[/ ]' '{print $2}')
-
-  DISK_SIZE_API=${DISK_SIZE%G}
-
-  JSON_PAYLOAD=$(
-    cat <<EOF
-{
-    "ct_type": 2,
-    "type":"vm",
-    "disk_size": $DISK_SIZE_API,
-    "core_count": $CORE_COUNT,
-    "ram_size": $RAM_SIZE,
-    "os_type": "$var_os",
-    "os_version": "$var_version",
-    "nsapp": "$NSAPP",
-    "method": "$METHOD",
-    "pve_version": "$pve_version",
-    "status": "installing",
-    "random_id": "$RANDOM_UUID"
-}
-EOF
-  )
-
-  if [[ "$DIAGNOSTICS" == "yes" ]]; then
-    RESPONSE=$(curl -s -w "%{http_code}" -L -X POST "$API_URL" --post301 --post302 \
-      -H "Content-Type: application/json" \
-      -d "$JSON_PAYLOAD") || true
-  fi
-}
-
-POST_UPDATE_DONE=false
-post_update_to_api() {
-
-  if ! command -v curl &>/dev/null; then
-    return
-  fi
-
-  if [ "$POST_UPDATE_DONE" = true ]; then
-    return 0
-  fi
-  local API_URL="http://api.community-scripts.org/upload/updatestatus"
-  local status="${1:-failed}"
-  local error="${2:-No error message}"
-
-  JSON_PAYLOAD=$(
-    cat <<EOF
-{
-    "status": "$status",
-    "error": "$error",
-    "random_id": "$RANDOM_UUID"
-}
-EOF
-  )
-
-  if [[ "$DIAGNOSTICS" == "yes" ]]; then
-    RESPONSE=$(curl -s -w "%{http_code}" -L -X POST "$API_URL" --post301 --post302 \
-      -H "Content-Type: application/json" \
-      -d "$JSON_PAYLOAD") || true
-  fi
-
-  POST_UPDATE_DONE=true
-}
diff --git a/misc/old_misc/build.func b/misc/old_misc/build.func
deleted file mode 100644
index 060c1eaf..00000000
--- a/misc/old_misc/build.func
+++ /dev/null
@@ -1,1439 +0,0 @@
-# Copyright (c) 2021-2026 tteck
-# Author: tteck (tteckster)
-# Co-Author: MickLesk
-# Co-Author: michelroegl-brunner
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-
-variables() {
-  NSAPP=$(echo "${APP,,}" | tr -d ' ')              # This function sets the NSAPP variable by converting the value of the APP variable to lowercase and removing any spaces.
-  var_install="${NSAPP}-install"                    # sets the var_install variable by appending "-install" to the value of NSAPP.
-  INTEGER='^[0-9]+([.][0-9]+)?$'                    # it defines the INTEGER regular expression pattern.
-  PVEHOST_NAME=$(hostname)                          # gets the Proxmox Hostname and sets it to Uppercase
-  DIAGNOSTICS="yes"                                 # sets the DIAGNOSTICS variable to "yes", used for the API call.
-  METHOD="default"                                  # sets the METHOD variable to "default", used for the API call.
-  RANDOM_UUID="$(cat /proc/sys/kernel/random/uuid)" # generates a random UUID and sets it to the RANDOM_UUID variable.
-  CT_TYPE=${var_unprivileged:-$CT_TYPE}
-}
-
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func)
-
-if command -v curl >/dev/null 2>&1; then
-  source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
-  load_functions
-elif command -v wget >/dev/null 2>&1; then
-  source <(wget -qO- https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
-  load_functions
-fi
-# This function enables error handling in the script by setting options and defining a trap for the ERR signal.
-catch_errors() {
-  set -Eeo pipefail
-  trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
-}
-
-# This function is called when an error occurs. It receives the exit code, line number, and command that caused the error, and displays an error message.
-error_handler() {
-  source /dev/stdin <<<$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func)
-  printf "\e[?25h"
-  local exit_code="$?"
-  local line_number="$1"
-  local command="$2"
-  local error_message="${RD}[ERROR]${CL} in line ${RD}$line_number${CL}: exit code ${RD}$exit_code${CL}: while executing command ${YW}$command${CL}"
-  post_update_to_api "failed" "${command}"
-  echo -e "\n$error_message\n"
-}
-
-# Check if the current shell is using bash
-shell_check() {
-  if [[ "$(ps -p $$ -o comm=)" != "bash" ]]; then
-    clear
-    msg_error "Your default shell is not bash. Please report this to our github issues or discord."
-    echo -e "\nExiting..."
-    sleep 2
-    exit
-  fi
-}
-
-# Run as root only
-root_check() {
-  if [[ "$(id -u)" -ne 0 || $(ps -o comm= -p $PPID) == "sudo" ]]; then
-    clear
-    msg_error "Please run this script as root."
-    echo -e "\nExiting..."
-    sleep 2
-    exit
-  fi
-}
-
-# This function checks the version of Proxmox Virtual Environment (PVE) and exits if the version is not supported.
-# Supported: Proxmox VE 8.0.x – 8.9.x, 9.0 and 9.1
-pve_check() {
-  local PVE_VER
-  PVE_VER="$(pveversion | awk -F'/' '{print $2}' | awk -F'-' '{print $1}')"
-
-  # Check for Proxmox VE 8.x: allow 8.0–8.9
-  if [[ "$PVE_VER" =~ ^8\.([0-9]+) ]]; then
-    local MINOR="${BASH_REMATCH[1]}"
-    if ((MINOR < 0 || MINOR > 9)); then
-      msg_error "This version of Proxmox VE is not supported."
-      msg_error "Supported: Proxmox VE version 8.0 – 8.9"
-      exit 1
-    fi
-    return 0
-  fi
-
-  # Check for Proxmox VE 9.x: allow 9.0 and 9.1
-  if [[ "$PVE_VER" =~ ^9\.([0-9]+) ]]; then
-    local MINOR="${BASH_REMATCH[1]}"
-    if ((MINOR < 0 || MINOR > 1)); then
-      msg_error "This version of Proxmox VE is not supported."
-      msg_error "Supported: Proxmox VE version 9.0 – 9.1"
-      exit 1
-    fi
-    return 0
-  fi
-
-  # All other unsupported versions
-  msg_error "This version of Proxmox VE is not supported."
-  msg_error "Supported versions: Proxmox VE 8.0 – 8.x or 9.0 – 9.1"
-  exit 1
-}
-
-# When a node is running tens of containers, it's possible to exceed the kernel's cryptographic key storage allocations.
-# These are tuneable, so verify if the currently deployment is approaching the limits, advise the user on how to tune the limits, and exit the script.
-# https://cleveruptime.com/docs/files/proc-key-users | https://docs.kernel.org/security/keys/core.html
-maxkeys_check() {
-  # Read kernel parameters
-  per_user_maxkeys=$(cat /proc/sys/kernel/keys/maxkeys 2>/dev/null || echo 0)
-  per_user_maxbytes=$(cat /proc/sys/kernel/keys/maxbytes 2>/dev/null || echo 0)
-
-  # Exit if kernel parameters are unavailable
-  if [[ "$per_user_maxkeys" -eq 0 || "$per_user_maxbytes" -eq 0 ]]; then
-    echo -e "${CROSS}${RD} Error: Unable to read kernel parameters. Ensure proper permissions.${CL}"
-    exit 1
-  fi
-
-  # Fetch key usage for user ID 100000 (typical for containers)
-  used_lxc_keys=$(awk '/100000:/ {print $2}' /proc/key-users 2>/dev/null || echo 0)
-  used_lxc_bytes=$(awk '/100000:/ {split($5, a, "/"); print a[1]}' /proc/key-users 2>/dev/null || echo 0)
-
-  # Calculate thresholds and suggested new limits
-  threshold_keys=$((per_user_maxkeys - 100))
-  threshold_bytes=$((per_user_maxbytes - 1000))
-  new_limit_keys=$((per_user_maxkeys * 2))
-  new_limit_bytes=$((per_user_maxbytes * 2))
-
-  # Check if key or byte usage is near limits
-  failure=0
-  if [[ "$used_lxc_keys" -gt "$threshold_keys" ]]; then
-    echo -e "${CROSS}${RD} Warning: Key usage is near the limit (${used_lxc_keys}/${per_user_maxkeys}).${CL}"
-    echo -e "${INFO} Suggested action: Set ${GN}kernel.keys.maxkeys=${new_limit_keys}${CL} in ${BOLD}/etc/sysctl.d/98-community-scripts.conf${CL}."
-    failure=1
-  fi
-  if [[ "$used_lxc_bytes" -gt "$threshold_bytes" ]]; then
-    echo -e "${CROSS}${RD} Warning: Key byte usage is near the limit (${used_lxc_bytes}/${per_user_maxbytes}).${CL}"
-    echo -e "${INFO} Suggested action: Set ${GN}kernel.keys.maxbytes=${new_limit_bytes}${CL} in ${BOLD}/etc/sysctl.d/98-community-scripts.conf${CL}."
-    failure=1
-  fi
-
-  # Provide next steps if issues are detected
-  if [[ "$failure" -eq 1 ]]; then
-    echo -e "${INFO} To apply changes, run: ${BOLD}service procps force-reload${CL}"
-    exit 1
-  fi
-
-  echo -e "${CM}${GN} All kernel key limits are within safe thresholds.${CL}"
-}
-
-# This function checks the system architecture and exits if it's not "amd64".
-arch_check() {
-  if [ "$(dpkg --print-architecture)" != "amd64" ]; then
-    echo -e "\n ${INFO}${YWB}This script will not work with PiMox! \n"
-    echo -e "\n ${YWB}Visit https://github.com/asylumexp/Proxmox for ARM64 support. \n"
-    echo -e "Exiting..."
-    sleep 2
-    exit
-  fi
-}
-
-# Function to get the current IP address based on the distribution
-get_current_ip() {
-  if [ -f /etc/os-release ]; then
-    # Check for Debian/Ubuntu (uses hostname -I)
-    if grep -qE 'ID=debian|ID=ubuntu' /etc/os-release; then
-      CURRENT_IP=$(hostname -I | awk '{print $1}')
-    # Check for Alpine (uses ip command)
-    elif grep -q 'ID=alpine' /etc/os-release; then
-      CURRENT_IP=$(ip -4 addr show eth0 | awk '/inet / {print $2}' | cut -d/ -f1 | head -n 1)
-    else
-      CURRENT_IP="Unknown"
-    fi
-  fi
-  echo "$CURRENT_IP"
-}
-
-# Function to update the IP address in the MOTD file
-update_motd_ip() {
-  MOTD_FILE="/etc/motd"
-
-  if [ -f "$MOTD_FILE" ]; then
-    # Remove existing IP Address lines to prevent duplication
-    sed -i '/IP Address:/d' "$MOTD_FILE"
-
-    IP=$(get_current_ip)
-    # Add the new IP address
-    echo -e "${TAB}${NETWORK}${YW} IP Address: ${GN}${IP}${CL}" >>"$MOTD_FILE"
-  fi
-}
-
-# This function checks if the script is running through SSH and prompts the user to confirm if they want to proceed or exit.
-ssh_check() {
-  if [ -n "${SSH_CLIENT:+x}" ]; then
-    if whiptail --backtitle "Proxmox VE Helper Scripts" --defaultno --title "SSH DETECTED" --yesno "It's advisable to utilize the Proxmox shell rather than SSH, as there may be potential complications with variable retrieval. Proceed using SSH?" 10 72; then
-      whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox --title "Proceed using SSH" "You've chosen to proceed using SSH. If any issues arise, please run the script in the Proxmox shell before creating a repository issue." 10 72
-    else
-      clear
-      echo "Exiting due to SSH usage. Please consider using the Proxmox shell."
-      exit
-    fi
-  fi
-}
-
-base_settings() {
-  # Default Settings
-  CT_TYPE=${var_unprivileged:-"1"}
-  DISK_SIZE=${var_disk:-"4"}
-  CORE_COUNT=${var_cpu:-"1"}
-  RAM_SIZE=${var_ram:-"1024"}
-  VERBOSE=${var_verbose:-"${1:-no}"}
-  PW=${var_pw:-""}
-  CT_ID=${var_ctid:-$NEXTID}
-  HN=${var_hostname:-$NSAPP}
-  BRG=${var_brg:-"vmbr0"}
-  NET=${var_net:-"dhcp"}
-  IPV6_METHOD=${var_ipv6_method:-"none"}
-  IPV6_STATIC=${var_ipv6_static:-""}
-  GATE=${var_gateway:-""}
-  APT_CACHER=${var_apt_cacher:-""}
-  APT_CACHER_IP=${var_apt_cacher_ip:-""}
-  MTU=${var_mtu:-""}
-  SD=${var_storage:-""}
-  NS=${var_ns:-""}
-  MAC=${var_mac:-""}
-  VLAN=${var_vlan:-""}
-  SSH=${var_ssh:-"no"}
-  SSH_AUTHORIZED_KEY=${var_ssh_authorized_key:-""}
-  UDHCPC_FIX=${var_udhcpc_fix:-""}
-  TAGS="community-script;${var_tags:-}"
-  ENABLE_FUSE=${var_fuse:-"${1:-no}"}
-  ENABLE_TUN=${var_tun:-"${1:-no}"}
-
-  # Since these 2 are only defined outside of default_settings function, we add a temporary fallback. TODO: To align everything, we should add these as constant variables (e.g. OSTYPE and OSVERSION), but that would currently require updating the default_settings function for all existing scripts
-  if [ -z "$var_os" ]; then
-    var_os="debian"
-  fi
-  if [ -z "$var_version" ]; then
-    var_version="12"
-  fi
-}
-
-write_config() {
-  mkdir -p /opt/community-scripts
-  # This function writes the configuration to a file.
-  if whiptail --backtitle "Proxmox VE Helper Scripts" --defaultno --title "Write configfile" --yesno "Do you want to write the selections to a config file?" 10 60; then
-    FILEPATH="/opt/community-scripts/${NSAPP}.conf"
-    [[ "$GATE" =~ ",gw=" ]] && local GATE="${GATE##,gw=}"
-
-    # Strip prefixes from parameters for config file storage
-    local SD_VALUE="${SD}"
-    local NS_VALUE="${NS}"
-    local MAC_VALUE="${MAC}"
-    local VLAN_VALUE="${VLAN}"
-    [[ "$SD" =~ ^-searchdomain= ]] && SD_VALUE="${SD#-searchdomain=}"
-    [[ "$NS" =~ ^-nameserver= ]] && NS_VALUE="${NS#-nameserver=}"
-    [[ "$MAC" =~ ^,hwaddr= ]] && MAC_VALUE="${MAC#,hwaddr=}"
-    [[ "$VLAN" =~ ^,tag= ]] && VLAN_VALUE="${VLAN#,tag=}"
-
-    if [[ ! -f $FILEPATH ]]; then
-      cat <<EOF >"$FILEPATH"
-# ${NSAPP} Configuration File
-# Generated on $(date)
-
-CT_TYPE="${CT_TYPE}"
-DISK_SIZE="${DISK_SIZE}"
-CORE_COUNT="${CORE_COUNT}"
-RAM_SIZE="${RAM_SIZE}"
-VERBOSE="${VERBOSE}"
-PW="${PW##-password }"
-#CT_ID=$NEXTID
-HN="${HN}"
-BRG="${BRG}"
-NET="${NET}"
-IPV6_METHOD="${IPV6_METHOD:-none}"
-# Set this only if using "IPV6_METHOD=static"
-#IPV6STATIC="fd00::1234/64"
-
-GATE="${GATE:-none}"
-APT_CACHER_IP="${APT_CACHER_IP:-none}"
-MTU="${MTU:-1500}"
-SD="${SD_VALUE:-none}"
-NS="${NS_VALUE:-none}"
-MAC="${MAC_VALUE:-none}"
-VLAN="${VLAN_VALUE:-none}"
-SSH="${SSH}"
-SSH_AUTHORIZED_KEY="${SSH_AUTHORIZED_KEY}"
-TAGS="${TAGS:-none}"
-ENABLE_FUSE="$ENABLE_FUSE"
-ENABLE_TUN="$ENABLE_TUN"
-EOF
-
-      echo -e "${INFO}${BOLD}${GN}Writing configuration to ${FILEPATH}${CL}"
-    else
-      echo -e "${INFO}${BOLD}${RD}Configuration file already exists at ${FILEPATH}${CL}"
-      if whiptail --backtitle "Proxmox VE Helper Scripts" --defaultno --title "Overwrite configfile" --yesno "Do you want to overwrite the existing config file?" 10 60; then
-        rm -f "$FILEPATH"
-        cat <<EOF >"$FILEPATH"
-# ${NSAPP} Configuration File
-# Generated on $(date)
-
-CT_TYPE="${CT_TYPE}"
-DISK_SIZE="${DISK_SIZE}"
-CORE_COUNT="${CORE_COUNT}"
-RAM_SIZE="${RAM_SIZE}"
-VERBOSE="${VERBOSE}"
-PW="${PW##-password }"
-#CT_ID=$NEXTID
-HN="${HN}"
-BRG="${BRG}"
-NET="${NET}"
-IPV6_METHOD="${IPV6_METHOD:-none}"
-
-# Set this only if using "IPV6_METHOD=static"
-#IPV6STATIC="fd00::1234/64"
-
-GATE="${GATE:-none}"
-APT_CACHER_IP="${APT_CACHER_IP:-none}"
-MTU="${MTU:-1500}"
-SD="${SD_VALUE:-none}"
-NS="${NS_VALUE:-none}"
-MAC="${MAC_VALUE:-none}"
-VLAN="${VLAN_VALUE:-none}"
-SSH="${SSH}"
-SSH_AUTHORIZED_KEY="${SSH_AUTHORIZED_KEY}"
-TAGS="${TAGS:-none}"
-ENABLE_FUSE="$ENABLE_FUSE"
-ENABLE_TUN="$ENABLE_TUN"
-EOF
-        echo -e "${INFO}${BOLD}${GN}Writing configuration to ${FILEPATH}${CL}"
-      else
-        echo -e "${INFO}${BOLD}${RD}Configuration file not overwritten${CL}"
-      fi
-    fi
-  fi
-}
-
-# This function displays the default values for various settings.
-echo_default() {
-  # Convert CT_TYPE to description
-  CT_TYPE_DESC="Unprivileged"
-  if [ "$CT_TYPE" -eq 0 ]; then
-    CT_TYPE_DESC="Privileged"
-  fi
-
-  # Output the selected values with icons
-  echo -e "${CONTAINERID}${BOLD}${DGN}Container ID: ${BGN}${CT_ID}${CL}"
-  echo -e "${OS}${BOLD}${DGN}Operating System: ${BGN}$var_os ($var_version)${CL}"
-  echo -e "${CONTAINERTYPE}${BOLD}${DGN}Container Type: ${BGN}$CT_TYPE_DESC${CL}"
-  echo -e "${DISKSIZE}${BOLD}${DGN}Disk Size: ${BGN}${DISK_SIZE} GB${CL}"
-  echo -e "${CPUCORE}${BOLD}${DGN}CPU Cores: ${BGN}${CORE_COUNT}${CL}"
-  echo -e "${RAMSIZE}${BOLD}${DGN}RAM Size: ${BGN}${RAM_SIZE} MiB${CL}"
-  if [ "$VERBOSE" == "yes" ]; then
-    echo -e "${SEARCH}${BOLD}${DGN}Verbose Mode: ${BGN}Enabled${CL}"
-  fi
-  echo -e "${CREATING}${BOLD}${BL}Creating a ${APP} LXC using the above default settings${CL}"
-  echo -e "  "
-}
-
-# This function is called when the user decides to exit the script. It clears the screen and displays an exit message.
-exit_script() {
-  clear
-  echo -e "\n${CROSS}${RD}User exited script${CL}\n"
-  exit
-}
-
-# This function allows the user to configure advanced settings for the script.
-advanced_settings() {
-  whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox --title "Here is an instructional tip:" "To make a selection, use the Spacebar." 8 58
-  # Setting Default Tag for Advanced Settings
-  TAGS="community-script;${var_tags:-}"
-  CT_DEFAULT_TYPE="${CT_TYPE}"
-  CT_TYPE=""
-  while [ -z "$CT_TYPE" ]; do
-    if [ "$CT_DEFAULT_TYPE" == "1" ]; then
-      if CT_TYPE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "CONTAINER TYPE" --radiolist "Choose Type" 10 58 2 \
-        "1" "Unprivileged" ON \
-        "0" "Privileged" OFF \
-        3>&1 1>&2 2>&3); then
-        if [ -n "$CT_TYPE" ]; then
-          CT_TYPE_DESC="Unprivileged"
-          if [ "$CT_TYPE" -eq 0 ]; then
-            CT_TYPE_DESC="Privileged"
-          fi
-          echo -e "${OS}${BOLD}${DGN}Operating System: ${BGN}$var_os${CL}"
-          echo -e "${OSVERSION}${BOLD}${DGN}Version: ${BGN}$var_version${CL}"
-          echo -e "${CONTAINERTYPE}${BOLD}${DGN}Container Type: ${BGN}$CT_TYPE_DESC${CL}"
-        fi
-      else
-        exit_script
-      fi
-    fi
-    if [ "$CT_DEFAULT_TYPE" == "0" ]; then
-      if CT_TYPE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "CONTAINER TYPE" --radiolist "Choose Type" 10 58 2 \
-        "1" "Unprivileged" OFF \
-        "0" "Privileged" ON \
-        3>&1 1>&2 2>&3); then
-        if [ -n "$CT_TYPE" ]; then
-          CT_TYPE_DESC="Unprivileged"
-          if [ "$CT_TYPE" -eq 0 ]; then
-            CT_TYPE_DESC="Privileged"
-          fi
-          echo -e "${OS}${BOLD}${DGN}Operating System: ${BGN}$var_os${CL}"
-          echo -e "${OSVERSION}${BOLD}${DGN}Version: ${BGN}$var_version${CL}"
-          echo -e "${CONTAINERTYPE}${BOLD}${DGN}Container Type: ${BGN}$CT_TYPE_DESC${CL}"
-        fi
-      else
-        exit_script
-      fi
-    fi
-  done
-
-  while true; do
-    if PW1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --passwordbox "\nSet Root Password (needed for root ssh access)" 9 58 --title "PASSWORD (leave blank for automatic login)" 3>&1 1>&2 2>&3); then
-      # Empty = Autologin
-      if [[ -z "$PW1" ]]; then
-        PW=""
-        PW1="Automatic Login"
-        echo -e "${VERIFYPW}${BOLD}${DGN}Root Password: ${BGN}$PW1${CL}"
-        break
-      fi
-
-      # Invalid: contains spaces
-      if [[ "$PW1" == *" "* ]]; then
-        whiptail --msgbox "Password cannot contain spaces." 8 58
-        continue
-      fi
-
-      # Invalid: too short
-      if ((${#PW1} < 5)); then
-        whiptail --msgbox "Password must be at least 5 characters." 8 58
-        continue
-      fi
-
-      # Confirm password
-      if PW2=$(whiptail --backtitle "Proxmox VE Helper Scripts" --passwordbox "\nVerify Root Password" 9 58 --title "PASSWORD VERIFICATION" 3>&1 1>&2 2>&3); then
-        if [[ "$PW1" == "$PW2" ]]; then
-          PW="-password $PW1"
-          echo -e "${VERIFYPW}${BOLD}${DGN}Root Password: ${BGN}********${CL}"
-          break
-        else
-          whiptail --msgbox "Passwords do not match. Please try again." 8 58
-        fi
-      else
-        exit_script
-      fi
-    else
-      exit_script
-    fi
-  done
-
-  if CT_ID=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Container ID" 8 58 "$NEXTID" --title "CONTAINER ID" 3>&1 1>&2 2>&3); then
-    if [ -z "$CT_ID" ]; then
-      CT_ID="$NEXTID"
-      echo -e "${CONTAINERID}${BOLD}${DGN}Container ID: ${BGN}$CT_ID${CL}"
-    else
-      echo -e "${CONTAINERID}${BOLD}${DGN}Container ID: ${BGN}$CT_ID${CL}"
-    fi
-  else
-    exit_script
-  fi
-
-  while true; do
-    if CT_NAME=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Hostname" 8 58 "$NSAPP" --title "HOSTNAME" 3>&1 1>&2 2>&3); then
-      if [ -z "$CT_NAME" ]; then
-        HN="$NSAPP"
-      else
-        HN=$(echo "${CT_NAME,,}" | tr -d ' ')
-      fi
-      # Hostname validate (RFC 1123)
-      if [[ "$HN" =~ ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ ]]; then
-        echo -e "${HOSTNAME}${BOLD}${DGN}Hostname: ${BGN}$HN${CL}"
-        break
-      else
-        whiptail --backtitle "Proxmox VE Helper Scripts" \
-          --msgbox "❌ Invalid hostname: '$HN'\n\nOnly lowercase letters, digits and hyphens (-) are allowed.\nUnderscores (_) or other characters are not permitted!" 10 70
-      fi
-    else
-      exit_script
-    fi
-  done
-
-  while true; do
-    DISK_SIZE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Disk Size in GB" 8 58 "$var_disk" --title "DISK SIZE" 3>&1 1>&2 2>&3) || exit_script
-
-    if [ -z "$DISK_SIZE" ]; then
-      DISK_SIZE="$var_disk"
-    fi
-
-    if [[ "$DISK_SIZE" =~ ^[1-9][0-9]*$ ]]; then
-      echo -e "${DISKSIZE}${BOLD}${DGN}Disk Size: ${BGN}${DISK_SIZE} GB${CL}"
-      break
-    else
-      whiptail --msgbox "Disk size must be a positive integer!" 8 58
-    fi
-  done
-
-  while true; do
-    CORE_COUNT=$(whiptail --backtitle "Proxmox VE Helper Scripts" \
-      --inputbox "Allocate CPU Cores" 8 58 "$var_cpu" --title "CORE COUNT" 3>&1 1>&2 2>&3) || exit_script
-
-    if [ -z "$CORE_COUNT" ]; then
-      CORE_COUNT="$var_cpu"
-    fi
-
-    if [[ "$CORE_COUNT" =~ ^[1-9][0-9]*$ ]]; then
-      echo -e "${CPUCORE}${BOLD}${DGN}CPU Cores: ${BGN}$CORE_COUNT${CL}"
-      break
-    else
-      whiptail --msgbox "CPU core count must be a positive integer!" 8 58
-    fi
-  done
-
-  while true; do
-    RAM_SIZE=$(whiptail --backtitle "Proxmox VE Helper Scripts" \
-      --inputbox "Allocate RAM in MiB" 8 58 "$var_ram" --title "RAM" 3>&1 1>&2 2>&3) || exit_script
-
-    if [ -z "$RAM_SIZE" ]; then
-      RAM_SIZE="$var_ram"
-    fi
-
-    if [[ "$RAM_SIZE" =~ ^[1-9][0-9]*$ ]]; then
-      echo -e "${RAMSIZE}${BOLD}${DGN}RAM Size: ${BGN}${RAM_SIZE} MiB${CL}"
-      break
-    else
-      whiptail --msgbox "RAM size must be a positive integer!" 8 58
-    fi
-  done
-
-  BRIDGES=""
-  IFACE_FILEPATH_LIST="/etc/network/interfaces"$'\n'$(find "/etc/network/interfaces.d/" -type f)
-  OLD_IFS=$IFS
-  IFS=$'\n'
-
-  for iface_filepath in ${IFACE_FILEPATH_LIST}; do
-    iface_indexes_tmpfile=$(mktemp -q -u '.iface-XXXX')
-
-    (grep -Pn '^\s*iface' "${iface_filepath}" | cut -d':' -f1 && wc -l "${iface_filepath}" | cut -d' ' -f1) |
-      awk 'FNR==1 {line=$0; next} {print line":"$0-1; line=$0}' >"${iface_indexes_tmpfile}" || true
-
-    if [ -f "${iface_indexes_tmpfile}" ]; then
-      while read -r pair; do
-        start=$(echo "${pair}" | cut -d':' -f1)
-        end=$(echo "${pair}" | cut -d':' -f2)
-
-        if awk "NR >= ${start} && NR <= ${end}" "${iface_filepath}" | grep -qP '^\s*(bridge[-_](ports|stp|fd|vlan-aware|vids)|ovs_type\s+OVSBridge)\b'; then
-          iface_name=$(sed "${start}q;d" "${iface_filepath}" | awk '{print $2}')
-          BRIDGES="${iface_name}"$'\n'"${BRIDGES}"
-        fi
-
-      done <"${iface_indexes_tmpfile}"
-      rm -f "${iface_indexes_tmpfile}"
-    fi
-
-  done
-
-  IFS=$OLD_IFS
-
-  BRIDGES=$(echo "$BRIDGES" | grep -v '^\s*$' | sort | uniq)
-
-  if [[ -z "$BRIDGES" ]]; then
-    BRG="vmbr0"
-    echo -e "${BRIDGE}${BOLD}${DGN}Bridge: ${BGN}$BRG${CL}"
-  else
-    BRG=$(whiptail --backtitle "Proxmox VE Helper Scripts" --menu "Select network bridge:" 15 40 6 $(echo "$BRIDGES" | awk '{print $0, "Bridge"}') 3>&1 1>&2 2>&3)
-    if [ -z "$BRG" ]; then
-      exit_script
-    else
-      echo -e "${BRIDGE}${BOLD}${DGN}Bridge: ${BGN}$BRG${CL}"
-    fi
-  fi
-
-  # IPv4 methods: dhcp, static, none
-  while true; do
-    IPV4_METHOD=$(whiptail --backtitle "Proxmox VE Helper Scripts" \
-      --title "IPv4 Address Management" \
-      --menu "Select IPv4 Address Assignment Method:" 12 60 2 \
-      "dhcp" "Automatic (DHCP, recommended)" \
-      "static" "Static (manual entry)" \
-      3>&1 1>&2 2>&3)
-
-    exit_status=$?
-    if [ $exit_status -ne 0 ]; then
-      exit_script
-    fi
-
-    case "$IPV4_METHOD" in
-    dhcp)
-      NET="dhcp"
-      GATE=""
-      echo -e "${NETWORK}${BOLD}${DGN}IPv4: DHCP${CL}"
-      break
-      ;;
-    static)
-      # Static: call and validate CIDR address
-      while true; do
-        NET=$(whiptail --backtitle "Proxmox VE Helper Scripts" \
-          --inputbox "Enter Static IPv4 CIDR Address (e.g. 192.168.100.50/24)" 8 58 "" \
-          --title "IPv4 ADDRESS" 3>&1 1>&2 2>&3)
-        if [ -z "$NET" ]; then
-          whiptail --msgbox "IPv4 address must not be empty." 8 58
-          continue
-        elif [[ "$NET" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$ ]]; then
-          echo -e "${NETWORK}${BOLD}${DGN}IPv4 Address: ${BGN}$NET${CL}"
-          break
-        else
-          whiptail --msgbox "$NET is not a valid IPv4 CIDR address. Please enter a correct value!" 8 58
-        fi
-      done
-
-      # call and validate Gateway
-      while true; do
-        GATE1=$(whiptail --backtitle "Proxmox VE Helper Scripts" \
-          --inputbox "Enter Gateway IP address for static IPv4" 8 58 "" \
-          --title "Gateway IP" 3>&1 1>&2 2>&3)
-        if [ -z "$GATE1" ]; then
-          whiptail --msgbox "Gateway IP address cannot be empty." 8 58
-        elif [[ ! "$GATE1" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
-          whiptail --msgbox "Invalid Gateway IP address format." 8 58
-        else
-          GATE=",gw=$GATE1"
-          echo -e "${GATEWAY}${BOLD}${DGN}Gateway IP Address: ${BGN}$GATE1${CL}"
-          break
-        fi
-      done
-      break
-      ;;
-    esac
-  done
-
-  # IPv6 Address Management selection
-  while true; do
-    IPV6_METHOD=$(whiptail --backtitle "Proxmox VE Helper Scripts" --menu \
-      "Select IPv6 Address Management Type:" 16 70 5 \
-      "auto" "SLAAC/AUTO (recommended) - Dynamic IPv6 from network" \
-      "dhcp" "DHCPv6 - DHCP-assigned IPv6 address" \
-      "static" "Static - Manual IPv6 address configuration" \
-      "none" "None - No IPv6 assignment (most containers)" \
-      "disable" "Fully Disabled - (breaks some services)" \
-      --default-item "auto" 3>&1 1>&2 2>&3)
-    [ $? -ne 0 ] && exit_script
-
-    case "$IPV6_METHOD" in
-    auto)
-      echo -e "${NETWORK}${BOLD}${DGN}IPv6: ${BGN}SLAAC/AUTO${CL}"
-      IPV6_ADDR=""
-      IPV6_GATE=""
-      break
-      ;;
-    dhcp)
-      echo -e "${NETWORK}${BOLD}${DGN}IPv6: ${BGN}DHCPv6${CL}"
-      IPV6_ADDR="dhcp"
-      IPV6_GATE=""
-      break
-      ;;
-    static)
-      # Ask for static IPv6 address (CIDR notation, e.g., 2001:db8::1234/64)
-      while true; do
-        IPV6_ADDR=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox \
-          "Set a static IPv6 CIDR address (e.g., 2001:db8::1234/64)" 8 58 "" \
-          --title "IPv6 STATIC ADDRESS" 3>&1 1>&2 2>&3) || exit_script
-        if [[ "$IPV6_ADDR" =~ ^([0-9a-fA-F:]+:+)+[0-9a-fA-F]+(/[0-9]{1,3})$ ]]; then
-          echo -e "${NETWORK}${BOLD}${DGN}IPv6 Address: ${BGN}$IPV6_ADDR${CL}"
-          break
-        else
-          whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox \
-            "$IPV6_ADDR is an invalid IPv6 CIDR address. Please enter a valid IPv6 CIDR address (e.g., 2001:db8::1234/64)" 8 58
-        fi
-      done
-      # Optional: ask for IPv6 gateway for static config
-      while true; do
-        IPV6_GATE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox \
-          "Enter IPv6 gateway address (optional, leave blank for none)" 8 58 "" --title "IPv6 GATEWAY" 3>&1 1>&2 2>&3)
-        if [ -z "$IPV6_GATE" ]; then
-          IPV6_GATE=""
-          break
-        elif [[ "$IPV6_GATE" =~ ^([0-9a-fA-F:]+:+)+[0-9a-fA-F]+$ ]]; then
-          break
-        else
-          whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox \
-            "Invalid IPv6 gateway format." 8 58
-
-        fi
-      done
-      break
-      ;;
-    none)
-      echo -e "${NETWORK}${BOLD}${DGN}IPv6: ${BGN}None${CL}"
-      IPV6_ADDR="none"
-      IPV6_GATE=""
-      break
-      ;;
-    disable)
-      whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox \
-        "⚠️  WARNING - FULLY DISABLE IPv6:\n\nThis will completely disable IPv6 inside the container via sysctl.\n\nSide Effects:\n  • Services requiring IPv6 will fail\n  • Localhost IPv6 (::1) will not work\n  • Some applications may not start\n\nOnly use if you have a specific reason to completely disable IPv6.\n\nFor most use cases, select 'None' instead." 14 70
-      echo -e "${NETWORK}${BOLD}${DGN}IPv6: ${BGN}Fully Disabled (IPv6 disabled via sysctl)${CL}"
-      IPV6_ADDR="none"
-      IPV6_GATE=""
-      break
-      ;;
-    *)
-      exit_script
-      ;;
-    esac
-  done
-
-  if [ "$var_os" == "alpine" ]; then
-    APT_CACHER=""
-    APT_CACHER_IP=""
-  else
-    if APT_CACHER_IP=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set APT-Cacher IP (leave blank for none)" 8 58 --title "APT-Cacher IP" 3>&1 1>&2 2>&3); then
-      APT_CACHER="${APT_CACHER_IP:+yes}"
-      echo -e "${NETWORK}${BOLD}${DGN}APT-Cacher IP Address: ${BGN}${APT_CACHER_IP:-Default}${CL}"
-    else
-      exit_script
-    fi
-  fi
-
-  if MTU1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Interface MTU Size (leave blank for default [The MTU of your selected vmbr, default is 1500])" 8 58 --title "MTU SIZE" 3>&1 1>&2 2>&3); then
-    if [ -z "$MTU1" ]; then
-      MTU1="Default"
-      MTU=""
-    else
-      MTU=",mtu=$MTU1"
-    fi
-    echo -e "${DEFAULT}${BOLD}${DGN}Interface MTU Size: ${BGN}$MTU1${CL}"
-  else
-    exit_script
-  fi
-
-  if SD=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a DNS Search Domain (leave blank for HOST)" 8 58 --title "DNS Search Domain" 3>&1 1>&2 2>&3); then
-    if [ -z "$SD" ]; then
-      SX=Host
-      SD=""
-    else
-      SX=$SD
-      SD="-searchdomain=$SD"
-    fi
-    echo -e "${SEARCH}${BOLD}${DGN}DNS Search Domain: ${BGN}$SX${CL}"
-  else
-    exit_script
-  fi
-
-  if NX=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a DNS Server IP (leave blank for HOST)" 8 58 --title "DNS SERVER IP" 3>&1 1>&2 2>&3); then
-    if [ -z "$NX" ]; then
-      NX=Host
-      NS=""
-    else
-      NS="-nameserver=$NX"
-    fi
-    echo -e "${NETWORK}${BOLD}${DGN}DNS Server IP Address: ${BGN}$NX${CL}"
-  else
-    exit_script
-  fi
-
-  if MAC1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a MAC Address(leave blank for generated MAC)" 8 58 --title "MAC ADDRESS" 3>&1 1>&2 2>&3); then
-    if [ -z "$MAC1" ]; then
-      MAC1="Default"
-      MAC=""
-    else
-      MAC=",hwaddr=$MAC1"
-      echo -e "${MACADDRESS}${BOLD}${DGN}MAC Address: ${BGN}$MAC1${CL}"
-    fi
-  else
-    exit_script
-  fi
-
-  if VLAN1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a Vlan(leave blank for no VLAN)" 8 58 --title "VLAN" 3>&1 1>&2 2>&3); then
-    if [ -z "$VLAN1" ]; then
-      VLAN1="Default"
-      VLAN=""
-    else
-      VLAN=",tag=$VLAN1"
-    fi
-    echo -e "${VLANTAG}${BOLD}${DGN}Vlan: ${BGN}$VLAN1${CL}"
-  else
-    exit_script
-  fi
-
-  if ADV_TAGS=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Custom Tags?[If you remove all, there will be no tags!]" 8 58 "${TAGS}" --title "Advanced Tags" 3>&1 1>&2 2>&3); then
-    if [ -n "${ADV_TAGS}" ]; then
-      ADV_TAGS=$(echo "$ADV_TAGS" | tr -d '[:space:]')
-      TAGS="${ADV_TAGS}"
-    else
-      TAGS=";"
-    fi
-    echo -e "${NETWORK}${BOLD}${DGN}Tags: ${BGN}$TAGS${CL}"
-  else
-    exit_script
-  fi
-
-  SSH_AUTHORIZED_KEY="$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "SSH Authorized key for root (leave empty for none)" 8 58 --title "SSH Key" 3>&1 1>&2 2>&3)"
-
-  if [[ -z "${SSH_AUTHORIZED_KEY}" ]]; then
-    SSH_AUTHORIZED_KEY=""
-  fi
-
-  if [[ "$PW" == -password* || -n "$SSH_AUTHORIZED_KEY" ]]; then
-    if (whiptail --backtitle "Proxmox VE Helper Scripts" --defaultno --title "SSH ACCESS" --yesno "Enable Root SSH Access?" 10 58); then
-      SSH="yes"
-    else
-      SSH="no"
-    fi
-    echo -e "${ROOTSSH}${BOLD}${DGN}Root SSH Access: ${BGN}$SSH${CL}"
-  else
-    SSH="no"
-    echo -e "${ROOTSSH}${BOLD}${DGN}Root SSH Access: ${BGN}$SSH${CL}"
-  fi
-
-  if (whiptail --backtitle "Proxmox VE Helper Scripts" --defaultno --title "FUSE Support" --yesno "Enable FUSE support?\nRequired for tools like rclone, mergerfs, AppImage, etc." 10 58); then
-    ENABLE_FUSE="yes"
-  else
-    ENABLE_FUSE="no"
-  fi
-  echo -e "${FUSE}${BOLD}${DGN}Enable FUSE Support: ${BGN}$ENABLE_FUSE${CL}"
-
-  if (whiptail --backtitle "Proxmox VE Helper Scripts" --defaultno --title "VERBOSE MODE" --yesno "Enable Verbose Mode?" 10 58); then
-    VERBOSE="yes"
-  else
-    VERBOSE="no"
-  fi
-  echo -e "${SEARCH}${BOLD}${DGN}Verbose Mode: ${BGN}$VERBOSE${CL}"
-
-  if (whiptail --backtitle "Proxmox VE Helper Scripts" --title "ADVANCED SETTINGS COMPLETE" --yesno "Ready to create ${APP} LXC?" 10 58); then
-    echo -e "${CREATING}${BOLD}${RD}Creating a ${APP} LXC using the above advanced settings${CL}"
-
-    # Strip prefixes from DNS parameters for config file storage
-    local SD_VALUE="$SD"
-    local NS_VALUE="$NS"
-    local MAC_VALUE="$MAC"
-    local VLAN_VALUE="$VLAN"
-    [[ "$SD" =~ ^-searchdomain= ]] && SD_VALUE="${SD#-searchdomain=}"
-    [[ "$NS" =~ ^-nameserver= ]] && NS_VALUE="${NS#-nameserver=}"
-    [[ "$MAC" =~ ^,hwaddr= ]] && MAC_VALUE="${MAC#,hwaddr=}"
-    [[ "$VLAN" =~ ^,tag= ]] && VLAN_VALUE="${VLAN#,tag=}"
-
-    # Temporarily store original values
-    local SD_ORIG="$SD"
-    local NS_ORIG="$NS"
-    local MAC_ORIG="$MAC"
-    local VLAN_ORIG="$VLAN"
-
-    # Set clean values for config file writing
-    SD="$SD_VALUE"
-    NS="$NS_VALUE"
-    MAC="$MAC_VALUE"
-    VLAN="$VLAN_VALUE"
-
-    write_config
-
-    # Restore original formatted values for container creation
-    SD="$SD_ORIG"
-    NS="$NS_ORIG"
-    MAC="$MAC_ORIG"
-    VLAN="$VLAN_ORIG"
-  else
-    clear
-    header_info
-    echo -e "${ADVANCED}${BOLD}${RD}Using Advanced Settings on node $PVEHOST_NAME${CL}"
-    advanced_settings
-  fi
-}
-
-diagnostics_check() {
-  if ! [ -d "/usr/local/community-scripts" ]; then
-    mkdir -p /usr/local/community-scripts
-  fi
-
-  if ! [ -f "/usr/local/community-scripts/diagnostics" ]; then
-    if (whiptail --backtitle "Proxmox VE Helper Scripts" --title "DIAGNOSTICS" --yesno "Send Diagnostics of LXC Installation?\n\n(This only transmits data without user data, just RAM, CPU, LXC name, ...)" 10 58); then
-      cat <<EOF >/usr/local/community-scripts/diagnostics
-DIAGNOSTICS=yes
-
-#This file is used to store the diagnostics settings for the Community-Scripts API.
-#https://github.com/community-scripts/ProxmoxVE/discussions/1836
-#Your diagnostics will be sent to the Community-Scripts API for troubleshooting/statistical purposes.
-#You can review the data at https://community-scripts.github.io/ProxmoxVE/data
-#If you do not wish to send diagnostics, please set the variable 'DIAGNOSTICS' to "no" in /usr/local/community-scripts/diagnostics, or use the menue.
-#This will disable the diagnostics feature.
-#To send diagnostics, set the variable 'DIAGNOSTICS' to "yes" in /usr/local/community-scripts/diagnostics, or use the menue.
-#This will enable the diagnostics feature.
-#The following information will be sent:
-#"ct_type"
-#"disk_size"
-#"core_count"
-#"ram_size"
-#"os_type"
-#"os_version"
-#"nsapp"
-#"method"
-#"pve_version"
-#"status"
-#If you have any concerns, please review the source code at /misc/build.func
-EOF
-      DIAGNOSTICS="yes"
-    else
-      cat <<EOF >/usr/local/community-scripts/diagnostics
-DIAGNOSTICS=no
-
-#This file is used to store the diagnostics settings for the Community-Scripts API.
-#https://github.com/community-scripts/ProxmoxVE/discussions/1836
-#Your diagnostics will be sent to the Community-Scripts API for troubleshooting/statistical purposes.
-#You can review the data at https://community-scripts.github.io/ProxmoxVE/data
-#If you do not wish to send diagnostics, please set the variable 'DIAGNOSTICS' to "no" in /usr/local/community-scripts/diagnostics, or use the menue.
-#This will disable the diagnostics feature.
-#To send diagnostics, set the variable 'DIAGNOSTICS' to "yes" in /usr/local/community-scripts/diagnostics, or use the menue.
-#This will enable the diagnostics feature.
-#The following information will be sent:
-#"ct_type"
-#"disk_size"
-#"core_count"
-#"ram_size"
-#"os_type"
-#"os_version"
-#"nsapp"
-#"method"
-#"pve_version"
-#"status"
-#If you have any concerns, please review the source code at /misc/build.func
-EOF
-      DIAGNOSTICS="no"
-    fi
-  else
-    DIAGNOSTICS=$(awk -F '=' '/^DIAGNOSTICS/ {print $2}' /usr/local/community-scripts/diagnostics)
-
-  fi
-
-}
-
-install_script() {
-  pve_check
-  shell_check
-  root_check
-  arch_check
-  ssh_check
-  maxkeys_check
-  diagnostics_check
-
-  if systemctl is-active -q ping-instances.service; then
-    systemctl -q stop ping-instances.service
-  fi
-  NEXTID=$(pvesh get /cluster/nextid)
-  # Read timezone - fallback for Debian 13/Proxmox 9+ where /etc/timezone doesn't exist
-  if [[ -f /etc/timezone ]]; then
-    timezone=$(cat /etc/timezone)
-  else
-    timezone=$(timedatectl show --value --property=Timezone 2>/dev/null || echo "UTC")
-  fi
-  header_info
-  while true; do
-
-    TMP_CHOICE=$(whiptail --backtitle "Proxmox VE Helper Scripts" \
-      --title "SETTINGS" \
-      --menu "Choose an option:" 20 60 6 \
-      "1" "Default Settings" \
-      "2" "Default Settings (with verbose)" \
-      "3" "Advanced Settings" \
-      "4" "Use Config File" \
-      "5" "Diagnostic Settings" \
-      "6" "Exit" \
-      --default-item "1" 3>&1 1>&2 2>&3) || true
-
-    if [ -z "$TMP_CHOICE" ]; then
-      echo -e "\n${CROSS}${RD}Menu canceled. Exiting script.${CL}\n"
-      exit 0
-    fi
-
-    CHOICE="$TMP_CHOICE"
-
-    case $CHOICE in
-    1)
-      header_info
-      echo -e "${DEFAULT}${BOLD}${BL}Using Default Settings on node $PVEHOST_NAME${CL}"
-      VERBOSE="no"
-      METHOD="default"
-      base_settings "$VERBOSE"
-      echo_default
-      break
-      ;;
-    2)
-      header_info
-      echo -e "${DEFAULT}${BOLD}${BL}Using Default Settings on node $PVEHOST_NAME (${VERBOSE_CROPPED}Verbose)${CL}"
-      VERBOSE="yes"
-      METHOD="default"
-      base_settings "$VERBOSE"
-      echo_default
-      break
-      ;;
-    3)
-      header_info
-      echo -e "${ADVANCED}${BOLD}${RD}Using Advanced Settings on node $PVEHOST_NAME${CL}"
-      METHOD="advanced"
-      base_settings
-      advanced_settings
-      break
-      ;;
-    4)
-      header_info
-      echo -e "${INFO}${HOLD} ${GN}Using Config File on node $PVEHOST_NAME${CL}"
-      METHOD="config_file"
-      source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/config-file.func)
-      config_file
-      break
-      ;;
-    5)
-      if [[ $DIAGNOSTICS == "yes" ]]; then
-        if whiptail --backtitle "Proxmox VE Helper Scripts" --title "DIAGNOSTICS SETTINGS" --yesno "Send Diagnostics of LXC Installation?\n\nCurrent setting: ${DIAGNOSTICS}" 10 58 \
-          --yes-button "No" --no-button "Back"; then
-          DIAGNOSTICS="no"
-          sed -i 's/^DIAGNOSTICS=.*/DIAGNOSTICS=no/' /usr/local/community-scripts/diagnostics
-          whiptail --backtitle "Proxmox VE Helper Scripts" --title "DIAGNOSTICS SETTINGS" --msgbox "Diagnostics settings changed to ${DIAGNOSTICS}." 8 58
-        fi
-      else
-        if whiptail --backtitle "Proxmox VE Helper Scripts" --title "DIAGNOSTICS SETTINGS" --yesno "Send Diagnostics of LXC Installation?\n\nCurrent setting: ${DIAGNOSTICS}" 10 58 \
-          --yes-button "Yes" --no-button "Back"; then
-          DIAGNOSTICS="yes"
-          sed -i 's/^DIAGNOSTICS=.*/DIAGNOSTICS=yes/' /usr/local/community-scripts/diagnostics
-          whiptail --backtitle "Proxmox VE Helper Scripts" --title "DIAGNOSTICS SETTINGS" --msgbox "Diagnostics settings changed to ${DIAGNOSTICS}." 8 58
-        fi
-      fi
-
-      ;;
-    6)
-      echo -e "\n${CROSS}${RD}Script terminated. Have a great day!${CL}\n"
-      exit 0
-      ;;
-    *)
-      echo -e "\n${CROSS}${RD}Invalid option, please try again.${CL}\n"
-      ;;
-    esac
-  done
-}
-
-check_container_resources() {
-  # Check actual RAM & Cores
-  current_ram=$(free -m | awk 'NR==2{print $2}')
-  current_cpu=$(nproc)
-
-  # Check whether the current RAM is less than the required RAM or the CPU cores are less than required
-  if [[ "$current_ram" -lt "$var_ram" ]] || [[ "$current_cpu" -lt "$var_cpu" ]]; then
-    echo -e "\n${INFO}${HOLD} ${GN}Required: ${var_cpu} CPU, ${var_ram}MB RAM ${CL}| ${RD}Current: ${current_cpu} CPU, ${current_ram}MB RAM${CL}"
-    echo -e "${YWB}Please ensure that the ${APP} LXC is configured with at least ${var_cpu} vCPU and ${var_ram} MB RAM for the build process.${CL}\n"
-    echo -ne "${INFO}${HOLD} May cause data loss! ${INFO} Continue update with under-provisioned LXC? [y/N] "
-    read -r prompt
-    if [[ ! "${prompt,,}" =~ ^(y|yes)$ ]]; then
-      echo -e "${CROSS}${HOLD} ${YWB}Exiting based on user input.${CL}"
-      exit 1
-    fi
-  else
-    echo -e ""
-  fi
-}
-
-check_container_storage() {
-  # Check if the /boot partition is more than 80% full
-  total_size=$(df /boot --output=size | tail -n 1)
-  local used_size=$(df /boot --output=used | tail -n 1)
-  usage=$((100 * used_size / total_size))
-  if ((usage > 80)); then
-    # Prompt the user for confirmation to continue
-    echo -e "${INFO}${HOLD} ${YWB}Warning: Storage is dangerously low (${usage}%).${CL}"
-    echo -ne "Continue anyway? [y/N] "
-    read -r prompt
-    if [[ ! "${prompt,,}" =~ ^(y|yes)$ ]]; then
-      echo -e "${CROSS}${HOLD}${YWB}Exiting based on user input.${CL}"
-      exit 1
-    fi
-  fi
-}
-
-start() {
-  source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
-  if command -v pveversion >/dev/null 2>&1; then
-    install_script
-  else
-    CHOICE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "${APP} LXC Update/Setting" --menu \
-      "Support/Update functions for ${APP} LXC. Choose an option:" \
-      12 60 3 \
-      "1" "YES (Silent Mode)" \
-      "2" "YES (Verbose Mode)" \
-      "3" "NO (Cancel Update)" --nocancel --default-item "1" 3>&1 1>&2 2>&3)
-
-    case "$CHOICE" in
-    1)
-      VERBOSE="no"
-      set_std_mode
-      ;;
-    2)
-      VERBOSE="yes"
-      set_std_mode
-      ;;
-    3)
-      clear
-      exit_script
-      exit
-      ;;
-    esac
-    update_script
-    cleanup_lxc
-  fi
-}
-
-# This function collects user settings and integrates all the collected information.
-build_container() {
-  #  if [ "$VERBOSE" == "yes" ]; then set -x; fi
-
-  NET_STRING="-net0 name=eth0,bridge=$BRG$MAC,ip=$NET$GATE$VLAN$MTU"
-  case "$IPV6_METHOD" in
-  auto) NET_STRING="$NET_STRING,ip6=auto" ;;
-  dhcp) NET_STRING="$NET_STRING,ip6=dhcp" ;;
-  static)
-    NET_STRING="$NET_STRING,ip6=$IPV6_ADDR"
-    [ -n "$IPV6_GATE" ] && NET_STRING="$NET_STRING,gw6=$IPV6_GATE"
-    ;;
-  none) ;;
-  esac
-  if [ "$CT_TYPE" == "1" ]; then
-    FEATURES="keyctl=1,nesting=1"
-  else
-    FEATURES="nesting=1"
-  fi
-
-  if [ "$ENABLE_FUSE" == "yes" ]; then
-    FEATURES="$FEATURES,fuse=1"
-  fi
-
-  if [[ $DIAGNOSTICS == "yes" ]]; then
-    post_to_api
-  fi
-
-  TEMP_DIR=$(mktemp -d)
-  pushd "$TEMP_DIR" >/dev/null
-  if [ "$var_os" == "alpine" ]; then
-    export FUNCTIONS_FILE_PATH="$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/alpine-install.func)"
-  else
-    export FUNCTIONS_FILE_PATH="$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/install.func)"
-  fi
-
-  export DIAGNOSTICS="$DIAGNOSTICS"
-  export RANDOM_UUID="$RANDOM_UUID"
-  export CACHER="$APT_CACHER"
-  export CACHER_IP="$APT_CACHER_IP"
-  export tz="$timezone"
-  export APPLICATION="$APP"
-  export app="$NSAPP"
-  export PASSWORD="$PW"
-  export VERBOSE="$VERBOSE"
-  export SSH_ROOT="${SSH}"
-  export SSH_AUTHORIZED_KEY
-  export CTID="$CT_ID"
-  export CTTYPE="$CT_TYPE"
-  export ENABLE_FUSE="$ENABLE_FUSE"
-  export ENABLE_TUN="$ENABLE_TUN"
-  export PCT_OSTYPE="$var_os"
-  export PCT_OSVERSION="$var_version"
-  export PCT_DISK_SIZE="$DISK_SIZE"
-  export PCT_OPTIONS="
-    -features $FEATURES
-    -hostname $HN
-    -tags $TAGS
-    $SD
-    $NS
-    $NET_STRING
-    -onboot 1
-    -cores $CORE_COUNT
-    -memory $RAM_SIZE
-    -unprivileged $CT_TYPE
-    $PW
-  "
-  # This executes create_lxc.sh and creates the container and .conf file
-  bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/create_lxc.sh)" $?
-
-  LXC_CONFIG="/etc/pve/lxc/${CTID}.conf"
-
-  # USB passthrough for privileged LXC (CT_TYPE=0)
-  if [ "$CT_TYPE" == "0" ]; then
-    cat <<EOF >>"$LXC_CONFIG"
-# USB passthrough
-lxc.cgroup2.devices.allow: a
-lxc.cap.drop:
-lxc.cgroup2.devices.allow: c 188:* rwm
-lxc.cgroup2.devices.allow: c 189:* rwm
-lxc.mount.entry: /dev/serial/by-id  dev/serial/by-id  none bind,optional,create=dir
-lxc.mount.entry: /dev/ttyUSB0       dev/ttyUSB0       none bind,optional,create=file
-lxc.mount.entry: /dev/ttyUSB1       dev/ttyUSB1       none bind,optional,create=file
-lxc.mount.entry: /dev/ttyACM0       dev/ttyACM0       none bind,optional,create=file
-lxc.mount.entry: /dev/ttyACM1       dev/ttyACM1       none bind,optional,create=file
-EOF
-  fi
-
-  # VAAPI passthrough for privileged containers or known apps
-  VAAPI_APPS=(
-    "immich"
-    "Channels"
-    "Emby"
-    "ErsatzTV"
-    "Frigate"
-    "Jellyfin"
-    "Plex"
-    "Scrypted"
-    "Tdarr"
-    "Unmanic"
-    "Ollama"
-    "FileFlows"
-    "Open WebUI"
-  )
-
-  is_vaapi_app=false
-  for vaapi_app in "${VAAPI_APPS[@]}"; do
-    if [[ "$APP" == "$vaapi_app" ]]; then
-      is_vaapi_app=true
-      break
-    fi
-  done
-
-  if ([ "$CT_TYPE" == "0" ] || [ "$is_vaapi_app" == "true" ]) &&
-    ([[ -e /dev/dri/renderD128 ]] || [[ -e /dev/dri/card0 ]] || [[ -e /dev/fb0 ]]); then
-
-    echo ""
-    msg_custom "⚙️ " "\e[96m" "Configuring VAAPI passthrough for LXC container"
-    if [ "$CT_TYPE" != "0" ]; then
-      msg_custom "⚠️ " "\e[33m" "Container is unprivileged – VAAPI passthrough may not work without additional host configuration (e.g., idmap)."
-    fi
-    msg_custom "ℹ️ " "\e[96m" "VAAPI enables GPU hardware acceleration (e.g., for video transcoding in Jellyfin or Plex)."
-    echo ""
-    read -rp "➤ Automatically mount all available VAAPI devices? [Y/n]: " VAAPI_ALL
-
-    if [[ "$VAAPI_ALL" =~ ^[Yy]$|^$ ]]; then
-      if [ "$CT_TYPE" == "0" ]; then
-        # PRV Container → alles zulässig
-        [[ -e /dev/dri/renderD128 ]] && {
-          echo "lxc.cgroup2.devices.allow: c 226:128 rwm" >>"$LXC_CONFIG"
-          echo "lxc.mount.entry: /dev/dri/renderD128 dev/dri/renderD128 none bind,optional,create=file" >>"$LXC_CONFIG"
-        }
-        [[ -e /dev/dri/card0 ]] && {
-          echo "lxc.cgroup2.devices.allow: c 226:0 rwm" >>"$LXC_CONFIG"
-          echo "lxc.mount.entry: /dev/dri/card0 dev/dri/card0 none bind,optional,create=file" >>"$LXC_CONFIG"
-        }
-        [[ -e /dev/fb0 ]] && {
-          echo "lxc.cgroup2.devices.allow: c 29:0 rwm" >>"$LXC_CONFIG"
-          echo "lxc.mount.entry: /dev/fb0 dev/fb0 none bind,optional,create=file" >>"$LXC_CONFIG"
-        }
-        [[ -d /dev/dri ]] && {
-          echo "lxc.mount.entry: /dev/dri dev/dri none bind,optional,create=dir" >>"$LXC_CONFIG"
-        }
-      else
-        # UNPRV Container → nur devX für UI
-        [[ -e /dev/dri/card0 ]] && echo "dev0: /dev/dri/card0,gid=44" >>"$LXC_CONFIG"
-        [[ -e /dev/dri/card1 ]] && echo "dev0: /dev/dri/card1,gid=44" >>"$LXC_CONFIG"
-        [[ -e /dev/dri/renderD128 ]] && echo "dev1: /dev/dri/renderD128,gid=104" >>"$LXC_CONFIG"
-      fi
-    fi
-
-  fi
-  if [ "$CT_TYPE" == "1" ] && [ "$is_vaapi_app" == "true" ]; then
-    if [[ -e /dev/dri/card0 ]]; then
-      echo "dev0: /dev/dri/card0,gid=44" >>"$LXC_CONFIG"
-    elif [[ -e /dev/dri/card1 ]]; then
-      echo "dev0: /dev/dri/card1,gid=44" >>"$LXC_CONFIG"
-    fi
-    if [[ -e /dev/dri/renderD128 ]]; then
-      echo "dev1: /dev/dri/renderD128,gid=104" >>"$LXC_CONFIG"
-    fi
-  fi
-
-  # TUN device passthrough
-  if [ "$ENABLE_TUN" == "yes" ]; then
-    cat <<EOF >>"$LXC_CONFIG"
-lxc.cgroup2.devices.allow: c 10:200 rwm
-lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
-EOF
-  fi
-
-  # This starts the container and executes <app>-install.sh
-  msg_info "Starting LXC Container"
-  pct start "$CTID"
-
-  # wait for status 'running'
-  for i in {1..10}; do
-    if pct status "$CTID" | grep -q "status: running"; then
-      msg_ok "Started LXC Container"
-      break
-    fi
-    sleep 1
-    if [ "$i" -eq 10 ]; then
-      msg_error "LXC Container did not reach running state"
-      exit 1
-    fi
-  done
-
-  if [ "$var_os" != "alpine" ]; then
-    msg_info "Waiting for network in LXC container"
-    for i in {1..10}; do
-      # 1. Primary check: ICMP ping (fastest, but may be blocked by ISP/firewall)
-      if pct exec "$CTID" -- ping -c1 -W1 deb.debian.org >/dev/null 2>&1; then
-        msg_ok "Network in LXC is reachable (ping)"
-        break
-      fi
-      # Wait and retry if not reachable yet
-      if [ "$i" -lt 10 ]; then
-        msg_warn "No network in LXC yet (try $i/10) – waiting..."
-        sleep 3
-      else
-        # After 10 unsuccessful ping attempts, try HTTP connectivity via wget as fallback
-        msg_warn "Ping failed 10 times. Trying HTTP connectivity check (wget) as fallback..."
-        if pct exec "$CTID" -- wget -q --spider http://deb.debian.org; then
-          msg_ok "Network in LXC is reachable (wget fallback)"
-        else
-          msg_error "No network in LXC after all checks."
-          read -r -p "Set fallback DNS (1.1.1.1/8.8.8.8)? [y/N]: " choice
-          case "$choice" in
-          [yY]*)
-            pct set "$CTID" --nameserver 1.1.1.1
-            pct set "$CTID" --nameserver 8.8.8.8
-            # Final attempt with wget after DNS change
-            if pct exec "$CTID" -- wget -q --spider http://deb.debian.org; then
-              msg_ok "Network reachable after DNS fallback"
-            else
-              msg_error "Still no network/DNS in LXC! Aborting customization."
-              exit_script
-            fi
-            ;;
-          *)
-            msg_error "Aborted by user – no DNS fallback set."
-            exit_script
-            ;;
-          esac
-        fi
-        break
-      fi
-    done
-  fi
-
-  msg_info "Customizing LXC Container"
-  : "${tz:=Etc/UTC}"
-  if [ "$var_os" == "alpine" ]; then
-    sleep 3
-    pct exec "$CTID" -- /bin/sh -c 'cat <<EOF >/etc/apk/repositories
-http://dl-cdn.alpinelinux.org/alpine/latest-stable/main
-http://dl-cdn.alpinelinux.org/alpine/latest-stable/community
-EOF'
-    pct exec "$CTID" -- ash -c "apk add bash newt curl openssh nano mc ncurses jq >/dev/null"
-  else
-    sleep 3
-    LANG=${LANG:-en_US.UTF-8}
-    pct exec "$CTID" -- bash -c "sed -i \"/$LANG/ s/^# //\" /etc/locale.gen"
-    pct exec "$CTID" -- bash -c "locale_line=\$(grep -v '^#' /etc/locale.gen | grep -E '^[a-zA-Z]' | awk '{print \$1}' | head -n 1) && \
-    echo LANG=\$locale_line >/etc/default/locale && \
-    locale-gen >/dev/null && \
-    export LANG=\$locale_line"
-
-    if [[ -z "${tz:-}" ]]; then
-      tz=$(timedatectl show --property=Timezone --value 2>/dev/null || echo "Etc/UTC")
-    fi
-    if pct exec "$CTID" -- test -e "/usr/share/zoneinfo/$tz"; then
-      pct exec "$CTID" -- bash -c "tz='$tz'; echo \"\$tz\" >/etc/timezone && ln -sf \"/usr/share/zoneinfo/\$tz\" /etc/localtime"
-    else
-      msg_warn "Skipping timezone setup – zone '$tz' not found in container"
-    fi
-
-    pct exec "$CTID" -- bash -c "apt-get update >/dev/null && apt-get install -y sudo curl mc gnupg2 jq >/dev/null"
-  fi
-  msg_ok "Customized LXC Container"
-
-  lxc-attach -n "$CTID" -- bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/install/${var_install}.sh)"
-}
-
-# This function sets the description of the container.
-description() {
-  IP=$(pct exec "$CTID" ip a s dev eth0 | awk '/inet / {print $2}' | cut -d/ -f1)
-
-  # Generate LXC Description
-  DESCRIPTION=$(
-    cat <<EOF
-<div align='center'>
-  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
-    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
-  </a>
-
-  <h2 style='font-size: 24px; margin: 20px 0;'>${APP} LXC</h2>
-
-  <p style='margin: 16px 0;'>
-    <a href='https://ko-fi.com/community_scripts' target='_blank' rel='noopener noreferrer'>
-      <img src='https://img.shields.io/badge/&#x2615;-Buy us a coffee-blue' alt='spend Coffee' />
-    </a>
-  </p>
-
-  <span style='margin: 0 10px;'>
-    <i class="fa fa-github fa-fw" style="color: #f5f5f5;"></i>
-    <a href='https://github.com/community-scripts/ProxmoxVE' target='_blank' rel='noopener noreferrer' style='text-decoration: none; color: #00617f;'>GitHub</a>
-  </span>
-  <span style='margin: 0 10px;'>
-    <i class="fa fa-comments fa-fw" style="color: #f5f5f5;"></i>
-    <a href='https://github.com/community-scripts/ProxmoxVE/discussions' target='_blank' rel='noopener noreferrer' style='text-decoration: none; color: #00617f;'>Discussions</a>
-  </span>
-  <span style='margin: 0 10px;'>
-    <i class="fa fa-exclamation-circle fa-fw" style="color: #f5f5f5;"></i>
-    <a href='https://github.com/community-scripts/ProxmoxVE/issues' target='_blank' rel='noopener noreferrer' style='text-decoration: none; color: #00617f;'>Issues</a>
-  </span>
-</div>
-EOF
-  )
-
-  # Set Description in LXC
-  pct set "$CTID" -description "$DESCRIPTION"
-
-  if [[ -f /etc/systemd/system/ping-instances.service ]]; then
-    systemctl start ping-instances.service
-  fi
-
-  post_update_to_api "done" "none"
-}
-
-api_exit_script() {
-  exit_code=$? # Capture the exit status of the last executed command
-  #200 exit codes indicate error in create_lxc.sh
-  #100 exit codes indicate error in install.func
-
-  if [ $exit_code -ne 0 ]; then
-    case $exit_code in
-    100) post_update_to_api "failed" "100: Unexpected error in create_lxc.sh" ;;
-    101) post_update_to_api "failed" "101: No network connection detected in create_lxc.sh" ;;
-    200) post_update_to_api "failed" "200: LXC creation failed in create_lxc.sh" ;;
-    201) post_update_to_api "failed" "201: Invalid Storage class in create_lxc.sh" ;;
-    202) post_update_to_api "failed" "202: User aborted menu in create_lxc.sh" ;;
-    203) post_update_to_api "failed" "203: CTID not set in create_lxc.sh" ;;
-    204) post_update_to_api "failed" "204: PCT_OSTYPE not set in create_lxc.sh" ;;
-    205) post_update_to_api "failed" "205: CTID cannot be less than 100 in create_lxc.sh" ;;
-    206) post_update_to_api "failed" "206: CTID already in use in create_lxc.sh" ;;
-    207) post_update_to_api "failed" "207: Template not found in create_lxc.sh" ;;
-    208) post_update_to_api "failed" "208: Error downloading template in create_lxc.sh" ;;
-    209) post_update_to_api "failed" "209: Container creation failed, but template is intact in create_lxc.sh" ;;
-    *) post_update_to_api "failed" "Unknown error, exit code: $exit_code in create_lxc.sh" ;;
-    esac
-  fi
-}
-
-if command -v pveversion >/dev/null 2>&1; then
-  trap 'api_exit_script' EXIT
-fi
-trap 'post_update_to_api "failed" "$BASH_COMMAND"' ERR
-trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
-trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
diff --git a/misc/old_misc/config-file.func b/misc/old_misc/config-file.func
deleted file mode 100644
index 9799b4a4..00000000
--- a/misc/old_misc/config-file.func
+++ /dev/null
@@ -1,699 +0,0 @@
-config_file() {
-  CONFIG_FILE="/opt/community-scripts/.settings"
-
-  if [[ -f "/opt/community-scripts/${NSAPP}.conf" ]]; then
-    CONFIG_FILE="/opt/community-scripts/${NSAPP}.conf"
-  fi
-
-  if CONFIG_FILE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set absolute path to config file" 8 58 "$CONFIG_FILE" --title "CONFIG FILE" 3>&1 1>&2 2>&3); then
-    if [[ ! -f "$CONFIG_FILE" ]]; then
-      echo -e "${CROSS}${RD}Config file not found, exiting script!.${CL}"
-      exit
-    else
-      echo -e "${INFO}${BOLD}${DGN}Using config File: ${BGN}$CONFIG_FILE${CL}"
-      source "$CONFIG_FILE"
-    fi
-  fi
-  if [[ -n "${CT_ID-}" ]]; then
-    if [[ "$CT_ID" =~ ^([0-9]{3,4})-([0-9]{3,4})$ ]]; then
-      MIN_ID=${BASH_REMATCH[1]}
-      MAX_ID=${BASH_REMATCH[2]}
-      if ((MIN_ID >= MAX_ID)); then
-        msg_error "Invalid Container ID range. The first number must be smaller than the second number, was ${CT_ID}"
-        exit
-      fi
-
-      LIST_OF_IDS=$(pvesh get /cluster/resources --type vm --output-format json 2>/dev/null | grep -oP '"vmid":\s*\K\d+') || true
-      if [[ -n "$LIST_OF_IDS" ]]; then
-        for ((ID = MIN_ID; ID <= MAX_ID; ID++)); do
-          if ! grep -q "^$ID$" <<<"$LIST_OF_IDS"; then
-            CT_ID=$ID
-            break
-          fi
-        done
-      fi
-      echo -e "${CONTAINERID}${BOLD}${DGN}Container ID: ${BGN}$CT_ID${CL}"
-
-    elif [[ "$CT_ID" =~ ^[0-9]+$ ]]; then
-      LIST_OF_IDS=$(pvesh get /cluster/resources --type vm --output-format json 2>/dev/null | grep -oP '"vmid":\s*\K\d+') || true
-      if [[ -n "$LIST_OF_IDS" ]]; then
-
-        if ! grep -q "^$CT_ID$" <<<"$LIST_OF_IDS"; then
-          echo -e "${CONTAINERID}${BOLD}${DGN}Container ID: ${BGN}$CT_ID${CL}"
-        else
-          msg_error "Container ID $CT_ID already exists"
-          exit
-        fi
-      else
-        echo -e "${CONTAINERID}${BOLD}${DGN}Container ID: ${BGN}$CT_ID${CL}"
-      fi
-    else
-      msg_error "Invalid Container ID format. Needs to be 0000-9999 or 0-9999, was ${CT_ID}"
-      exit
-    fi
-  else
-    if CT_ID=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Container ID" 8 58 "$NEXTID" --title "CONTAINER ID" 3>&1 1>&2 2>&3); then
-      if [ -z "$CT_ID" ]; then
-        CT_ID="$NEXTID"
-        echo -e "${CONTAINERID}${BOLD}${DGN}Container ID: ${BGN}$CT_ID${CL}"
-      else
-        echo -e "${CONTAINERID}${BOLD}${DGN}Container ID: ${BGN}$CT_ID${CL}"
-      fi
-    else
-      exit_script
-    fi
-
-  fi
-  if [[ -n "${CT_TYPE-}" ]]; then
-    if [[ "$CT_TYPE" -eq 0 ]]; then
-      CT_TYPE_DESC="Privileged"
-    elif [[ "$CT_TYPE" -eq 1 ]]; then
-      CT_TYPE_DESC="Unprivileged"
-    else
-      msg_error "Unknown setting for CT_TYPE, should be 1 or 0, was ${CT_TYPE}"
-      exit
-    fi
-    echo -e "${CONTAINERTYPE}${BOLD}${DGN}Container Type: ${BGN}$CT_TYPE_DESC${CL}"
-  else
-    if CT_TYPE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "CONTAINER TYPE" --radiolist "Choose Type" 10 58 2 \
-      "1" "Unprivileged" ON \
-      "0" "Privileged" OFF \
-      3>&1 1>&2 2>&3); then
-      if [ -n "$CT_TYPE" ]; then
-        CT_TYPE_DESC="Unprivileged"
-        if [ "$CT_TYPE" -eq 0 ]; then
-          CT_TYPE_DESC="Privileged"
-        fi
-        echo -e "${CONTAINERTYPE}${BOLD}${DGN}Container Type: ${BGN}$CT_TYPE_DESC${CL}"
-      fi
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${PW-}" ]]; then
-    if [[ "$PW" == "none" ]]; then
-      PW=""
-    else
-      if [[ "$PW" == *" "* ]]; then
-        msg_error "Password cannot be empty"
-        exit
-      elif [[ ${#PW} -lt 5 ]]; then
-        msg_error "Password must be at least 5 characters long"
-        exit
-      else
-        echo -e "${VERIFYPW}${BOLD}${DGN}Root Password: ${BGN}********${CL}"
-      fi
-      PW="-password $PW"
-    fi
-  else
-    while true; do
-      if PW1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --passwordbox "\nSet Root Password (needed for root ssh access)" 9 58 --title "PASSWORD (leave blank for automatic login)" 3>&1 1>&2 2>&3); then
-        if [[ -n "$PW1" ]]; then
-          if [[ "$PW1" == *" "* ]]; then
-            whiptail --msgbox "Password cannot contain spaces. Please try again." 8 58
-          elif [ ${#PW1} -lt 5 ]; then
-            whiptail --msgbox "Password must be at least 5 characters long. Please try again." 8 58
-          else
-            if PW2=$(whiptail --backtitle "Proxmox VE Helper Scripts" --passwordbox "\nVerify Root Password" 9 58 --title "PASSWORD VERIFICATION" 3>&1 1>&2 2>&3); then
-              if [[ "$PW1" == "$PW2" ]]; then
-                PW="-password $PW1"
-                echo -e "${VERIFYPW}${BOLD}${DGN}Root Password: ${BGN}********${CL}"
-                break
-              else
-                whiptail --msgbox "Passwords do not match. Please try again." 8 58
-              fi
-            else
-              exit_script
-            fi
-          fi
-        else
-          PW1="Automatic Login"
-          PW=""
-          echo -e "${VERIFYPW}${BOLD}${DGN}Root Password: ${BGN}$PW1${CL}"
-          break
-        fi
-      else
-        exit_script
-      fi
-    done
-  fi
-
-  if [[ -n "${HN-}" ]]; then
-    echo -e "${HOSTNAME}${BOLD}${DGN}Hostname: ${BGN}$HN${CL}"
-  else
-    if CT_NAME=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Hostname" 8 58 "$NSAPP" --title "HOSTNAME" 3>&1 1>&2 2>&3); then
-      if [ -z "$CT_NAME" ]; then
-        HN="$NSAPP"
-      else
-        HN=$(echo "${CT_NAME,,}" | tr -d ' ')
-      fi
-      echo -e "${HOSTNAME}${BOLD}${DGN}Hostname: ${BGN}$HN${CL}"
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${DISK_SIZE-}" ]]; then
-    if [[ "$DISK_SIZE" =~ ^-?[0-9]+$ ]]; then
-      echo -e "${DISKSIZE}${BOLD}${DGN}Disk Size: ${BGN}${DISK_SIZE} GB${CL}"
-    else
-      msg_error "DISK_SIZE must be an integer, was ${DISK_SIZE}"
-      exit
-    fi
-  else
-    if DISK_SIZE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Disk Size in GB" 8 58 "$var_disk" --title "DISK SIZE" 3>&1 1>&2 2>&3); then
-      if [ -z "$DISK_SIZE" ]; then
-        DISK_SIZE="$var_disk"
-        echo -e "${DISKSIZE}${BOLD}${DGN}Disk Size: ${BGN}${DISK_SIZE} GB${CL}"
-      else
-        if ! [[ $DISK_SIZE =~ $INTEGER ]]; then
-          echo -e "{INFO}${HOLD}${RD} DISK SIZE MUST BE AN INTEGER NUMBER!${CL}"
-          advanced_settings
-        fi
-        echo -e "${DISKSIZE}${BOLD}${DGN}Disk Size: ${BGN}${DISK_SIZE} GB${CL}"
-      fi
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${CORE_COUNT-}" ]]; then
-    if [[ "$CORE_COUNT" =~ ^-?[0-9]+$ ]]; then
-      echo -e "${CPUCORE}${BOLD}${DGN}CPU Cores: ${BGN}${CORE_COUNT}${CL}"
-    else
-      msg_error "CORE_COUNT must be an integer, was ${CORE_COUNT}"
-      exit
-    fi
-  else
-    if CORE_COUNT=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Allocate CPU Cores" 8 58 "$var_cpu" --title "CORE COUNT" 3>&1 1>&2 2>&3); then
-      if [ -z "$CORE_COUNT" ]; then
-        CORE_COUNT="$var_cpu"
-        echo -e "${CPUCORE}${BOLD}${DGN}CPU Cores: ${BGN}$CORE_COUNT${CL}"
-      else
-        echo -e "${CPUCORE}${BOLD}${DGN}CPU Cores: ${BGN}$CORE_COUNT${CL}"
-      fi
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${RAM_SIZE-}" ]]; then
-    if [[ "$RAM_SIZE" =~ ^-?[0-9]+$ ]]; then
-      echo -e "${RAMSIZE}${BOLD}${DGN}RAM Size: ${BGN}${RAM_SIZE} MiB${CL}"
-    else
-      msg_error "RAM_SIZE must be an integer, was ${RAM_SIZE}"
-      exit
-    fi
-  else
-    if RAM_SIZE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Allocate RAM in MiB" 8 58 "$var_ram" --title "RAM" 3>&1 1>&2 2>&3); then
-      if [ -z "$RAM_SIZE" ]; then
-        RAM_SIZE="$var_ram"
-        echo -e "${RAMSIZE}${BOLD}${DGN}RAM Size: ${BGN}${RAM_SIZE} MiB${CL}"
-      else
-        echo -e "${RAMSIZE}${BOLD}${DGN}RAM Size: ${BGN}${RAM_SIZE} MiB${CL}"
-      fi
-    else
-      exit_script
-    fi
-  fi
-
-  IFACE_FILEPATH_LIST="/etc/network/interfaces"$'\n'$(find "/etc/network/interfaces.d/" -type f)
-  BRIDGES=""
-  OLD_IFS=$IFS
-  IFS=$'\n'
-
-  for iface_filepath in ${IFACE_FILEPATH_LIST}; do
-
-    iface_indexes_tmpfile=$(mktemp -q -u '.iface-XXXX')
-    (grep -Pn '^\s*iface' "${iface_filepath}" | cut -d':' -f1 && wc -l "${iface_filepath}" | cut -d' ' -f1) | awk 'FNR==1 {line=$0; next} {print line":"$0-1; line=$0}' >"${iface_indexes_tmpfile}" || true
-
-    if [ -f "${iface_indexes_tmpfile}" ]; then
-
-      while read -r pair; do
-        start=$(echo "${pair}" | cut -d':' -f1)
-        end=$(echo "${pair}" | cut -d':' -f2)
-        if awk "NR >= ${start} && NR <= ${end}" "${iface_filepath}" | grep -qP '^\s*(bridge[-_](ports|stp|fd|vlan-aware|vids)|ovs_type\s+OVSBridge)\b'; then
-          iface_name=$(sed "${start}q;d" "${iface_filepath}" | awk '{print $2}')
-          BRIDGES="${iface_name}"$'\n'"${BRIDGES}"
-        fi
-
-      done <"${iface_indexes_tmpfile}"
-      rm -f "${iface_indexes_tmpfile}"
-    fi
-
-  done
-  IFS=$OLD_IFS
-  BRIDGES=$(echo "$BRIDGES" | grep -v '^\s*$' | sort | uniq)
-
-  if [[ -n "${BRG-}" ]]; then
-    if echo "$BRIDGES" | grep -q "${BRG}"; then
-      echo -e "${BRIDGE}${BOLD}${DGN}Bridge: ${BGN}$BRG${CL}"
-    else
-      msg_error "Bridge '${BRG}' does not exist in /etc/network/interfaces or /etc/network/interfaces.d/sdn"
-      exit
-    fi
-  else
-    BRG=$(whiptail --backtitle "Proxmox VE Helper Scripts" --menu "Select network bridge:" 15 40 6 $(echo "$BRIDGES" | awk '{print $0, "Bridge"}') 3>&1 1>&2 2>&3)
-    if [ -z "$BRG" ]; then
-      exit_script
-    else
-      echo -e "${BRIDGE}${BOLD}${DGN}Bridge: ${BGN}$BRG${CL}"
-    fi
-  fi
-
-  local ip_cidr_regex='^([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})/([0-9]{1,2})$'
-  local ip_regex='^([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$'
-
-  if [[ -n ${NET-} ]]; then
-    if [ "$NET" == "dhcp" ]; then
-      echo -e "${NETWORK}${BOLD}${DGN}IP Address: ${BGN}DHCP${CL}"
-      echo -e "${GATEWAY}${BOLD}${DGN}Gateway IP Address: ${BGN}Default${CL}"
-      GATE=""
-    elif [[ "$NET" =~ $ip_cidr_regex ]]; then
-      echo -e "${NETWORK}${BOLD}${DGN}IP Address: ${BGN}$NET${CL}"
-      if [[ -n "$GATE" ]]; then
-        [[ "$GATE" =~ ",gw=" ]] && GATE="${GATE##,gw=}"
-        if [[ "$GATE" =~ $ip_regex ]]; then
-          echo -e "${GATEWAY}${BOLD}${DGN}Gateway IP Address: ${BGN}$GATE${CL}"
-          GATE=",gw=$GATE"
-        else
-          msg_error "Invalid IP Address format for Gateway. Needs to be 0.0.0.0, was ${GATE}"
-          exit
-        fi
-
-      else
-        while true; do
-          GATE1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Enter gateway IP address" 8 58 --title "Gateway IP" 3>&1 1>&2 2>&3)
-          if [ -z "$GATE1" ]; then
-            whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox "Gateway IP address cannot be empty" 8 58
-          elif [[ ! "$GATE1" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
-            whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox "Invalid IP address format" 8 58
-          else
-            GATE=",gw=$GATE1"
-            echo -e "${GATEWAY}${BOLD}${DGN}Gateway IP Address: ${BGN}$GATE1${CL}"
-            break
-          fi
-        done
-      fi
-    elif [[ "$NET" == *-* ]]; then
-      IFS="-" read -r ip_start ip_end <<<"$NET"
-
-      if [[ ! "$ip_start" =~ $ip_cidr_regex ]] || [[ ! "$ip_end" =~ $ip_cidr_regex ]]; then
-        msg_error "Invalid IP range format, was $NET should be 0.0.0.0/0-0.0.0.0/0"
-        exit 1
-      fi
-
-      ip1="${ip_start%%/*}"
-      ip2="${ip_end%%/*}"
-      cidr="${ip_start##*/}"
-
-      ip_to_int() {
-        local IFS=.
-        read -r i1 i2 i3 i4 <<<"$1"
-        echo $(((i1 << 24) + (i2 << 16) + (i3 << 8) + i4))
-      }
-
-      int_to_ip() {
-        local ip=$1
-        echo "$(((ip >> 24) & 0xFF)).$(((ip >> 16) & 0xFF)).$(((ip >> 8) & 0xFF)).$((ip & 0xFF))"
-      }
-
-      start_int=$(ip_to_int "$ip1")
-      end_int=$(ip_to_int "$ip2")
-
-      for ((ip_int = start_int; ip_int <= end_int; ip_int++)); do
-        ip=$(int_to_ip $ip_int)
-        msg_info "Checking IP: $ip"
-        if ! ping -c 2 -W 1 "$ip" >/dev/null 2>&1; then
-          NET="$ip/$cidr"
-          msg_ok "Using free IP Address: ${BGN}$NET${CL}"
-          sleep 3
-          break
-        fi
-      done
-      if [[ "$NET" == *-* ]]; then
-        msg_error "No free IP found in range"
-        exit 1
-      fi
-      if [ -n "$GATE" ]; then
-        if [[ "$GATE" =~ $ip_regex ]]; then
-          echo -e "${GATEWAY}${BOLD}${DGN}Gateway IP Address: ${BGN}$GATE${CL}"
-          GATE=",gw=$GATE"
-        else
-          msg_error "Invalid IP Address format for Gateway. Needs to be 0.0.0.0, was ${GATE}"
-          exit
-        fi
-      else
-        while true; do
-          GATE1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Enter gateway IP address" 8 58 --title "Gateway IP" 3>&1 1>&2 2>&3)
-          if [ -z "$GATE1" ]; then
-            whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox "Gateway IP address cannot be empty" 8 58
-          elif [[ ! "$GATE1" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
-            whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox "Invalid IP address format" 8 58
-          else
-            GATE=",gw=$GATE1"
-            echo -e "${GATEWAY}${BOLD}${DGN}Gateway IP Address: ${BGN}$GATE1${CL}"
-            break
-          fi
-        done
-      fi
-    else
-      msg_error "Invalid IP Address format. Needs to be 0.0.0.0/0 or a range like 10.0.0.1/24-10.0.0.10/24, was ${NET}"
-      exit
-    fi
-  else
-    while true; do
-      NET=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a Static IPv4 CIDR Address (/24)" 8 58 dhcp --title "IP ADDRESS" 3>&1 1>&2 2>&3)
-      exit_status=$?
-      if [ $exit_status -eq 0 ]; then
-        if [ "$NET" = "dhcp" ]; then
-          echo -e "${NETWORK}${BOLD}${DGN}IP Address: ${BGN}$NET${CL}"
-          break
-        else
-          if [[ "$NET" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/([0-9]|[1-2][0-9]|3[0-2])$ ]]; then
-            echo -e "${NETWORK}${BOLD}${DGN}IP Address: ${BGN}$NET${CL}"
-            break
-          else
-            whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox "$NET is an invalid IPv4 CIDR address. Please enter a valid IPv4 CIDR address or 'dhcp'" 8 58
-          fi
-        fi
-      else
-        exit_script
-      fi
-    done
-    if [ "$NET" != "dhcp" ]; then
-      while true; do
-        GATE1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Enter gateway IP address" 8 58 --title "Gateway IP" 3>&1 1>&2 2>&3)
-        if [ -z "$GATE1" ]; then
-          whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox "Gateway IP address cannot be empty" 8 58
-        elif [[ ! "$GATE1" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
-          whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox "Invalid IP address format" 8 58
-        else
-          GATE=",gw=$GATE1"
-          echo -e "${GATEWAY}${BOLD}${DGN}Gateway IP Address: ${BGN}$GATE1${CL}"
-          break
-        fi
-      done
-    else
-      GATE=""
-      echo -e "${GATEWAY}${BOLD}${DGN}Gateway IP Address: ${BGN}Default${CL}"
-    fi
-  fi
-
-  if [ "$var_os" == "alpine" ]; then
-    APT_CACHER=""
-    APT_CACHER_IP=""
-  else
-    if [[ -n "${APT_CACHER_IP-}" ]]; then
-      if [[ ! $APT_CACHER_IP == "none" ]]; then
-        APT_CACHER="yes"
-        echo -e "${NETWORK}${BOLD}${DGN}APT-CACHER IP Address: ${BGN}$APT_CACHER_IP${CL}"
-      else
-        APT_CACHER=""
-        echo -e "${NETWORK}${BOLD}${DGN}APT-Cacher IP Address: ${BGN}No${CL}"
-      fi
-    else
-      if APT_CACHER_IP=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set APT-Cacher IP (leave blank for none)" 8 58 --title "APT-Cacher IP" 3>&1 1>&2 2>&3); then
-        APT_CACHER="${APT_CACHER_IP:+yes}"
-        echo -e "${NETWORK}${BOLD}${DGN}APT-Cacher IP Address: ${BGN}${APT_CACHER_IP:-Default}${CL}"
-        if [[ -n $APT_CACHER_IP ]]; then
-          APT_CACHER_IP="none"
-        fi
-      else
-        exit_script
-      fi
-    fi
-  fi
-
-  if [[ -n "${MTU-}" ]]; then
-    if [[ "$MTU" =~ ^-?[0-9]+$ ]]; then
-      echo -e "${DEFAULT}${BOLD}${DGN}Interface MTU Size: ${BGN}$MTU${CL}"
-      MTU=",mtu=$MTU"
-    else
-      msg_error "MTU must be an integer, was ${MTU}"
-      exit
-    fi
-  else
-    if MTU1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Interface MTU Size (leave blank for default [The MTU of your selected vmbr, default is 1500])" 8 58 --title "MTU SIZE" 3>&1 1>&2 2>&3); then
-      if [ -z "$MTU1" ]; then
-        MTU1="Default"
-        MTU=""
-      else
-        MTU=",mtu=$MTU1"
-      fi
-      echo -e "${DEFAULT}${BOLD}${DGN}Interface MTU Size: ${BGN}$MTU1${CL}"
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ "$IPV6_METHOD" == "static" ]]; then
-    if [[ -n "$IPV6STATIC" ]]; then
-      IP6=",ip6=${IPV6STATIC}"
-      echo -e "${NETWORK}${BOLD}${DGN}IPv6 Address: ${BGN}${IPV6STATIC}${CL}"
-    else
-      msg_error "IPV6_METHOD is set to static but IPV6STATIC is empty"
-      exit
-    fi
-  elif [[ "$IPV6_METHOD" == "auto" ]]; then
-    IP6=",ip6=auto"
-    echo -e "${NETWORK}${BOLD}${DGN}IPv6 Address: ${BGN}auto${CL}"
-  else
-    IP6=""
-    echo -e "${NETWORK}${BOLD}${DGN}IPv6 Address: ${BGN}none${CL}"
-  fi
-
-  if [[ -n "${SD-}" ]]; then
-    if [[ "$SD" == "none" ]]; then
-      SD=""
-      echo -e "${SEARCH}${BOLD}${DGN}DNS Search Domain: ${BGN}Host${CL}"
-    else
-      # Strip prefix if present for config file storage
-      local SD_VALUE="$SD"
-      [[ "$SD" =~ ^-searchdomain= ]] && SD_VALUE="${SD#-searchdomain=}"
-      echo -e "${SEARCH}${BOLD}${DGN}DNS Search Domain: ${BGN}$SD_VALUE${CL}"
-      SD="-searchdomain=$SD_VALUE"
-    fi
-  else
-    if SD=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a DNS Search Domain (leave blank for HOST)" 8 58 --title "DNS Search Domain" 3>&1 1>&2 2>&3); then
-      if [ -z "$SD" ]; then
-        SX=Host
-        SD=""
-      else
-        SX=$SD
-        SD="-searchdomain=$SD"
-      fi
-      echo -e "${SEARCH}${BOLD}${DGN}DNS Search Domain: ${BGN}$SX${CL}"
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${NS-}" ]]; then
-    if [[ $NS == "none" ]]; then
-      NS=""
-      echo -e "${NETWORK}${BOLD}${DGN}DNS Server IP Address: ${BGN}Host${CL}"
-    else
-      # Strip prefix if present for config file storage
-      local NS_VALUE="$NS"
-      [[ "$NS" =~ ^-nameserver= ]] && NS_VALUE="${NS#-nameserver=}"
-      if [[ "$NS_VALUE" =~ $ip_regex ]]; then
-        echo -e "${NETWORK}${BOLD}${DGN}DNS Server IP Address: ${BGN}$NS_VALUE${CL}"
-        NS="-nameserver=$NS_VALUE"
-      else
-        msg_error "Invalid IP Address format for DNS Server. Needs to be 0.0.0.0, was ${NS_VALUE}"
-        exit
-      fi
-    fi
-  else
-    if NX=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a DNS Server IP (leave blank for HOST)" 8 58 --title "DNS SERVER IP" 3>&1 1>&2 2>&3); then
-      if [ -z "$NX" ]; then
-        NX=Host
-        NS=""
-      else
-        NS="-nameserver=$NX"
-      fi
-      echo -e "${NETWORK}${BOLD}${DGN}DNS Server IP Address: ${BGN}$NX${CL}"
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${MAC-}" ]]; then
-    if [[ "$MAC" == "none" ]]; then
-      MAC=""
-      echo -e "${MACADDRESS}${BOLD}${DGN}MAC Address: ${BGN}Host${CL}"
-    else
-      # Strip prefix if present for config file storage
-      local MAC_VALUE="$MAC"
-      [[ "$MAC" =~ ^,hwaddr= ]] && MAC_VALUE="${MAC#,hwaddr=}"
-      if [[ "$MAC_VALUE" =~ ^([A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2}$ ]]; then
-        echo -e "${MACADDRESS}${BOLD}${DGN}MAC Address: ${BGN}$MAC_VALUE${CL}"
-        MAC=",hwaddr=$MAC_VALUE"
-      else
-        msg_error "MAC Address must be in the format xx:xx:xx:xx:xx:xx, was ${MAC_VALUE}"
-        exit
-      fi
-    fi
-  else
-    if MAC1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a MAC Address(leave blank for generated MAC)" 8 58 --title "MAC ADDRESS" 3>&1 1>&2 2>&3); then
-      if [ -z "$MAC1" ]; then
-        MAC1="Default"
-        MAC=""
-      else
-        MAC=",hwaddr=$MAC1"
-        echo -e "${MACADDRESS}${BOLD}${DGN}MAC Address: ${BGN}$MAC1${CL}"
-      fi
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${VLAN-}" ]]; then
-    if [[ "$VLAN" == "none" ]]; then
-      VLAN=""
-      echo -e "${VLANTAG}${BOLD}${DGN}Vlan: ${BGN}Host${CL}"
-    else
-      # Strip prefix if present for config file storage
-      local VLAN_VALUE="$VLAN"
-      [[ "$VLAN" =~ ^,tag= ]] && VLAN_VALUE="${VLAN#,tag=}"
-      if [[ "$VLAN_VALUE" =~ ^-?[0-9]+$ ]]; then
-        echo -e "${VLANTAG}${BOLD}${DGN}Vlan: ${BGN}$VLAN_VALUE${CL}"
-        VLAN=",tag=$VLAN_VALUE"
-      else
-        msg_error "VLAN must be an integer, was ${VLAN_VALUE}"
-        exit
-      fi
-    fi
-  else
-    if VLAN1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a Vlan(leave blank for no VLAN)" 8 58 --title "VLAN" 3>&1 1>&2 2>&3); then
-      if [ -z "$VLAN1" ]; then
-        VLAN1="Default"
-        VLAN=""
-      else
-        VLAN=",tag=$VLAN1"
-      fi
-      echo -e "${VLANTAG}${BOLD}${DGN}Vlan: ${BGN}$VLAN1${CL}"
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${TAGS-}" ]]; then
-    if [[ "$TAGS" == *"DEFAULT"* ]]; then
-      TAGS="${TAGS//DEFAULT/}"
-      TAGS="${TAGS//;/}"
-      TAGS="$TAGS;${var_tags:-}"
-      echo -e "${NETWORK}${BOLD}${DGN}Tags: ${BGN}$TAGS${CL}"
-    fi
-  else
-    TAGS="community-scripts;"
-    if ADV_TAGS=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Custom Tags?[If you remove all, there will be no tags!]" 8 58 "${TAGS}" --title "Advanced Tags" 3>&1 1>&2 2>&3); then
-      if [ -n "${ADV_TAGS}" ]; then
-        ADV_TAGS=$(echo "$ADV_TAGS" | tr -d '[:space:]')
-        TAGS="${ADV_TAGS}"
-      else
-        TAGS=";"
-      fi
-      echo -e "${NETWORK}${BOLD}${DGN}Tags: ${BGN}$TAGS${CL}"
-    else
-      exit_script
-    fi
-  fi
-
-  if [[ -n "${SSH-}" ]]; then
-    if [[ "$SSH" == "yes" ]]; then
-      echo -e "${ROOTSSH}${BOLD}${DGN}Root SSH Access: ${BGN}$SSH${CL}"
-      if [[ ! -z "$SSH_AUTHORIZED_KEY" ]]; then
-        echo -e "${ROOTSSH}${BOLD}${DGN}SSH Authorized Key: ${BGN}********************${CL}"
-      else
-        echo -e "${ROOTSSH}${BOLD}${DGN}SSH Authorized Key: ${BGN}None${CL}"
-      fi
-    elif [[ "$SSH" == "no" ]]; then
-      echo -e "${ROOTSSH}${BOLD}${DGN}Root SSH Access: ${BGN}$SSH${CL}"
-    else
-      msg_error "SSH needs to be 'yes' or 'no', was ${SSH}"
-      exit
-    fi
-  else
-    SSH_AUTHORIZED_KEY="$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "SSH Authorized key for root (leave empty for none)" 8 58 --title "SSH Key" 3>&1 1>&2 2>&3)"
-    if [[ -z "${SSH_AUTHORIZED_KEY}" ]]; then
-      SSH_AUTHORIZED_KEY=""
-    fi
-    if [[ "$PW" == -password* || -n "$SSH_AUTHORIZED_KEY" ]]; then
-      if (whiptail --backtitle "Proxmox VE Helper Scripts" --defaultno --title "SSH ACCESS" --yesno "Enable Root SSH Access?" 10 58); then
-        SSH="yes"
-      else
-        SSH="no"
-      fi
-      echo -e "${ROOTSSH}${BOLD}${DGN}Root SSH Access: ${BGN}$SSH${CL}"
-    else
-      SSH="no"
-      echo -e "${ROOTSSH}${BOLD}${DGN}Root SSH Access: ${BGN}$SSH${CL}"
-    fi
-  fi
-
-  if [[ -n "$ENABLE_FUSE" ]]; then
-    if [[ "$ENABLE_FUSE" == "yes" ]]; then
-      echo -e "${FUSE}${BOLD}${DGN}Enable FUSE: ${BGN}Yes${CL}"
-    elif [[ "$ENABLE_FUSE" == "no" ]]; then
-      echo -e "${FUSE}${BOLD}${DGN}Enable FUSE: ${BGN}No${CL}"
-    else
-      msg_error "Enable FUSE needs to be 'yes' or 'no', was ${ENABLE_FUSE}"
-      exit
-    fi
-  else
-    if (whiptail --backtitle "Proxmox VE Helper Scripts" --defaultno --title "FUSE" --yesno "Enable FUSE?" 10 58); then
-      ENABLE_FUSE="yes"
-    else
-      ENABLE_FUSE="no"
-    fi
-    echo -e "${FUSE}${BOLD}${DGN}Enable FUSE: ${BGN}$ENABLE_FUSE${CL}"
-  fi
-
-  if [[ -n "$ENABLE_TUN" ]]; then
-    if [[ "$ENABLE_TUN" == "yes" ]]; then
-      echo -e "${FUSE}${BOLD}${DGN}Enable TUN: ${BGN}Yes${CL}"
-    elif [[ "$ENABLE_TUN" == "no" ]]; then
-      echo -e "${FUSE}${BOLD}${DGN}Enable TUN: ${BGN}No${CL}"
-    else
-      msg_error "Enable TUN needs to be 'yes' or 'no', was ${ENABLE_TUN}"
-      exit
-    fi
-  else
-    if (whiptail --backtitle "Proxmox VE Helper Scripts" --defaultno --title "TUN" --yesno "Enable TUN?" 10 58); then
-      ENABLE_TUN="yes"
-    else
-      ENABLE_TUN="no"
-    fi
-    echo -e "${FUSE}${BOLD}${DGN}Enable TUN: ${BGN}$ENABLE_TUN${CL}"
-  fi
-
-  if [[ -n "${VERBOSE-}" ]]; then
-    if [[ "$VERBOSE" == "yes" ]]; then
-      echo -e "${SEARCH}${BOLD}${DGN}Verbose Mode: ${BGN}$VERBOSE${CL}"
-    elif [[ "$VERBOSE" == "no" ]]; then
-      echo -e "${SEARCH}${BOLD}${DGN}Verbose Mode: ${BGN}No${CL}"
-    else
-      msg_error "Verbose Mode needs to be 'yes' or 'no', was ${VERBOSE}"
-      exit
-    fi
-  else
-    if (whiptail --backtitle "Proxmox VE Helper Scripts" --defaultno --title "VERBOSE MODE" --yesno "Enable Verbose Mode?" 10 58); then
-      VERBOSE="yes"
-    else
-      VERBOSE="no"
-    fi
-    echo -e "${SEARCH}${BOLD}${DGN}Verbose Mode: ${BGN}$VERBOSE${CL}"
-  fi
-
-  if (whiptail --backtitle "Proxmox VE Helper Scripts" --title "ADVANCED SETTINGS WITH CONFIG FILE COMPLETE" --yesno "Ready to create ${APP} LXC?" 10 58); then
-    echo -e "${CREATING}${BOLD}${RD}Creating a ${APP} LXC using the above settings${CL}"
-  else
-    clear
-    header_info
-    echo -e "${INFO}${HOLD} ${GN}Using Config File on node $PVEHOST_NAME${CL}"
-    config_file
-  fi
-}
diff --git a/misc/old_misc/core.func b/misc/old_misc/core.func
deleted file mode 100644
index 5328d2a1..00000000
--- a/misc/old_misc/core.func
+++ /dev/null
@@ -1,452 +0,0 @@
-# Copyright (c) 2021-2026 community-scripts ORG
-# License: MIT | https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/LICENSE
-
-# ------------------------------------------------------------------------------
-# Loads core utility groups once (colors, formatting, icons, defaults).
-# ------------------------------------------------------------------------------
-
-[[ -n "${_CORE_FUNC_LOADED:-}" ]] && return
-_CORE_FUNC_LOADED=1
-
-load_functions() {
-  [[ -n "${__FUNCTIONS_LOADED:-}" ]] && return
-  __FUNCTIONS_LOADED=1
-  color
-  formatting
-  icons
-  default_vars
-  set_std_mode
-  # add more
-}
-
-# ============================================================================
-# Error & Signal Handling – robust, universal, subshell-safe
-# ============================================================================
-
-_tool_error_hint() {
-  local cmd="$1"
-  local code="$2"
-  case "$cmd" in
-  curl)
-    case "$code" in
-    6) echo "Curl: Could not resolve host (DNS problem)" ;;
-    7) echo "Curl: Failed to connect to host (connection refused)" ;;
-    22) echo "Curl: HTTP error (404/403 etc)" ;;
-    28) echo "Curl: Operation timeout" ;;
-    *) echo "Curl: Unknown error ($code)" ;;
-    esac
-    ;;
-  wget)
-    echo "Wget failed – URL unreachable or permission denied"
-    ;;
-  systemctl)
-    echo "Systemd unit failure – check service name and permissions"
-    ;;
-  jq)
-    echo "jq parse error – malformed JSON or missing key"
-    ;;
-  mariadb | mysql)
-    echo "MySQL/MariaDB command failed – check credentials or DB"
-    ;;
-  unzip)
-    echo "unzip failed – corrupt file or missing permission"
-    ;;
-  tar)
-    echo "tar failed – invalid format or missing binary"
-    ;;
-  node | npm | pnpm | yarn)
-    echo "Node tool failed – check version compatibility or package.json"
-    ;;
-  *) echo "" ;;
-  esac
-}
-
-catch_errors() {
-  set -Eeuo pipefail
-  trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
-}
-
-# ------------------------------------------------------------------------------
-# Sets ANSI color codes used for styled terminal output.
-# ------------------------------------------------------------------------------
-color() {
-  YW=$(echo "\033[33m")
-  YWB=$'\e[93m'
-  BL=$(echo "\033[36m")
-  RD=$(echo "\033[01;31m")
-  BGN=$(echo "\033[4;92m")
-  GN=$(echo "\033[1;92m")
-  DGN=$(echo "\033[32m")
-  CL=$(echo "\033[m")
-}
-
-# Special for spinner and colorized output via printf
-color_spinner() {
-  CS_YW=$'\033[33m'
-  CS_YWB=$'\033[93m'
-  CS_CL=$'\033[m'
-}
-
-# ------------------------------------------------------------------------------
-# Defines formatting helpers like tab, bold, and line reset sequences.
-# ------------------------------------------------------------------------------
-formatting() {
-  BFR="\\r\\033[K"
-  BOLD=$(echo "\033[1m")
-  HOLD=" "
-  TAB="  "
-  TAB3="      "
-}
-
-# ------------------------------------------------------------------------------
-# Sets symbolic icons used throughout user feedback and prompts.
-# ------------------------------------------------------------------------------
-icons() {
-  CM="${TAB}✔️${TAB}"
-  CROSS="${TAB}✖️${TAB}"
-  DNSOK="✔️ "
-  DNSFAIL="${TAB}✖️${TAB}"
-  INFO="${TAB}💡${TAB}${CL}"
-  OS="${TAB}🖥️${TAB}${CL}"
-  OSVERSION="${TAB}🌟${TAB}${CL}"
-  CONTAINERTYPE="${TAB}📦${TAB}${CL}"
-  DISKSIZE="${TAB}💾${TAB}${CL}"
-  CPUCORE="${TAB}🧠${TAB}${CL}"
-  RAMSIZE="${TAB}🛠️${TAB}${CL}"
-  SEARCH="${TAB}🔍${TAB}${CL}"
-  VERBOSE_CROPPED="🔍${TAB}"
-  VERIFYPW="${TAB}🔐${TAB}${CL}"
-  CONTAINERID="${TAB}🆔${TAB}${CL}"
-  HOSTNAME="${TAB}🏠${TAB}${CL}"
-  BRIDGE="${TAB}🌉${TAB}${CL}"
-  NETWORK="${TAB}📡${TAB}${CL}"
-  GATEWAY="${TAB}🌐${TAB}${CL}"
-  DISABLEIPV6="${TAB}🚫${TAB}${CL}"
-  DEFAULT="${TAB}⚙️${TAB}${CL}"
-  MACADDRESS="${TAB}🔗${TAB}${CL}"
-  VLANTAG="${TAB}🏷️${TAB}${CL}"
-  ROOTSSH="${TAB}🔑${TAB}${CL}"
-  CREATING="${TAB}🚀${TAB}${CL}"
-  ADVANCED="${TAB}🧩${TAB}${CL}"
-  FUSE="${TAB}🗂️${TAB}${CL}"
-  HOURGLASS="${TAB}⏳${TAB}"
-
-}
-
-# ------------------------------------------------------------------------------
-# Sets default retry and wait variables used for system actions.
-# ------------------------------------------------------------------------------
-default_vars() {
-  RETRY_NUM=10
-  RETRY_EVERY=3
-  i=$RETRY_NUM
-  #[[ "${VAR_OS:-}" == "unknown" ]]
-}
-
-# ------------------------------------------------------------------------------
-# Sets default verbose mode for script and os execution.
-# ------------------------------------------------------------------------------
-set_std_mode() {
-  if [ "${VERBOSE:-no}" = "yes" ]; then
-    STD=""
-  else
-    STD="silent"
-  fi
-}
-
-# Silent execution function
-silent() {
-  "$@" >/dev/null 2>&1
-}
-
-# Function to download & save header files
-get_header() {
-  local app_name=$(echo "${APP,,}" | tr -d ' ')
-  local app_type=${APP_TYPE:-ct}
-  local header_url="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/${app_type}/headers/${app_name}"
-  local local_header_path="/usr/local/community-scripts/headers/${app_type}/${app_name}"
-
-  mkdir -p "$(dirname "$local_header_path")"
-
-  if [ ! -s "$local_header_path" ]; then
-    if ! curl -fsSL "$header_url" -o "$local_header_path"; then
-      return 1
-    fi
-  fi
-
-  cat "$local_header_path" 2>/dev/null || true
-}
-
-header_info() {
-  local app_name=$(echo "${APP,,}" | tr -d ' ')
-  local header_content
-
-  header_content=$(get_header "$app_name") || header_content=""
-
-  clear
-  local term_width
-  term_width=$(tput cols 2>/dev/null || echo 120)
-
-  if [ -n "$header_content" ]; then
-    echo "$header_content"
-  fi
-}
-
-ensure_tput() {
-  if ! command -v tput >/dev/null 2>&1; then
-    if grep -qi 'alpine' /etc/os-release; then
-      apk add --no-cache ncurses >/dev/null 2>&1
-    elif command -v apt-get >/dev/null 2>&1; then
-      apt-get update -qq >/dev/null
-      apt-get install -y -qq ncurses-bin >/dev/null 2>&1
-    fi
-  fi
-}
-
-is_alpine() {
-  local os_id="${var_os:-${PCT_OSTYPE:-}}"
-
-  if [[ -z "$os_id" && -f /etc/os-release ]]; then
-    os_id="$(
-      . /etc/os-release 2>/dev/null
-      echo "${ID:-}"
-    )"
-  fi
-
-  [[ "$os_id" == "alpine" ]]
-}
-
-is_verbose_mode() {
-  local verbose="${VERBOSE:-${var_verbose:-no}}"
-  local tty_status
-  if [[ -t 2 ]]; then
-    tty_status="interactive"
-  else
-    tty_status="not-a-tty"
-  fi
-  [[ "$verbose" != "no" || ! -t 2 ]]
-}
-
-# ------------------------------------------------------------------------------
-# Handles specific curl error codes and displays descriptive messages.
-# ------------------------------------------------------------------------------
-__curl_err_handler() {
-  local exit_code="$1"
-  local target="$2"
-  local curl_msg="$3"
-
-  case $exit_code in
-  1) msg_error "Unsupported protocol: $target" ;;
-  2) msg_error "Curl init failed: $target" ;;
-  3) msg_error "Malformed URL: $target" ;;
-  5) msg_error "Proxy resolution failed: $target" ;;
-  6) msg_error "Host resolution failed: $target" ;;
-  7) msg_error "Connection failed: $target" ;;
-  9) msg_error "Access denied: $target" ;;
-  18) msg_error "Partial file transfer: $target" ;;
-  22) msg_error "HTTP error (e.g. 400/404): $target" ;;
-  23) msg_error "Write error on local system: $target" ;;
-  26) msg_error "Read error from local file: $target" ;;
-  28) msg_error "Timeout: $target" ;;
-  35) msg_error "SSL connect error: $target" ;;
-  47) msg_error "Too many redirects: $target" ;;
-  51) msg_error "SSL cert verify failed: $target" ;;
-  52) msg_error "Empty server response: $target" ;;
-  55) msg_error "Send error: $target" ;;
-  56) msg_error "Receive error: $target" ;;
-  60) msg_error "SSL CA not trusted: $target" ;;
-  67) msg_error "Login denied by server: $target" ;;
-  78) msg_error "Remote file not found (404): $target" ;;
-  *) msg_error "Curl failed with code $exit_code: $target" ;;
-  esac
-
-  [[ -n "$curl_msg" ]] && printf "%s\n" "$curl_msg" >&2
-  exit 1
-}
-
-fatal() {
-  msg_error "$1"
-  kill -INT $$
-}
-
-spinner() {
-  local chars=(⠋ ⠙ ⠹ ⠸ ⠼ ⠴ ⠦ ⠧ ⠇ ⠏)
-  local i=0
-  while true; do
-    local index=$((i++ % ${#chars[@]}))
-    printf "\r\033[2K%s %b" "${CS_YWB}${chars[$index]}${CS_CL}" "${CS_YWB}${SPINNER_MSG:-}${CS_CL}"
-    sleep 0.1
-  done
-}
-
-clear_line() {
-  tput cr 2>/dev/null || echo -en "\r"
-  tput el 2>/dev/null || echo -en "\033[K"
-}
-
-stop_spinner() {
-  local pid="${SPINNER_PID:-}"
-  [[ -z "$pid" && -f /tmp/.spinner.pid ]] && pid=$(</tmp/.spinner.pid)
-
-  if [[ -n "$pid" && "$pid" =~ ^[0-9]+$ ]]; then
-    if kill "$pid" 2>/dev/null; then
-      sleep 0.05
-      kill -9 "$pid" 2>/dev/null || true
-      wait "$pid" 2>/dev/null || true
-    fi
-    rm -f /tmp/.spinner.pid
-  fi
-
-  unset SPINNER_PID SPINNER_MSG
-  stty sane 2>/dev/null || true
-}
-
-msg_info() {
-  local msg="$1"
-  [[ -z "$msg" ]] && return
-
-  if ! declare -p MSG_INFO_SHOWN &>/dev/null || ! declare -A MSG_INFO_SHOWN &>/dev/null; then
-    declare -gA MSG_INFO_SHOWN=()
-  fi
-  [[ -n "${MSG_INFO_SHOWN["$msg"]+x}" ]] && return
-  MSG_INFO_SHOWN["$msg"]=1
-
-  stop_spinner
-  SPINNER_MSG="$msg"
-
-  if is_verbose_mode || is_alpine; then
-    local HOURGLASS="${TAB}⏳${TAB}"
-    printf "\r\e[2K%s %b" "$HOURGLASS" "${YW}${msg}${CL}" >&2
-    return
-  fi
-
-  color_spinner
-  spinner &
-  SPINNER_PID=$!
-  echo "$SPINNER_PID" >/tmp/.spinner.pid
-  disown "$SPINNER_PID" 2>/dev/null || true
-}
-
-msg_ok() {
-  local msg="$1"
-  [[ -z "$msg" ]] && return
-  stop_spinner
-  clear_line
-  printf "%s %b\n" "$CM" "${GN}${msg}${CL}" >&2
-  unset MSG_INFO_SHOWN["$msg"]
-}
-
-msg_error() {
-  stop_spinner
-  local msg="$1"
-  echo -e "${BFR:-} ${CROSS:-✖️} ${RD}${msg}${CL}"
-}
-
-msg_warn() {
-  stop_spinner
-  local msg="$1"
-  echo -e "${BFR:-} ${INFO:-ℹ️} ${YWB}${msg}${CL}"
-}
-
-msg_custom() {
-  local symbol="${1:-"[*]"}"
-  local color="${2:-"\e[36m"}"
-  local msg="${3:-}"
-  [[ -z "$msg" ]] && return
-  stop_spinner
-  echo -e "${BFR:-} ${symbol} ${color}${msg}${CL:-\e[0m}"
-}
-
-run_container_safe() {
-  local ct="$1"
-  shift
-  local cmd="$*"
-
-  lxc-attach -n "$ct" -- bash -euo pipefail -c "
-    trap 'echo Aborted in container; exit 130' SIGINT SIGTERM
-    $cmd
-  " || __handle_general_error "lxc-attach to CT $ct"
-}
-
-cleanup_lxc() {
-  msg_info "Cleaning up"
-
-  if is_alpine; then
-    $STD apk cache clean || true
-    rm -rf /var/cache/apk/*
-  else
-    $STD apt -y autoremove || true
-    $STD apt -y autoclean || true
-    $STD apt -y clean || true
-  fi
-
-  # Clear temp artifacts (keep sockets/FIFOs; ignore errors)
-  find /tmp /var/tmp -type f -name 'tmp*' -delete 2>/dev/null || true
-  find /tmp /var/tmp -type f -name 'tempfile*' -delete 2>/dev/null || true
-
-  # Truncate writable log files silently (permission errors ignored)
-  if command -v truncate >/dev/null 2>&1; then
-    find /var/log -type f -writable -print0 2>/dev/null |
-      xargs -0 -n1 truncate -s 0 2>/dev/null || true
-  fi
-
-  # Node.js npm
-  if command -v npm &>/dev/null; then $STD npm cache clean --force || true; fi
-  # Node.js yarn
-  if command -v yarn &>/dev/null; then $STD yarn cache clean || true; fi
-  # Node.js pnpm
-  if command -v pnpm &>/dev/null; then $STD pnpm store prune || true; fi
-  # Go
-  if command -v go &>/dev/null; then $STD go clean -cache -modcache || true; fi
-  # Rust cargo
-  if command -v cargo &>/dev/null; then $STD cargo clean || true; fi
-  # Ruby gem
-  if command -v gem &>/dev/null; then $STD gem cleanup || true; fi
-  # Composer (PHP)
-  if command -v composer &>/dev/null; then $STD composer clear-cache || true; fi
-
-  if command -v journalctl &>/dev/null; then
-    $STD journalctl --vacuum-time=10m || true
-  fi
-  msg_ok "Cleaned"
-}
-
-check_or_create_swap() {
-  msg_info "Checking for active swap"
-
-  if swapon --noheadings --show | grep -q 'swap'; then
-    msg_ok "Swap is active"
-    return 0
-  fi
-
-  msg_error "No active swap detected"
-
-  read -p "Do you want to create a swap file? [y/N]: " create_swap
-  create_swap="${create_swap,,}" # to lowercase
-
-  if [[ "$create_swap" != "y" && "$create_swap" != "yes" ]]; then
-    msg_info "Skipping swap file creation"
-    return 1
-  fi
-
-  read -p "Enter swap size in MB (e.g., 2048 for 2GB): " swap_size_mb
-  if ! [[ "$swap_size_mb" =~ ^[0-9]+$ ]]; then
-    msg_error "Invalid size input. Aborting."
-    return 1
-  fi
-
-  local swap_file="/swapfile"
-
-  msg_info "Creating ${swap_size_mb}MB swap file at $swap_file"
-  if dd if=/dev/zero of="$swap_file" bs=1M count="$swap_size_mb" status=progress &&
-    chmod 600 "$swap_file" &&
-    mkswap "$swap_file" &&
-    swapon "$swap_file"; then
-    msg_ok "Swap file created and activated successfully"
-  else
-    msg_error "Failed to create or activate swap"
-    return 1
-  fi
-}
-
-trap 'stop_spinner' EXIT INT TERM
diff --git a/misc/old_misc/create_lxc.sh b/misc/old_misc/create_lxc.sh
deleted file mode 100644
index b13aca46..00000000
--- a/misc/old_misc/create_lxc.sh
+++ /dev/null
@@ -1,385 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 tteck
-# Author: tteck (tteckster)
-# Co-Author: MickLesk
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-
-# This sets verbose mode if the global variable is set to "yes"
-# if [ "$VERBOSE" == "yes" ]; then set -x; fi
-
-if command -v curl >/dev/null 2>&1; then
-  source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
-  load_functions
-  #echo "(create-lxc.sh) Loaded core.func via curl"
-elif command -v wget >/dev/null 2>&1; then
-  source <(wget -qO- https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
-  load_functions
-  #echo "(create-lxc.sh) Loaded core.func via wget"
-fi
-
-# This sets error handling options and defines the error_handler function to handle errors
-set -Eeuo pipefail
-trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
-trap on_exit EXIT
-trap on_interrupt INT
-trap on_terminate TERM
-
-function on_exit() {
-  local exit_code="$?"
-  [[ -n "${lockfile:-}" && -e "$lockfile" ]] && rm -f "$lockfile"
-  exit "$exit_code"
-}
-
-function error_handler() {
-  local exit_code="$?"
-  local line_number="$1"
-  local command="$2"
-  printf "\e[?25h"
-  echo -e "\n${RD}[ERROR]${CL} in line ${RD}$line_number${CL}: exit code ${RD}$exit_code${CL}: while executing command ${YW}$command${CL}\n"
-  exit "$exit_code"
-}
-
-function on_interrupt() {
-  echo -e "\n${RD}Interrupted by user (SIGINT)${CL}"
-  exit 130
-}
-
-function on_terminate() {
-  echo -e "\n${RD}Terminated by signal (SIGTERM)${CL}"
-  exit 143
-}
-
-function exit_script() {
-  clear
-  printf "\e[?25h"
-  echo -e "\n${CROSS}${RD}User exited script${CL}\n"
-  kill 0
-  exit 1
-}
-
-function check_storage_support() {
-  local CONTENT="$1"
-  local -a VALID_STORAGES=()
-  while IFS= read -r line; do
-    local STORAGE_NAME
-    STORAGE_NAME=$(awk '{print $1}' <<<"$line")
-    [[ -z "$STORAGE_NAME" ]] && continue
-    VALID_STORAGES+=("$STORAGE_NAME")
-  done < <(pvesm status -content "$CONTENT" 2>/dev/null | awk 'NR>1')
-
-  [[ ${#VALID_STORAGES[@]} -gt 0 ]]
-}
-
-# This function selects a storage pool for a given content type (e.g., rootdir, vztmpl).
-function select_storage() {
-  local CLASS=$1 CONTENT CONTENT_LABEL
-
-  case $CLASS in
-  container)
-    CONTENT='rootdir'
-    CONTENT_LABEL='Container'
-    ;;
-  template)
-    CONTENT='vztmpl'
-    CONTENT_LABEL='Container template'
-    ;;
-  iso)
-    CONTENT='iso'
-    CONTENT_LABEL='ISO image'
-    ;;
-  images)
-    CONTENT='images'
-    CONTENT_LABEL='VM Disk image'
-    ;;
-  backup)
-    CONTENT='backup'
-    CONTENT_LABEL='Backup'
-    ;;
-  snippets)
-    CONTENT='snippets'
-    CONTENT_LABEL='Snippets'
-    ;;
-  *)
-    msg_error "Invalid storage class '$CLASS'"
-    return 1
-    ;;
-  esac
-
-  # Check for preset STORAGE variable
-  if [ "$CONTENT" = "rootdir" ] && [ -n "${STORAGE:-}" ]; then
-    if pvesm status -content "$CONTENT" | awk 'NR>1 {print $1}' | grep -qx "$STORAGE"; then
-      STORAGE_RESULT="$STORAGE"
-      msg_info "Using preset storage: $STORAGE_RESULT for $CONTENT_LABEL"
-      return 0
-    else
-      msg_error "Preset storage '$STORAGE' is not valid for content type '$CONTENT'."
-      return 2
-    fi
-  fi
-
-  local -A STORAGE_MAP
-  local -a MENU
-  local COL_WIDTH=0
-
-  while read -r TAG TYPE _ TOTAL USED FREE _; do
-    [[ -n "$TAG" && -n "$TYPE" ]] || continue
-    local STORAGE_NAME="$TAG"
-    local DISPLAY="${STORAGE_NAME} (${TYPE})"
-    local USED_FMT=$(numfmt --to=iec --from-unit=K --format %.1f <<<"$USED")
-    local FREE_FMT=$(numfmt --to=iec --from-unit=K --format %.1f <<<"$FREE")
-    local INFO="Free: ${FREE_FMT}B  Used: ${USED_FMT}B"
-    STORAGE_MAP["$DISPLAY"]="$STORAGE_NAME"
-    MENU+=("$DISPLAY" "$INFO" "OFF")
-    ((${#DISPLAY} > COL_WIDTH)) && COL_WIDTH=${#DISPLAY}
-  done < <(pvesm status -content "$CONTENT" | awk 'NR>1')
-
-  if [ ${#MENU[@]} -eq 0 ]; then
-    msg_error "No storage found for content type '$CONTENT'."
-    return 2
-  fi
-
-  if [ $((${#MENU[@]} / 3)) -eq 1 ]; then
-    STORAGE_RESULT="${STORAGE_MAP[${MENU[0]}]}"
-    STORAGE_INFO="${MENU[1]}"
-    return 0
-  fi
-
-  local WIDTH=$((COL_WIDTH + 42))
-  while true; do
-    local DISPLAY_SELECTED
-    DISPLAY_SELECTED=$(whiptail --backtitle "Proxmox VE Helper Scripts" \
-      --title "Storage Pools" \
-      --radiolist "Which storage pool for ${CONTENT_LABEL,,}?\n(Spacebar to select)" \
-      16 "$WIDTH" 6 "${MENU[@]}" 3>&1 1>&2 2>&3)
-
-    # Cancel or ESC
-    [[ $? -ne 0 ]] && exit_script
-
-    # Strip trailing whitespace or newline (important for storages like "storage (dir)")
-    DISPLAY_SELECTED=$(sed 's/[[:space:]]*$//' <<<"$DISPLAY_SELECTED")
-
-    if [[ -z "$DISPLAY_SELECTED" || -z "${STORAGE_MAP[$DISPLAY_SELECTED]+_}" ]]; then
-      whiptail --msgbox "No valid storage selected. Please try again." 8 58
-      continue
-    fi
-
-    STORAGE_RESULT="${STORAGE_MAP[$DISPLAY_SELECTED]}"
-    for ((i = 0; i < ${#MENU[@]}; i += 3)); do
-      if [[ "${MENU[$i]}" == "$DISPLAY_SELECTED" ]]; then
-        STORAGE_INFO="${MENU[$i + 1]}"
-        break
-      fi
-    done
-    return 0
-  done
-}
-
-# Test if required variables are set
-[[ "${CTID:-}" ]] || {
-  msg_error "You need to set 'CTID' variable."
-  exit 203
-}
-[[ "${PCT_OSTYPE:-}" ]] || {
-  msg_error "You need to set 'PCT_OSTYPE' variable."
-  exit 204
-}
-
-# Test if ID is valid
-[ "$CTID" -ge "100" ] || {
-  msg_error "ID cannot be less than 100."
-  exit 205
-}
-
-# Test if ID is in use
-if qm status "$CTID" &>/dev/null || pct status "$CTID" &>/dev/null; then
-  echo -e "ID '$CTID' is already in use."
-  unset CTID
-  msg_error "Cannot use ID that is already in use."
-  exit 206
-fi
-
-# This checks for the presence of valid Container Storage and Template Storage locations
-if ! check_storage_support "rootdir"; then
-  msg_error "No valid storage found for 'rootdir' [Container]"
-  exit 1
-fi
-if ! check_storage_support "vztmpl"; then
-  msg_error "No valid storage found for 'vztmpl' [Template]"
-  exit 1
-fi
-
-while true; do
-  if select_storage template; then
-    TEMPLATE_STORAGE="$STORAGE_RESULT"
-    TEMPLATE_STORAGE_INFO="$STORAGE_INFO"
-    msg_ok "Storage ${BL}$TEMPLATE_STORAGE${CL} ($TEMPLATE_STORAGE_INFO) [Template]"
-    break
-  fi
-done
-
-while true; do
-  if select_storage container; then
-    CONTAINER_STORAGE="$STORAGE_RESULT"
-    CONTAINER_STORAGE_INFO="$STORAGE_INFO"
-    msg_ok "Storage ${BL}$CONTAINER_STORAGE${CL} ($CONTAINER_STORAGE_INFO) [Container]"
-    break
-  fi
-done
-
-# Check free space on selected container storage
-STORAGE_FREE=$(pvesm status | awk -v s="$CONTAINER_STORAGE" '$1 == s { print $6 }')
-REQUIRED_KB=$((${PCT_DISK_SIZE:-8} * 1024 * 1024))
-if [ "$STORAGE_FREE" -lt "$REQUIRED_KB" ]; then
-  msg_error "Not enough space on '$CONTAINER_STORAGE'. Needed: ${PCT_DISK_SIZE:-8}G."
-  exit 214
-fi
-
-# Check Cluster Quorum if in Cluster
-if [ -f /etc/pve/corosync.conf ]; then
-  msg_info "Checking cluster quorum"
-  if ! pvecm status | awk -F':' '/^Quorate/ { exit ($2 ~ /Yes/) ? 0 : 1 }'; then
-
-    msg_error "Cluster is not quorate. Start all nodes or configure quorum device (QDevice)."
-    exit 210
-  fi
-  msg_ok "Cluster is quorate"
-fi
-
-# Update LXC template list
-TEMPLATE_SEARCH="${PCT_OSTYPE}-${PCT_OSVERSION:-}"
-case "$PCT_OSTYPE" in
-debian | ubuntu)
-  TEMPLATE_PATTERN="-standard_"
-  ;;
-alpine | fedora | rocky | centos)
-  TEMPLATE_PATTERN="-default_"
-  ;;
-*)
-  TEMPLATE_PATTERN=""
-  ;;
-esac
-
-# 1. Check local templates first
-msg_info "Searching for template '$TEMPLATE_SEARCH'"
-mapfile -t TEMPLATES < <(
-  pveam list "$TEMPLATE_STORAGE" |
-    awk -v s="$TEMPLATE_SEARCH" -v p="$TEMPLATE_PATTERN" '$1 ~ s && $1 ~ p {print $1}' |
-    sed 's/.*\///' | sort -t - -k 2 -V
-)
-
-if [ ${#TEMPLATES[@]} -gt 0 ]; then
-  TEMPLATE_SOURCE="local"
-else
-  msg_info "No local template found, checking online repository"
-  pveam update >/dev/null 2>&1
-  mapfile -t TEMPLATES < <(
-    pveam update >/dev/null 2>&1 &&
-      pveam available -section system |
-      sed -n "s/.*\($TEMPLATE_SEARCH.*$TEMPLATE_PATTERN.*\)/\1/p" |
-        sort -t - -k 2 -V
-  )
-  TEMPLATE_SOURCE="online"
-fi
-
-TEMPLATE="${TEMPLATES[-1]}"
-TEMPLATE_PATH="$(pvesm path $TEMPLATE_STORAGE:vztmpl/$TEMPLATE 2>/dev/null ||
-  echo "/var/lib/vz/template/cache/$TEMPLATE")"
-msg_ok "Template ${BL}$TEMPLATE${CL} [$TEMPLATE_SOURCE]"
-
-# 4. Validate template (exists & not corrupted)
-TEMPLATE_VALID=1
-
-if [ ! -s "$TEMPLATE_PATH" ]; then
-  TEMPLATE_VALID=0
-elif ! tar --use-compress-program=zstdcat -tf "$TEMPLATE_PATH" >/dev/null 2>&1; then
-  TEMPLATE_VALID=0
-fi
-
-if [ "$TEMPLATE_VALID" -eq 0 ]; then
-  msg_warn "Template $TEMPLATE is missing or corrupted. Re-downloading."
-  [[ -f "$TEMPLATE_PATH" ]] && rm -f "$TEMPLATE_PATH"
-  for attempt in {1..3}; do
-    msg_info "Attempt $attempt: Downloading LXC template..."
-    if pveam download "$TEMPLATE_STORAGE" "$TEMPLATE" >/dev/null 2>&1; then
-      msg_ok "Template download successful."
-      break
-    fi
-    if [ $attempt -eq 3 ]; then
-      msg_error "Failed after 3 attempts. Please check network access or manually run:\n  pveam download $TEMPLATE_STORAGE $TEMPLATE"
-      exit 208
-    fi
-    sleep $((attempt * 5))
-  done
-fi
-
-msg_info "Creating LXC Container"
-# Check and fix subuid/subgid
-grep -q "root:100000:65536" /etc/subuid || echo "root:100000:65536" >>/etc/subuid
-grep -q "root:100000:65536" /etc/subgid || echo "root:100000:65536" >>/etc/subgid
-
-# Combine all options
-PCT_OPTIONS=(${PCT_OPTIONS[@]:-${DEFAULT_PCT_OPTIONS[@]}})
-[[ " ${PCT_OPTIONS[@]} " =~ " -rootfs " ]] || PCT_OPTIONS+=(-rootfs "$CONTAINER_STORAGE:${PCT_DISK_SIZE:-8}")
-
-# Secure creation of the LXC container with lock and template check
-lockfile="/tmp/template.${TEMPLATE}.lock"
-exec 9>"$lockfile" || {
-  msg_error "Failed to create lock file '$lockfile'."
-  exit 200
-}
-flock -w 60 9 || {
-  msg_error "Timeout while waiting for template lock"
-  exit 211
-}
-
-if ! pct create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" "${PCT_OPTIONS[@]}" &>/dev/null; then
-  msg_error "Container creation failed. Checking if template is corrupted or incomplete."
-
-  if [[ ! -s "$TEMPLATE_PATH" || "$(stat -c%s "$TEMPLATE_PATH")" -lt 1000000 ]]; then
-    msg_error "Template file too small or missing – re-downloading."
-    rm -f "$TEMPLATE_PATH"
-  elif ! zstdcat "$TEMPLATE_PATH" | tar -tf - &>/dev/null; then
-    msg_error "Template appears to be corrupted – re-downloading."
-    rm -f "$TEMPLATE_PATH"
-  else
-    msg_error "Template is valid, but container creation failed. Update your whole Proxmox System (pve-container) first or check https://github.com/community-scripts/ProxmoxVE/discussions/8126"
-    exit 209
-  fi
-
-  # Retry download
-  for attempt in {1..3}; do
-    msg_info "Attempt $attempt: Re-downloading template..."
-    if timeout 120 pveam download "$TEMPLATE_STORAGE" "$TEMPLATE" >/dev/null; then
-      msg_ok "Template re-download successful."
-      break
-    fi
-    if [ "$attempt" -eq 3 ]; then
-      msg_error "Three failed attempts. Aborting."
-      exit 208
-    fi
-    sleep $((attempt * 5))
-  done
-
-  sleep 1 # I/O-Sync-Delay
-  msg_ok "Re-downloaded LXC Template"
-fi
-
-if ! pct list | awk '{print $1}' | grep -qx "$CTID"; then
-  msg_error "Container ID $CTID not listed in 'pct list' – unexpected failure."
-  exit 215
-fi
-
-if ! grep -q '^rootfs:' "/etc/pve/lxc/$CTID.conf"; then
-  msg_error "RootFS entry missing in container config – storage not correctly assigned."
-  exit 216
-fi
-
-if grep -q '^hostname:' "/etc/pve/lxc/$CTID.conf"; then
-  CT_HOSTNAME=$(grep '^hostname:' "/etc/pve/lxc/$CTID.conf" | awk '{print $2}')
-  if [[ ! "$CT_HOSTNAME" =~ ^[a-z0-9-]+$ ]]; then
-    msg_warn "Hostname '$CT_HOSTNAME' contains invalid characters – may cause issues with networking or DNS."
-  fi
-fi
-
-msg_ok "LXC Container ${BL}$CTID${CL} ${GN}was successfully created."
diff --git a/misc/old_misc/install.func b/misc/old_misc/install.func
deleted file mode 100644
index 4c7309a2..00000000
--- a/misc/old_misc/install.func
+++ /dev/null
@@ -1,217 +0,0 @@
-# Copyright (c) 2021-2026 tteck
-# Author: tteck (tteckster)
-# Co-Author: MickLesk
-# License: MIT
-# https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-
-if ! command -v curl >/dev/null 2>&1; then
-  printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
-  apt-get update >/dev/null 2>&1
-  apt-get install -y curl >/dev/null 2>&1
-fi
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
-load_functions
-# This function enables IPv6 if it's not disabled and sets verbose mode
-verb_ip6() {
-  set_std_mode # Set STD mode based on VERBOSE
-
-  if [ "$IPV6_METHOD" == "disable" ]; then
-    msg_info "Disabling IPv6 (this may affect some services)"
-    mkdir -p /etc/sysctl.d
-    $STD tee /etc/sysctl.d/99-disable-ipv6.conf >/dev/null <<EOF
-# Disable IPv6 (set by community-scripts)
-net.ipv6.conf.all.disable_ipv6 = 1
-net.ipv6.conf.default.disable_ipv6 = 1
-net.ipv6.conf.lo.disable_ipv6 = 1
-EOF
-    $STD sysctl -p /etc/sysctl.d/99-disable-ipv6.conf
-    msg_ok "Disabled IPv6"
-  fi
-}
-
-# This function sets error handling options and defines the error_handler function to handle errors
-catch_errors() {
-  set -Eeuo pipefail
-  trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
-}
-
-# This function handles errors
-error_handler() {
-  source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func)
-  printf "\e[?25h"
-  local exit_code="$?"
-  local line_number="$1"
-  local command="$2"
-  local error_message="${RD}[ERROR]${CL} in line ${RD}$line_number${CL}: exit code ${RD}$exit_code${CL}: while executing command ${YW}$command${CL}"
-  echo -e "\n$error_message"
-  if [[ "$line_number" -eq 51 ]]; then
-    echo -e "The silent function has suppressed the error, run the script with verbose mode enabled, which will provide more detailed output.\n"
-    post_update_to_api "failed" "No error message, script ran in silent mode"
-  else
-    post_update_to_api "failed" "${command}"
-  fi
-}
-
-# This function sets up the Container OS by generating the locale, setting the timezone, and checking the network connection
-setting_up_container() {
-  msg_info "Setting up Container OS"
-  for ((i = RETRY_NUM; i > 0; i--)); do
-    if [ "$(hostname -I)" != "" ]; then
-      break
-    fi
-    echo 1>&2 -en "${CROSS}${RD} No Network! "
-    sleep $RETRY_EVERY
-  done
-  if [ "$(hostname -I)" = "" ]; then
-    echo 1>&2 -e "\n${CROSS}${RD} No Network After $RETRY_NUM Tries${CL}"
-    echo -e "${NETWORK}Check Network Settings"
-    exit 1
-  fi
-  rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED
-  systemctl disable -q --now systemd-networkd-wait-online.service
-  msg_ok "Set up Container OS"
-  #msg_custom "${CM}" "${GN}" "Network Connected: ${BL}$(hostname -I)"
-  msg_ok "Network Connected: ${BL}$(hostname -I)"
-}
-
-# This function checks the network connection by pinging a known IP address and prompts the user to continue if the internet is not connected
-# This function checks the network connection by pinging a known IP address and prompts the user to continue if the internet is not connected
-network_check() {
-  set +e
-  trap - ERR
-  ipv4_connected=false
-  ipv6_connected=false
-  sleep 1
-
-  # Check IPv4 connectivity to Google, Cloudflare & Quad9 DNS servers.
-  if ping -c 1 -W 1 1.1.1.1 &>/dev/null || ping -c 1 -W 1 8.8.8.8 &>/dev/null || ping -c 1 -W 1 9.9.9.9 &>/dev/null; then
-    msg_ok "IPv4 Internet Connected"
-    ipv4_connected=true
-  else
-    msg_error "IPv4 Internet Not Connected"
-  fi
-
-  # Check IPv6 connectivity to Google, Cloudflare & Quad9 DNS servers.
-  if ping6 -c 1 -W 1 2606:4700:4700::1111 &>/dev/null || ping6 -c 1 -W 1 2001:4860:4860::8888 &>/dev/null || ping6 -c 1 -W 1 2620:fe::fe &>/dev/null; then
-    msg_ok "IPv6 Internet Connected"
-    ipv6_connected=true
-  else
-    msg_error "IPv6 Internet Not Connected"
-  fi
-
-  # If both IPv4 and IPv6 checks fail, prompt the user
-  if [[ $ipv4_connected == false && $ipv6_connected == false ]]; then
-    read -r -p "No Internet detected, would you like to continue anyway? <y/N> " prompt
-    if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
-      echo -e "${INFO}${RD}Expect Issues Without Internet${CL}"
-    else
-      echo -e "${NETWORK}Check Network Settings"
-      exit 1
-    fi
-  fi
-
-  # DNS resolution checks for GitHub-related domains (IPv4 and/or IPv6)
-  GIT_HOSTS=("github.com" "raw.githubusercontent.com" "api.github.com" "git.community-scripts.org")
-  GIT_STATUS="Git DNS:"
-  DNS_FAILED=false
-
-  for HOST in "${GIT_HOSTS[@]}"; do
-    RESOLVEDIP=$(getent hosts "$HOST" | awk '{ print $1 }' | grep -E '(^([0-9]{1,3}\.){3}[0-9]{1,3}$)|(^[a-fA-F0-9:]+$)' | head -n1)
-    if [[ -z "$RESOLVEDIP" ]]; then
-      GIT_STATUS+="$HOST:($DNSFAIL)"
-      DNS_FAILED=true
-    else
-      GIT_STATUS+=" $HOST:($DNSOK)"
-    fi
-  done
-
-  if [[ "$DNS_FAILED" == true ]]; then
-    fatal "$GIT_STATUS"
-  else
-    msg_ok "$GIT_STATUS"
-  fi
-
-  set -e
-  trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
-}
-
-# This function updates the Container OS by running apt-get update and upgrade
-update_os() {
-  msg_info "Updating Container OS"
-  if [[ "$CACHER" == "yes" ]]; then
-    echo 'Acquire::http::Proxy-Auto-Detect "/usr/local/bin/apt-proxy-detect.sh";' >/etc/apt/apt.conf.d/00aptproxy
-    cat <<EOF >/usr/local/bin/apt-proxy-detect.sh
-#!/bin/bash
-if nc -w1 -z "${CACHER_IP}" 3142; then
-  echo -n "http://${CACHER_IP}:3142"
-else
-  echo -n "DIRECT"
-fi
-EOF
-    chmod +x /usr/local/bin/apt-proxy-detect.sh
-  fi
-  $STD apt-get update
-  $STD apt-get -o Dpkg::Options::="--force-confold" -y dist-upgrade
-  rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED
-  msg_ok "Updated Container OS"
-
-  source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
-}
-
-# This function modifies the message of the day (motd) and SSH settings
-motd_ssh() {
-  # Set terminal to 256-color mode
-  grep -qxF "export TERM='xterm-256color'" /root/.bashrc || echo "export TERM='xterm-256color'" >>/root/.bashrc
-
-  # Get OS information (Debian / Ubuntu)
-  if [ -f "/etc/os-release" ]; then
-    OS_NAME=$(grep ^NAME /etc/os-release | cut -d= -f2 | tr -d '"')
-    OS_VERSION=$(grep ^VERSION_ID /etc/os-release | cut -d= -f2 | tr -d '"')
-  elif [ -f "/etc/debian_version" ]; then
-    OS_NAME="Debian"
-    OS_VERSION=$(cat /etc/debian_version)
-  fi
-
-  PROFILE_FILE="/etc/profile.d/00_lxc-details.sh"
-  echo "echo -e \"\"" >"$PROFILE_FILE"
-  echo -e "echo -e \"${BOLD}${APPLICATION} LXC Container${CL}"\" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${TAB}${GATEWAY}${YW} Provided by: ${GN}community-scripts ORG ${YW}| GitHub: ${GN}https://github.com/community-scripts/ProxmoxVE${CL}\"" >>"$PROFILE_FILE"
-  echo "echo \"\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${TAB}${OS}${YW} OS: ${GN}${OS_NAME} - Version: ${OS_VERSION}${CL}\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${TAB}${HOSTNAME}${YW} Hostname: ${GN}\$(hostname)${CL}\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${TAB}${INFO}${YW} IP Address: ${GN}\$(hostname -I | awk '{print \$1}')${CL}\"" >>"$PROFILE_FILE"
-
-  # Disable default MOTD scripts
-  chmod -x /etc/update-motd.d/*
-
-  if [[ "${SSH_ROOT}" == "yes" ]]; then
-    sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" /etc/ssh/sshd_config
-    systemctl restart sshd
-  fi
-}
-
-# This function customizes the container by modifying the getty service and enabling auto-login for the root user
-customize() {
-  if [[ "$PASSWORD" == "" ]]; then
-    msg_info "Customizing Container"
-    GETTY_OVERRIDE="/etc/systemd/system/container-getty@1.service.d/override.conf"
-    mkdir -p $(dirname $GETTY_OVERRIDE)
-    cat <<EOF >$GETTY_OVERRIDE
-  [Service]
-  ExecStart=
-  ExecStart=-/sbin/agetty --autologin root --noclear --keep-baud tty%I 115200,38400,9600 \$TERM
-EOF
-    systemctl daemon-reload
-    systemctl restart $(basename $(dirname $GETTY_OVERRIDE) | sed 's/\.d//')
-    msg_ok "Customized Container"
-  fi
-  echo "bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/${app}.sh)\"" >/usr/bin/update
-  chmod +x /usr/bin/update
-
-  if [[ -n "${SSH_AUTHORIZED_KEY}" ]]; then
-    mkdir -p /root/.ssh
-    echo "${SSH_AUTHORIZED_KEY}" >/root/.ssh/authorized_keys
-    chmod 700 /root/.ssh
-    chmod 600 /root/.ssh/authorized_keys
-  fi
-}
diff --git a/misc/old_misc/tools.func b/misc/old_misc/tools.func
deleted file mode 100644
index 91e4a144..00000000
--- a/misc/old_misc/tools.func
+++ /dev/null
@@ -1,4818 +0,0 @@
-#!/bin/bash
-
-# ==============================================================================
-# HELPER FUNCTIONS FOR PACKAGE MANAGEMENT
-# ==============================================================================
-#
-# This file provides unified helper functions for robust package installation
-# and repository management across Debian/Ubuntu OS upgrades.
-#
-# Key Features:
-#   - Automatic retry logic for transient APT/network failures
-#   - Unified keyring cleanup from all 3 locations
-#   - Legacy installation cleanup (nvm, rbenv, rustup)
-#   - OS-upgrade-safe repository preparation
-#   - Service pattern matching for multi-version tools
-#
-# Usage in install scripts:
-#   source /dev/stdin <<< "$FUNCTIONS"  # Load from build.func
-#   prepare_repository_setup "mysql"
-#   install_packages_with_retry "mysql-server" "mysql-client"
-#
-# Quick Reference (Core Helpers):
-#   cleanup_tool_keyrings()          - Remove keyrings from all 3 locations
-#   stop_all_services()              - Stop services by pattern (e.g. "php*-fpm")
-#   verify_tool_version()            - Validate installed version matches expected
-#   cleanup_legacy_install()         - Remove nvm, rbenv, rustup, etc.
-#   prepare_repository_setup()       - Cleanup repos + keyrings + validate APT
-#   install_packages_with_retry()    - Install with 3 retries and APT refresh
-#   upgrade_packages_with_retry()    - Upgrade with 3 retries and APT refresh
-#
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# Cache installed version to avoid repeated checks
-# ------------------------------------------------------------------------------
-cache_installed_version() {
-  local app="$1"
-  local version="$2"
-  mkdir -p /var/cache/app-versions
-  echo "$version" >"/var/cache/app-versions/${app}_version.txt"
-}
-
-get_cached_version() {
-  local app="$1"
-  mkdir -p /var/cache/app-versions
-  if [[ -f "/var/cache/app-versions/${app}_version.txt" ]]; then
-    cat "/var/cache/app-versions/${app}_version.txt"
-    return 0
-  fi
-  return 0
-}
-
-# ------------------------------------------------------------------------------
-# Clean up ALL keyring locations for a tool (unified helper)
-# Usage: cleanup_tool_keyrings "mariadb" "mysql" "postgresql"
-# ------------------------------------------------------------------------------
-cleanup_tool_keyrings() {
-  local tool_patterns=("$@")
-
-  for pattern in "${tool_patterns[@]}"; do
-    rm -f /usr/share/keyrings/${pattern}*.gpg \
-      /etc/apt/keyrings/${pattern}*.gpg \
-      /etc/apt/trusted.gpg.d/${pattern}*.gpg 2>/dev/null || true
-  done
-}
-
-# ------------------------------------------------------------------------------
-# Stop and disable all service instances matching a pattern
-# Usage: stop_all_services "php*-fpm" "mysql" "mariadb"
-# ------------------------------------------------------------------------------
-stop_all_services() {
-  local service_patterns=("$@")
-
-  for pattern in "${service_patterns[@]}"; do
-    # Find all matching services (use || true to avoid pipeline failures)
-    local services
-    services=$(systemctl list-units --type=service --all 2>/dev/null |
-      grep -oE "${pattern}[^ ]*\.service" 2>/dev/null |
-      sort -u 2>/dev/null || true)
-
-    # Only process if we found any services
-    if [[ -n "$services" ]]; then
-      while IFS= read -r service; do
-        [[ -z "$service" ]] && continue
-        $STD systemctl stop "$service" 2>/dev/null || true
-        $STD systemctl disable "$service" 2>/dev/null || true
-      done <<<"$services"
-    fi
-  done
-
-  return 0
-}
-
-# ------------------------------------------------------------------------------
-# Verify installed tool version matches expected version
-# Returns: 0 if match, 1 if mismatch (with warning)
-# Usage: verify_tool_version "nodejs" "22" "$(node -v | grep -oP '^v\K[0-9]+')"
-# ------------------------------------------------------------------------------
-verify_tool_version() {
-  local tool_name="$1"
-  local expected_version="$2"
-  local installed_version="$3"
-
-  # Extract major version for comparison
-  local expected_major="${expected_version%%.*}"
-  local installed_major="${installed_version%%.*}"
-
-  if [[ "$installed_major" != "$expected_major" ]]; then
-    msg_warn "$tool_name version mismatch: expected $expected_version, got $installed_version"
-    return 1
-  fi
-
-  return 0
-}
-
-# ------------------------------------------------------------------------------
-# Clean up legacy installation methods (nvm, rbenv, rustup, etc.)
-# Usage: cleanup_legacy_install "nodejs" -> removes nvm
-# ------------------------------------------------------------------------------
-cleanup_legacy_install() {
-  local tool_name="$1"
-
-  case "$tool_name" in
-  nodejs | node)
-    if [[ -d "$HOME/.nvm" ]]; then
-      msg_info "Removing legacy nvm installation"
-      rm -rf "$HOME/.nvm" "$HOME/.npm" "$HOME/.bower" "$HOME/.config/yarn" 2>/dev/null || true
-      sed -i '/NVM_DIR/d' "$HOME/.bashrc" "$HOME/.profile" 2>/dev/null || true
-      msg_ok "Legacy nvm installation removed"
-    fi
-    ;;
-  ruby)
-    if [[ -d "$HOME/.rbenv" ]]; then
-      msg_info "Removing legacy rbenv installation"
-      rm -rf "$HOME/.rbenv" 2>/dev/null || true
-      sed -i '/rbenv/d' "$HOME/.bashrc" "$HOME/.profile" 2>/dev/null || true
-      msg_ok "Legacy rbenv installation removed"
-    fi
-    ;;
-  rust)
-    if [[ -d "$HOME/.cargo" ]] || [[ -d "$HOME/.rustup" ]]; then
-      msg_info "Removing legacy rustup installation"
-      rm -rf "$HOME/.cargo" "$HOME/.rustup" 2>/dev/null || true
-      sed -i '/cargo/d' "$HOME/.bashrc" "$HOME/.profile" 2>/dev/null || true
-      msg_ok "Legacy rustup installation removed"
-    fi
-    ;;
-  go | golang)
-    if [[ -d "$HOME/go" ]]; then
-      msg_info "Removing legacy Go workspace"
-      # Keep user code, just remove GOPATH env
-      sed -i '/GOPATH/d' "$HOME/.bashrc" "$HOME/.profile" 2>/dev/null || true
-      msg_ok "Legacy Go workspace cleaned"
-    fi
-    ;;
-  esac
-}
-
-# ------------------------------------------------------------------------------
-# Unified repository preparation before setup
-# Cleans up old repos, keyrings, and ensures APT is working
-# Usage: prepare_repository_setup "mariadb" "mysql"
-# ------------------------------------------------------------------------------
-prepare_repository_setup() {
-  local repo_names=("$@")
-
-  # Clean up all old repository files
-  for repo in "${repo_names[@]}"; do
-    cleanup_old_repo_files "$repo"
-  done
-
-  # Clean up all keyrings
-  cleanup_tool_keyrings "${repo_names[@]}"
-
-  # Ensure APT is in working state
-  ensure_apt_working || return 1
-
-  return 0
-}
-
-# ------------------------------------------------------------------------------
-# Install packages with retry logic
-# Usage: install_packages_with_retry "mysql-server" "mysql-client"
-# ------------------------------------------------------------------------------
-install_packages_with_retry() {
-  local packages=("$@")
-  local max_retries=2
-  local retry=0
-
-  while [[ $retry -le $max_retries ]]; do
-    if $STD apt install -y "${packages[@]}" 2>/dev/null; then
-      return 0
-    fi
-
-    retry=$((retry + 1))
-    if [[ $retry -le $max_retries ]]; then
-      msg_warn "Package installation failed, retrying ($retry/$max_retries)..."
-      sleep 2
-      $STD apt update 2>/dev/null || true
-    fi
-  done
-
-  return 1
-}
-
-# ------------------------------------------------------------------------------
-# Upgrade specific packages with retry logic
-# Usage: upgrade_packages_with_retry "mariadb-server" "mariadb-client"
-# ------------------------------------------------------------------------------
-upgrade_packages_with_retry() {
-  local packages=("$@")
-  local max_retries=2
-  local retry=0
-
-  while [[ $retry -le $max_retries ]]; do
-    if $STD apt install --only-upgrade -y "${packages[@]}" 2>/dev/null; then
-      return 0
-    fi
-
-    retry=$((retry + 1))
-    if [[ $retry -le $max_retries ]]; then
-      msg_warn "Package upgrade failed, retrying ($retry/$max_retries)..."
-      sleep 2
-      $STD apt update 2>/dev/null || true
-    fi
-  done
-
-  return 1
-}
-
-# ------------------------------------------------------------------------------
-# Check if tool is already installed and optionally verify exact version
-# Returns: 0 if installed (with optional version match), 1 if not installed
-# Usage: is_tool_installed "mariadb" "11.4" || echo "Not installed"
-# ------------------------------------------------------------------------------
-is_tool_installed() {
-  local tool_name="$1"
-  local required_version="${2:-}"
-  local installed_version=""
-
-  case "$tool_name" in
-  mariadb)
-    if command -v mariadb >/dev/null 2>&1; then
-      installed_version=$(mariadb --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
-    fi
-    ;;
-  mysql)
-    if command -v mysql >/dev/null 2>&1; then
-      installed_version=$(mysql --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
-    fi
-    ;;
-  mongodb | mongod)
-    if command -v mongod >/dev/null 2>&1; then
-      installed_version=$(mongod --version 2>/dev/null | awk '/db version/{print $3}' | cut -d. -f1,2)
-    fi
-    ;;
-  node | nodejs)
-    if command -v node >/dev/null 2>&1; then
-      installed_version=$(node -v 2>/dev/null | grep -oP '^v\K[0-9]+')
-    fi
-    ;;
-  php)
-    if command -v php >/dev/null 2>&1; then
-      installed_version=$(php -v 2>/dev/null | awk '/^PHP/{print $2}' | cut -d. -f1,2)
-    fi
-    ;;
-  postgres | postgresql)
-    if command -v psql >/dev/null 2>&1; then
-      installed_version=$(psql --version 2>/dev/null | awk '{print $3}' | cut -d. -f1)
-    fi
-    ;;
-  ruby)
-    if command -v ruby >/dev/null 2>&1; then
-      installed_version=$(ruby --version 2>/dev/null | awk '{print $2}' | cut -d. -f1,2)
-    fi
-    ;;
-  rust | rustc)
-    if command -v rustc >/dev/null 2>&1; then
-      installed_version=$(rustc --version 2>/dev/null | awk '{print $2}')
-    fi
-    ;;
-  go | golang)
-    if command -v go >/dev/null 2>&1; then
-      installed_version=$(go version 2>/dev/null | awk '{print $3}' | sed 's/go//')
-    fi
-    ;;
-  clickhouse)
-    if command -v clickhouse >/dev/null 2>&1; then
-      installed_version=$(clickhouse --version 2>/dev/null | awk '{print $2}')
-    fi
-    ;;
-  esac
-
-  if [[ -z "$installed_version" ]]; then
-    return 1 # Not installed
-  fi
-
-  if [[ -n "$required_version" && "$installed_version" != "$required_version" ]]; then
-    echo "$installed_version"
-    return 1 # Version mismatch
-  fi
-
-  echo "$installed_version"
-  return 0 # Installed and version matches (if specified)
-}
-
-# ------------------------------------------------------------------------------
-# Remove old tool version completely (purge + cleanup repos)
-# Usage: remove_old_tool_version "mariadb" "repository-name"
-# ------------------------------------------------------------------------------
-remove_old_tool_version() {
-  local tool_name="$1"
-  local repo_name="${2:-$tool_name}"
-
-  case "$tool_name" in
-  mariadb)
-    stop_all_services "mariadb"
-    $STD apt purge -y 'mariadb*' >/dev/null 2>&1 || true
-    cleanup_tool_keyrings "mariadb"
-    ;;
-  mysql)
-    stop_all_services "mysql"
-    $STD apt purge -y 'mysql*' >/dev/null 2>&1 || true
-    rm -rf /var/lib/mysql 2>/dev/null || true
-    cleanup_tool_keyrings "mysql"
-    ;;
-  mongodb)
-    stop_all_services "mongod"
-    $STD apt purge -y 'mongodb*' >/dev/null 2>&1 || true
-    rm -rf /var/lib/mongodb 2>/dev/null || true
-    cleanup_tool_keyrings "mongodb"
-    ;;
-  node | nodejs)
-    $STD apt purge -y nodejs npm >/dev/null 2>&1 || true
-    # Clean up npm global modules
-    if command -v npm >/dev/null 2>&1; then
-      npm list -g 2>/dev/null | grep -oE '^  \S+' | awk '{print $1}' | while read -r module; do
-        npm uninstall -g "$module" >/dev/null 2>&1 || true
-      done
-    fi
-    cleanup_legacy_install "nodejs"
-    cleanup_tool_keyrings "nodesource"
-    ;;
-  php)
-    stop_all_services "php.*-fpm"
-    $STD apt purge -y 'php*' >/dev/null 2>&1 || true
-    rm -rf /etc/php 2>/dev/null || true
-    cleanup_tool_keyrings "deb.sury.org-php" "php"
-    ;;
-  postgresql)
-    stop_all_services "postgresql"
-    $STD apt purge -y 'postgresql*' >/dev/null 2>&1 || true
-    # Keep data directory for safety (can be removed manually if needed)
-    # rm -rf /var/lib/postgresql 2>/dev/null || true
-    cleanup_tool_keyrings "postgresql" "pgdg"
-    ;;
-  java)
-    $STD apt purge -y 'temurin*' 'adoptium*' 'openjdk*' >/dev/null 2>&1 || true
-    cleanup_tool_keyrings "adoptium"
-    ;;
-  ruby)
-    cleanup_legacy_install "ruby"
-    $STD apt purge -y 'ruby*' >/dev/null 2>&1 || true
-    ;;
-  rust)
-    cleanup_legacy_install "rust"
-    ;;
-  go | golang)
-    rm -rf /usr/local/go 2>/dev/null || true
-    cleanup_legacy_install "golang"
-    ;;
-  clickhouse)
-    stop_all_services "clickhouse-server"
-    $STD apt purge -y 'clickhouse*' >/dev/null 2>&1 || true
-    rm -rf /var/lib/clickhouse 2>/dev/null || true
-    cleanup_tool_keyrings "clickhouse"
-    ;;
-  esac
-
-  # Clean up old repository files (both .list and .sources)
-  cleanup_old_repo_files "$repo_name"
-
-  return 0
-}
-
-# ------------------------------------------------------------------------------
-# Determine if tool update/upgrade is needed
-# Returns: 0 (update needed), 1 (already up-to-date)
-# Usage: if should_update_tool "mariadb" "11.4"; then ... fi
-# ------------------------------------------------------------------------------
-should_update_tool() {
-  local tool_name="$1"
-  local target_version="$2"
-  local current_version=""
-
-  # Get currently installed version
-  current_version=$(is_tool_installed "$tool_name" 2>/dev/null) || return 0 # Not installed = needs install
-
-  # If versions are identical, no update needed
-  if [[ "$current_version" == "$target_version" ]]; then
-    return 1 # No update needed
-  fi
-
-  return 0 # Update needed
-}
-
-# ---------------------–----------------------------------------------------------
-# Unified repository management for tools
-# Handles adding, updating, and verifying tool repositories
-# Usage: manage_tool_repository "mariadb" "11.4" "https://repo..." "GPG_key_url"
-# Supports: mariadb, mongodb, nodejs, postgresql, php, mysql
-# ------------------------------------------------------------------------------
-manage_tool_repository() {
-  local tool_name="$1"
-  local version="$2"
-  local repo_url="$3"
-  local gpg_key_url="${4:-}"
-  local distro_id repo_component suite
-
-  distro_id=$(awk -F= '/^ID=/{print $2}' /etc/os-release | tr -d '"')
-
-  case "$tool_name" in
-  mariadb)
-    if [[ -z "$repo_url" || -z "$gpg_key_url" ]]; then
-      msg_error "MariaDB repository requires repo_url and gpg_key_url"
-      return 1
-    fi
-
-    # Clean old repos first
-    cleanup_old_repo_files "mariadb"
-
-    # Get suite for fallback handling
-    local distro_codename
-    distro_codename=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
-    suite=$(get_fallback_suite "$distro_id" "$distro_codename" "$repo_url/$distro_id")
-
-    # Setup new repository using deb822 format
-    setup_deb822_repo \
-      "mariadb" \
-      "$gpg_key_url" \
-      "$repo_url/$distro_id" \
-      "$suite" \
-      "main"
-    return 0
-    ;;
-
-  mongodb)
-    if [[ -z "$repo_url" || -z "$gpg_key_url" ]]; then
-      msg_error "MongoDB repository requires repo_url and gpg_key_url"
-      return 1
-    fi
-
-    # Clean old repos first
-    cleanup_old_repo_files "mongodb"
-
-    # Import GPG key
-    mkdir -p /etc/apt/keyrings
-    if ! curl -fsSL "$gpg_key_url" | gpg --dearmor --yes -o "/etc/apt/keyrings/mongodb-server-${version}.gpg" 2>/dev/null; then
-      msg_error "Failed to download MongoDB GPG key"
-      return 1
-    fi
-
-    # Setup repository
-    local distro_codename
-    distro_codename=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
-
-    # Suite mapping with fallback for newer releases not yet supported by upstream
-    if [[ "$distro_id" == "debian" ]]; then
-      case "$distro_codename" in
-      trixie | forky | sid)
-        # Testing/unstable releases fallback to latest stable suite
-        suite="bookworm"
-        ;;
-      bookworm)
-        suite="bookworm"
-        ;;
-      bullseye)
-        suite="bullseye"
-        ;;
-      *)
-        # Unknown release: fallback to latest stable suite
-        msg_warn "Unknown Debian release '${distro_codename}', using bookworm"
-        suite="bookworm"
-        ;;
-      esac
-    elif [[ "$distro_id" == "ubuntu" ]]; then
-      case "$distro_codename" in
-      oracular | plucky)
-        # Newer releases fallback to latest LTS
-        suite="noble"
-        ;;
-      noble)
-        suite="noble"
-        ;;
-      jammy)
-        suite="jammy"
-        ;;
-      focal)
-        suite="focal"
-        ;;
-      *)
-        # Unknown release: fallback to latest LTS
-        msg_warn "Unknown Ubuntu release '${distro_codename}', using noble"
-        suite="noble"
-        ;;
-      esac
-    else
-      # For other distros, try generic fallback
-      suite=$(get_fallback_suite "$distro_id" "$distro_codename" "$repo_url")
-    fi
-
-    repo_component="main"
-    [[ "$distro_id" == "ubuntu" ]] && repo_component="multiverse"
-
-    cat <<EOF >/etc/apt/sources.list.d/mongodb-org-${version}.sources
-Types: deb
-URIs: ${repo_url}
-Suites: ${suite}/mongodb-org/${version}
-Components: ${repo_component}
-Architectures: $(dpkg --print-architecture)
-Signed-By: /etc/apt/keyrings/mongodb-server-${version}.gpg
-EOF
-    return 0
-    ;;
-
-  nodejs)
-    if [[ -z "$repo_url" || -z "$gpg_key_url" ]]; then
-      msg_error "Node.js repository requires repo_url and gpg_key_url"
-      return 1
-    fi
-
-    cleanup_old_repo_files "nodesource"
-
-    # NodeSource uses deb822 format with GPG from repo
-    local distro_codename
-    distro_codename=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
-
-    # Create keyring directory first
-    mkdir -p /etc/apt/keyrings
-
-    # Download GPG key from NodeSource
-    curl -fsSL "$gpg_key_url" | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg || {
-      msg_error "Failed to import NodeSource GPG key"
-      return 1
-    }
-
-    cat <<EOF >/etc/apt/sources.list.d/nodesource.sources
-Types: deb
-URIs: $repo_url
-Suites: nodistro
-Components: main
-Architectures: $(dpkg --print-architecture)
-Signed-By: /etc/apt/keyrings/nodesource.gpg
-EOF
-    return 0
-    ;;
-
-  php)
-    if [[ -z "$gpg_key_url" ]]; then
-      msg_error "PHP repository requires gpg_key_url"
-      return 1
-    fi
-
-    cleanup_old_repo_files "php"
-
-    # Download and install keyring
-    curl -fsSLo /tmp/debsuryorg-archive-keyring.deb "$gpg_key_url" || {
-      msg_error "Failed to download PHP keyring"
-      return 1
-    }
-    dpkg -i /tmp/debsuryorg-archive-keyring.deb >/dev/null 2>&1 || {
-      msg_error "Failed to install PHP keyring"
-      rm -f /tmp/debsuryorg-archive-keyring.deb
-      return 1
-    }
-    rm -f /tmp/debsuryorg-archive-keyring.deb
-
-    # Setup repository
-    local distro_codename
-    distro_codename=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
-    cat <<EOF >/etc/apt/sources.list.d/php.sources
-Types: deb
-URIs: https://packages.sury.org/php
-Suites: $distro_codename
-Components: main
-Architectures: $(dpkg --print-architecture)
-Signed-By: /usr/share/keyrings/deb.sury.org-php.gpg
-EOF
-    return 0
-    ;;
-
-  postgresql)
-    if [[ -z "$gpg_key_url" ]]; then
-      msg_error "PostgreSQL repository requires gpg_key_url"
-      return 1
-    fi
-
-    cleanup_old_repo_files "postgresql"
-
-    # Create keyring directory first
-    mkdir -p /etc/apt/keyrings
-
-    # Import PostgreSQL key
-    curl -fsSL "$gpg_key_url" | gpg --dearmor -o /etc/apt/keyrings/postgresql.gpg || {
-      msg_error "Failed to import PostgreSQL GPG key"
-      return 1
-    }
-
-    # Setup repository
-    local distro_codename
-    distro_codename=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
-    cat <<EOF >/etc/apt/sources.list.d/postgresql.sources
-Types: deb
-URIs: http://apt.postgresql.org/pub/repos/apt
-Suites: $distro_codename-pgdg
-Components: main
-Architectures: $(dpkg --print-architecture)
-Signed-By: /etc/apt/keyrings/postgresql.gpg
-EOF
-    return 0
-    ;;
-
-  *)
-    msg_error "Unknown tool repository: $tool_name"
-    return 1
-    ;;
-  esac
-
-  return 0
-}
-
-# ------–----------------------------------------------------------------------
-# Unified package upgrade function (with apt update caching)
-# ------------------------------------------------------------------------------
-upgrade_package() {
-  local package="$1"
-
-  # Use same caching logic as ensure_dependencies
-  local apt_cache_file="/var/cache/apt-update-timestamp"
-  local current_time=$(date +%s)
-  local last_update=0
-
-  if [[ -f "$apt_cache_file" ]]; then
-    last_update=$(cat "$apt_cache_file" 2>/dev/null || echo 0)
-  fi
-
-  if ((current_time - last_update > 300)); then
-    $STD apt update || {
-      msg_warn "APT update failed in upgrade_package - continuing with cached packages"
-    }
-    echo "$current_time" >"$apt_cache_file"
-  fi
-
-  $STD apt install --only-upgrade -y "$package" || {
-    msg_warn "Failed to upgrade $package"
-    return 1
-  }
-}
-
-# ------------------------------------------------------------------------------
-# Repository availability check
-# ------------------------------------------------------------------------------
-verify_repo_available() {
-  local repo_url="$1"
-  local suite="$2"
-
-  if curl -fsSL --max-time 10 "${repo_url}/dists/${suite}/Release" &>/dev/null; then
-    return 0
-  fi
-  return 1
-}
-
-# ------------------------------------------------------------------------------
-# Ensure dependencies are installed (with apt update caching)
-# ------------------------------------------------------------------------------
-ensure_dependencies() {
-  local deps=("$@")
-  local missing=()
-
-  for dep in "${deps[@]}"; do
-    if ! command -v "$dep" &>/dev/null && ! is_package_installed "$dep"; then
-      missing+=("$dep")
-    fi
-  done
-
-  if [[ ${#missing[@]} -gt 0 ]]; then
-    # Only run apt update if not done recently (within last 5 minutes)
-    local apt_cache_file="/var/cache/apt-update-timestamp"
-    local current_time=$(date +%s)
-    local last_update=0
-
-    if [[ -f "$apt_cache_file" ]]; then
-      last_update=$(cat "$apt_cache_file" 2>/dev/null || echo 0)
-    fi
-
-    if ((current_time - last_update > 300)); then
-      # Ensure orphaned sources are cleaned before updating
-      cleanup_orphaned_sources 2>/dev/null || true
-
-      if ! $STD apt update; then
-        ensure_apt_working || return 1
-      fi
-      echo "$current_time" >"$apt_cache_file"
-    fi
-
-    $STD apt install -y "${missing[@]}" || {
-      msg_error "Failed to install dependencies: ${missing[*]}"
-      return 1
-    }
-  fi
-}
-
-# ------------------------------------------------------------------------------
-# Smart version comparison
-# ------------------------------------------------------------------------------
-version_gt() {
-  test "$(printf '%s\n' "$@" | sort -V | head -n 1)" != "$1"
-}
-
-# ------------------------------------------------------------------------------
-# Get system architecture (normalized)
-# ------------------------------------------------------------------------------
-get_system_arch() {
-  local arch_type="${1:-dpkg}" # dpkg, uname, or both
-  local arch
-
-  case "$arch_type" in
-  dpkg)
-    arch=$(dpkg --print-architecture 2>/dev/null)
-    ;;
-  uname)
-    arch=$(uname -m)
-    [[ "$arch" == "x86_64" ]] && arch="amd64"
-    [[ "$arch" == "aarch64" ]] && arch="arm64"
-    ;;
-  both | *)
-    arch=$(dpkg --print-architecture 2>/dev/null || uname -m)
-    [[ "$arch" == "x86_64" ]] && arch="amd64"
-    [[ "$arch" == "aarch64" ]] && arch="arm64"
-    ;;
-  esac
-
-  echo "$arch"
-}
-
-# ------------------------------------------------------------------------------
-# Create temporary directory with automatic cleanup
-# ------------------------------------------------------------------------------
-create_temp_dir() {
-  local tmp_dir=$(mktemp -d)
-  # Set trap to cleanup on EXIT, ERR, INT, TERM
-  trap "rm -rf '$tmp_dir'" EXIT ERR INT TERM
-  echo "$tmp_dir"
-}
-
-# ------------------------------------------------------------------------------
-# Check if package is installed (faster than dpkg -l | grep)
-# ------------------------------------------------------------------------------
-is_package_installed() {
-  local package="$1"
-  dpkg-query -W -f='${Status}' "$package" 2>/dev/null | grep -q "^install ok installed$"
-}
-
-# ------------------------------------------------------------------------------
-# GitHub API call with authentication and rate limit handling
-# ------------------------------------------------------------------------------
-github_api_call() {
-  local url="$1"
-  local output_file="${2:-/dev/stdout}"
-  local max_retries=3
-  local retry_delay=2
-
-  local header_args=()
-  [[ -n "${GITHUB_TOKEN:-}" ]] && header_args=(-H "Authorization: Bearer $GITHUB_TOKEN")
-
-  for attempt in $(seq 1 $max_retries); do
-    local http_code
-    http_code=$(curl -fsSL -w "%{http_code}" -o "$output_file" \
-      -H "Accept: application/vnd.github+json" \
-      -H "X-GitHub-Api-Version: 2022-11-28" \
-      "${header_args[@]}" \
-      "$url" 2>/dev/null || echo "000")
-
-    case "$http_code" in
-    200)
-      return 0
-      ;;
-    403)
-      # Rate limit - check if we can retry
-      if [[ $attempt -lt $max_retries ]]; then
-        msg_warn "GitHub API rate limit, waiting ${retry_delay}s... (attempt $attempt/$max_retries)"
-        sleep "$retry_delay"
-        retry_delay=$((retry_delay * 2))
-        continue
-      fi
-      msg_error "GitHub API rate limit exceeded. Set GITHUB_TOKEN to increase limits."
-      return 1
-      ;;
-    404)
-      msg_error "GitHub API endpoint not found: $url"
-      return 1
-      ;;
-    *)
-      if [[ $attempt -lt $max_retries ]]; then
-        sleep "$retry_delay"
-        continue
-      fi
-      msg_error "GitHub API call failed with HTTP $http_code"
-      return 1
-      ;;
-    esac
-  done
-
-  return 1
-}
-
-should_upgrade() {
-  local current="$1"
-  local target="$2"
-
-  [[ -z "$current" ]] && return 0
-  version_gt "$target" "$current" && return 0
-  return 1
-}
-
-# ------------------------------------------------------------------------------
-# Get OS information (cached for performance)
-# ------------------------------------------------------------------------------
-get_os_info() {
-  local field="${1:-all}" # id, codename, version, version_id, all
-
-  # Cache OS info to avoid repeated file reads
-  if [[ -z "${_OS_ID:-}" ]]; then
-    export _OS_ID=$(awk -F= '/^ID=/{gsub(/"/,"",$2); print $2}' /etc/os-release)
-    export _OS_CODENAME=$(awk -F= '/^VERSION_CODENAME=/{gsub(/"/,"",$2); print $2}' /etc/os-release)
-    export _OS_VERSION=$(awk -F= '/^VERSION_ID=/{gsub(/"/,"",$2); print $2}' /etc/os-release)
-    export _OS_VERSION_FULL=$(awk -F= '/^VERSION=/{gsub(/"/,"",$2); print $2}' /etc/os-release)
-  fi
-
-  case "$field" in
-  id) echo "$_OS_ID" ;;
-  codename) echo "$_OS_CODENAME" ;;
-  version) echo "$_OS_VERSION" ;;
-  version_id) echo "$_OS_VERSION" ;;
-  version_full) echo "$_OS_VERSION_FULL" ;;
-  all) echo "ID=$_OS_ID CODENAME=$_OS_CODENAME VERSION=$_OS_VERSION" ;;
-  *) echo "$_OS_ID" ;;
-  esac
-}
-
-# ------------------------------------------------------------------------------
-# Check if running on specific OS
-# ------------------------------------------------------------------------------
-is_debian() {
-  [[ "$(get_os_info id)" == "debian" ]]
-}
-
-is_ubuntu() {
-  [[ "$(get_os_info id)" == "ubuntu" ]]
-}
-
-is_alpine() {
-  [[ "$(get_os_info id)" == "alpine" ]]
-}
-
-# ------------------------------------------------------------------------------
-# Get Debian/Ubuntu major version
-# ------------------------------------------------------------------------------
-get_os_version_major() {
-  local version=$(get_os_info version)
-  echo "${version%%.*}"
-}
-
-# ------------------------------------------------------------------------------
-# Download file with retry logic and progress
-# ------------------------------------------------------------------------------
-download_file() {
-  local url="$1"
-  local output="$2"
-  local max_retries="${3:-3}"
-  local show_progress="${4:-false}"
-
-  local curl_opts=(-fsSL)
-  [[ "$show_progress" == "true" ]] && curl_opts=(-fL#)
-
-  for attempt in $(seq 1 $max_retries); do
-    if curl "${curl_opts[@]}" -o "$output" "$url"; then
-      return 0
-    fi
-
-    if [[ $attempt -lt $max_retries ]]; then
-      msg_warn "Download failed, retrying... (attempt $attempt/$max_retries)"
-      sleep 2
-    fi
-  done
-
-  msg_error "Failed to download: $url"
-  return 1
-}
-
-# ------------------------------------------------------------------------------
-# Get fallback suite for repository (comprehensive mapping)
-# ------------------------------------------------------------------------------
-get_fallback_suite() {
-  local distro_id="$1"
-  local distro_codename="$2"
-  local repo_base_url="$3"
-
-  # Check if current codename works
-  if verify_repo_available "$repo_base_url" "$distro_codename"; then
-    echo "$distro_codename"
-    return 0
-  fi
-
-  # Comprehensive fallback mappings
-  case "$distro_id" in
-  debian)
-    case "$distro_codename" in
-    # Debian 13 (Trixie) → Debian 12 (Bookworm)
-    trixie | forky | sid)
-      echo "bookworm"
-      ;;
-    # Debian 12 (Bookworm) stays
-    bookworm)
-      echo "bookworm"
-      ;;
-    # Debian 11 (Bullseye) stays
-    bullseye)
-      echo "bullseye"
-      ;;
-    # Unknown → latest stable
-    *)
-      echo "bookworm"
-      ;;
-    esac
-    ;;
-  ubuntu)
-    case "$distro_codename" in
-    # Ubuntu 24.10 (Oracular) → 24.04 LTS (Noble)
-    oracular | plucky)
-      echo "noble"
-      ;;
-    # Ubuntu 24.04 LTS (Noble) stays
-    noble)
-      echo "noble"
-      ;;
-    # Ubuntu 23.10 (Mantic) → 22.04 LTS (Jammy)
-    mantic | lunar)
-      echo "jammy"
-      ;;
-    # Ubuntu 22.04 LTS (Jammy) stays
-    jammy)
-      echo "jammy"
-      ;;
-    # Ubuntu 20.04 LTS (Focal) stays
-    focal)
-      echo "focal"
-      ;;
-    # Unknown → latest LTS
-    *)
-      echo "jammy"
-      ;;
-    esac
-    ;;
-  *)
-    echo "$distro_codename"
-    ;;
-  esac
-}
-
-# ------------------------------------------------------------------------------
-# Verify package source and version
-# ------------------------------------------------------------------------------
-verify_package_source() {
-  local package="$1"
-  local expected_version="$2"
-
-  if apt-cache policy "$package" 2>/dev/null | grep -q "$expected_version"; then
-    return 0
-  fi
-  return 1
-}
-
-# ------------------------------------------------------------------------------
-# Check if running on LTS version
-# ------------------------------------------------------------------------------
-is_lts_version() {
-  local os_id=$(get_os_info id)
-  local codename=$(get_os_info codename)
-
-  if [[ "$os_id" == "ubuntu" ]]; then
-    case "$codename" in
-    focal | jammy | noble) return 0 ;; # 20.04, 22.04, 24.04
-    *) return 1 ;;
-    esac
-  elif [[ "$os_id" == "debian" ]]; then
-    # Debian releases are all "stable"
-    case "$codename" in
-    bullseye | bookworm | trixie) return 0 ;;
-    *) return 1 ;;
-    esac
-  fi
-
-  return 1
-}
-
-# ------------------------------------------------------------------------------
-# Get optimal number of parallel jobs (cached)
-# ------------------------------------------------------------------------------
-get_parallel_jobs() {
-  if [[ -z "${_PARALLEL_JOBS:-}" ]]; then
-    local cpu_count=$(nproc 2>/dev/null || echo 1)
-    local mem_gb=$(free -g | awk '/^Mem:/{print $2}')
-
-    # Limit by available memory (assume 1GB per job for compilation)
-    local max_by_mem=$((mem_gb > 0 ? mem_gb : 1))
-    local max_jobs=$((cpu_count < max_by_mem ? cpu_count : max_by_mem))
-
-    # At least 1, at most cpu_count
-    export _PARALLEL_JOBS=$((max_jobs > 0 ? max_jobs : 1))
-  fi
-  echo "$_PARALLEL_JOBS"
-}
-
-# ------------------------------------------------------------------------------
-# Get default PHP version for OS
-# ------------------------------------------------------------------------------
-get_default_php_version() {
-  local os_id=$(get_os_info id)
-  local os_version=$(get_os_version_major)
-
-  case "$os_id" in
-  debian)
-    case "$os_version" in
-    13) echo "8.3" ;; # Debian 13 (Trixie)
-    12) echo "8.2" ;; # Debian 12 (Bookworm)
-    11) echo "7.4" ;; # Debian 11 (Bullseye)
-    *) echo "8.2" ;;
-    esac
-    ;;
-  ubuntu)
-    case "$os_version" in
-    24) echo "8.3" ;; # Ubuntu 24.04 LTS (Noble)
-    22) echo "8.1" ;; # Ubuntu 22.04 LTS (Jammy)
-    20) echo "7.4" ;; # Ubuntu 20.04 LTS (Focal)
-    *) echo "8.1" ;;
-    esac
-    ;;
-  *)
-    echo "8.2"
-    ;;
-  esac
-}
-
-# ------------------------------------------------------------------------------
-# Get default Python version for OS
-# ------------------------------------------------------------------------------
-get_default_python_version() {
-  local os_id=$(get_os_info id)
-  local os_version=$(get_os_version_major)
-
-  case "$os_id" in
-  debian)
-    case "$os_version" in
-    13) echo "3.12" ;; # Debian 13 (Trixie)
-    12) echo "3.11" ;; # Debian 12 (Bookworm)
-    11) echo "3.9" ;;  # Debian 11 (Bullseye)
-    *) echo "3.11" ;;
-    esac
-    ;;
-  ubuntu)
-    case "$os_version" in
-    24) echo "3.12" ;; # Ubuntu 24.04 LTS
-    22) echo "3.10" ;; # Ubuntu 22.04 LTS
-    20) echo "3.8" ;;  # Ubuntu 20.04 LTS
-    *) echo "3.10" ;;
-    esac
-    ;;
-  *)
-    echo "3.11"
-    ;;
-  esac
-}
-
-# ------------------------------------------------------------------------------
-# Get default Node.js LTS version
-# ------------------------------------------------------------------------------
-get_default_nodejs_version() {
-  # Always return current LTS (as of 2025)
-  echo "22"
-}
-
-# ------------------------------------------------------------------------------
-# Check if package manager is locked
-# ------------------------------------------------------------------------------
-is_apt_locked() {
-  if fuser /var/lib/dpkg/lock-frontend &>/dev/null ||
-    fuser /var/lib/apt/lists/lock &>/dev/null ||
-    fuser /var/cache/apt/archives/lock &>/dev/null; then
-    return 0
-  fi
-  return 1
-}
-
-# ------------------------------------------------------------------------------
-# Wait for apt to be available
-# ------------------------------------------------------------------------------
-wait_for_apt() {
-  local max_wait="${1:-300}" # 5 minutes default
-  local waited=0
-
-  while is_apt_locked; do
-    if [[ $waited -ge $max_wait ]]; then
-      msg_error "Timeout waiting for apt to be available"
-      return 1
-    fi
-
-    sleep 5
-    waited=$((waited + 5))
-  done
-
-  return 0
-}
-
-# ------------------------------------------------------------------------------
-# Cleanup old repository files (migration helper)
-# ------------------------------------------------------------------------------
-cleanup_old_repo_files() {
-  local app="$1"
-
-  # Remove old-style .list files (including backups)
-  rm -f /etc/apt/sources.list.d/"${app}"*.list
-  rm -f /etc/apt/sources.list.d/"${app}"*.list.save
-  rm -f /etc/apt/sources.list.d/"${app}"*.list.distUpgrade
-  rm -f /etc/apt/sources.list.d/"${app}"*.list.dpkg-*
-
-  # Remove old GPG keys from trusted.gpg.d
-  rm -f /etc/apt/trusted.gpg.d/"${app}"*.gpg
-
-  # Remove keyrings from /etc/apt/keyrings
-  rm -f /etc/apt/keyrings/"${app}"*.gpg
-
-  # Remove ALL .sources files for this app (including the main one)
-  # This ensures no orphaned .sources files reference deleted keyrings
-  rm -f /etc/apt/sources.list.d/"${app}"*.sources
-}
-
-# ------------------------------------------------------------------------------
-# Cleanup orphaned .sources files that reference missing keyrings
-# This prevents APT signature verification errors
-# Call this at the start of any setup function to ensure APT is in a clean state
-# ------------------------------------------------------------------------------
-cleanup_orphaned_sources() {
-  local sources_dir="/etc/apt/sources.list.d"
-  local keyrings_dir="/etc/apt/keyrings"
-
-  [[ ! -d "$sources_dir" ]] && return 0
-
-  while IFS= read -r -d '' sources_file; do
-    local basename_file
-    basename_file=$(basename "$sources_file")
-
-    # NEVER remove debian.sources - this is the standard Debian repository
-    if [[ "$basename_file" == "debian.sources" ]]; then
-      continue
-    fi
-
-    # Extract Signed-By path from .sources file
-    local keyring_path
-    keyring_path=$(grep -E '^Signed-By:' "$sources_file" 2>/dev/null | awk '{print $2}')
-
-    # If keyring doesn't exist, remove the .sources file
-    if [[ -n "$keyring_path" ]] && [[ ! -f "$keyring_path" ]]; then
-      rm -f "$sources_file"
-    fi
-  done < <(find "$sources_dir" -name "*.sources" -print0 2>/dev/null)
-
-  # Also check for broken symlinks in keyrings directory
-  if [[ -d "$keyrings_dir" ]]; then
-    find "$keyrings_dir" -type l ! -exec test -e {} \; -delete 2>/dev/null || true
-  fi
-}
-
-# ------------------------------------------------------------------------------
-# Ensure APT is in a working state before installing packages
-# This should be called at the start of any setup function
-# ------------------------------------------------------------------------------
-ensure_apt_working() {
-  # Clean up orphaned sources first
-  cleanup_orphaned_sources
-
-  # Try to update package lists
-  if ! $STD apt update; then
-    # More aggressive cleanup
-    rm -f /etc/apt/sources.list.d/*.sources 2>/dev/null || true
-    cleanup_orphaned_sources
-
-    # Try again
-    if ! $STD apt update; then
-      msg_error "Cannot update package lists - APT is critically broken"
-      return 1
-    fi
-  fi
-
-  return 0
-}
-
-# ------------------------------------------------------------------------------
-# Standardized deb822 repository setup (with optional Architectures)
-# Always runs apt update after repo creation to ensure package availability
-# ------------------------------------------------------------------------------
-setup_deb822_repo() {
-  local name="$1"
-  local gpg_url="$2"
-  local repo_url="$3"
-  local suite="$4"
-  local component="${5-main}"
-  local architectures="${6-}" # optional
-
-  # Validate required parameters
-  if [[ -z "$name" || -z "$gpg_url" || -z "$repo_url" || -z "$suite" ]]; then
-    msg_error "setup_deb822_repo: missing required parameters (name=$name repo=$repo_url suite=$suite)"
-    return 1
-  fi
-
-  # Cleanup
-  cleanup_old_repo_files "$name"
-  cleanup_orphaned_sources
-
-  mkdir -p /etc/apt/keyrings || {
-    msg_error "Failed to create /etc/apt/keyrings"
-    return 1
-  }
-
-  # Import GPG
-  curl -fsSL "$gpg_url" | gpg --dearmor --yes -o "/etc/apt/keyrings/${name}.gpg" || {
-    msg_error "Failed to import GPG key for ${name}"
-    return 1
-  }
-
-  # Write deb822
-  {
-    echo "Types: deb"
-    echo "URIs: $repo_url"
-    echo "Suites: $suite"
-    echo "Components: $component"
-    [[ -n "$architectures" ]] && echo "Architectures: $architectures"
-    echo "Signed-By: /etc/apt/keyrings/${name}.gpg"
-  } >/etc/apt/sources.list.d/${name}.sources
-
-  $STD apt update
-}
-
-# ------------------------------------------------------------------------------
-# Package version hold/unhold helpers
-# ------------------------------------------------------------------------------
-hold_package_version() {
-  local package="$1"
-  $STD apt-mark hold "$package"
-}
-
-unhold_package_version() {
-  local package="$1"
-  $STD apt-mark unhold "$package"
-}
-
-# ------------------------------------------------------------------------------
-# Safe service restart with verification
-# ------------------------------------------------------------------------------
-safe_service_restart() {
-  local service="$1"
-
-  if systemctl is-active --quiet "$service"; then
-    $STD systemctl restart "$service"
-  else
-    $STD systemctl start "$service"
-  fi
-
-  if ! systemctl is-active --quiet "$service"; then
-    msg_error "Failed to start $service"
-    systemctl status "$service" --no-pager
-    return 1
-  fi
-  return 0
-}
-
-# ------------------------------------------------------------------------------
-# Enable and start service (with error handling)
-# ------------------------------------------------------------------------------
-enable_and_start_service() {
-  local service="$1"
-
-  if ! systemctl enable "$service" &>/dev/null; then
-    return 1
-  fi
-
-  if ! systemctl start "$service" &>/dev/null; then
-    msg_error "Failed to start $service"
-    systemctl status "$service" --no-pager
-    return 1
-  fi
-
-  return 0
-}
-
-# ------------------------------------------------------------------------------
-# Check if service is enabled
-# ------------------------------------------------------------------------------
-is_service_enabled() {
-  local service="$1"
-  systemctl is-enabled --quiet "$service" 2>/dev/null
-}
-
-# ------------------------------------------------------------------------------
-# Check if service is running
-# ------------------------------------------------------------------------------
-is_service_running() {
-  local service="$1"
-  systemctl is-active --quiet "$service" 2>/dev/null
-}
-
-# ------------------------------------------------------------------------------
-# Extract version from JSON (GitHub releases)
-# ------------------------------------------------------------------------------
-extract_version_from_json() {
-  local json="$1"
-  local field="${2:-tag_name}"
-  local strip_v="${3:-true}"
-
-  ensure_dependencies jq
-
-  local version
-  version=$(echo "$json" | jq -r ".${field} // empty")
-
-  if [[ -z "$version" ]]; then
-    return 1
-  fi
-
-  if [[ "$strip_v" == "true" ]]; then
-    echo "${version#v}"
-  else
-    echo "$version"
-  fi
-}
-
-# ------------------------------------------------------------------------------
-# Get latest GitHub release version
-# ------------------------------------------------------------------------------
-get_latest_github_release() {
-  local repo="$1"
-  local strip_v="${2:-true}"
-  local temp_file=$(mktemp)
-
-  if ! github_api_call "https://api.github.com/repos/${repo}/releases/latest" "$temp_file"; then
-    rm -f "$temp_file"
-    return 1
-  fi
-
-  local version
-  version=$(extract_version_from_json "$(cat "$temp_file")" "tag_name" "$strip_v")
-  rm -f "$temp_file"
-
-  if [[ -z "$version" ]]; then
-    return 1
-  fi
-
-  echo "$version"
-}
-
-# ------------------------------------------------------------------------------
-# Debug logging (only if DEBUG=1)
-# ------------------------------------------------------------------------------
-debug_log() {
-  [[ "${DEBUG:-0}" == "1" ]] && echo "[DEBUG] $*" >&2
-}
-
-# ------------------------------------------------------------------------------
-# Performance timing helper
-# ------------------------------------------------------------------------------
-start_timer() {
-  echo $(date +%s)
-}
-
-end_timer() {
-  local start_time="$1"
-  local label="${2:-Operation}"
-  local end_time=$(date +%s)
-  local duration=$((end_time - start_time))
-}
-
-# ------------------------------------------------------------------------------
-# GPG key fingerprint verification
-# ------------------------------------------------------------------------------
-verify_gpg_fingerprint() {
-  local key_file="$1"
-  local expected_fingerprint="$2"
-
-  local actual_fingerprint
-  actual_fingerprint=$(gpg --show-keys --with-fingerprint --with-colons "$key_file" 2>&1 | grep -m1 '^fpr:' | cut -d: -f10)
-
-  if [[ "$actual_fingerprint" == "$expected_fingerprint" ]]; then
-    return 0
-  fi
-
-  msg_error "GPG fingerprint mismatch! Expected: $expected_fingerprint, Got: $actual_fingerprint"
-  return 1
-}
-
-# ==============================================================================
-# INSTALL FUNCTIONS
-# ==============================================================================
-
-# ------------------------------------------------------------------------------
-# Checks for new GitHub release (latest tag).
-#
-# Description:
-#   - Queries the GitHub API for the latest release tag
-#   - Compares it to a local cached version (~/.<app>)
-#   - If newer, sets global CHECK_UPDATE_RELEASE and returns 0
-#
-# Usage:
-#     if check_for_gh_release "flaresolverr" "FlareSolverr/FlareSolverr" [optional] "v1.1.1"; then
-#       # trigger update...
-#     fi
-#     exit 0
-#     } (end of update_script not from the function)
-#
-# Notes:
-#   - Requires `jq` (auto-installed if missing)
-#   - Does not modify anything, only checks version state
-#   - Does not support pre-releases
-# ------------------------------------------------------------------------------
-check_for_gh_release() {
-  local app="$1"
-  local source="$2"
-  local pinned_version_in="${3:-}" # optional
-  local app_lc="${app,,}"
-  local current_file="$HOME/.${app_lc}"
-
-  msg_info "Checking for update: ${app}"
-
-  # DNS check
-  if ! getent hosts api.github.com >/dev/null 2>&1; then
-    msg_error "Network error: cannot resolve api.github.com"
-    return 1
-  fi
-
-  ensure_dependencies jq
-
-  # Fetch releases and exclude drafts/prereleases
-  local releases_json
-  releases_json=$(curl -fsSL --max-time 20 \
-    -H 'Accept: application/vnd.github+json' \
-    -H 'X-GitHub-Api-Version: 2022-11-28' \
-    "https://api.github.com/repos/${source}/releases") || {
-    msg_error "Unable to fetch releases for ${app}"
-    return 1
-  }
-
-  mapfile -t raw_tags < <(jq -r '.[] | select(.draft==false and .prerelease==false) | .tag_name' <<<"$releases_json")
-  if ((${#raw_tags[@]} == 0)); then
-    msg_error "No stable releases found for ${app}"
-    return 1
-  fi
-
-  local clean_tags=()
-  for t in "${raw_tags[@]}"; do
-    clean_tags+=("${t#v}")
-  done
-
-  local latest_raw="${raw_tags[0]}"
-  local latest_clean="${clean_tags[0]}"
-
-  # current installed (stored without v)
-  local current=""
-  if [[ -f "$current_file" ]]; then
-    current="$(<"$current_file")"
-  else
-    # Migration: search for any /opt/*_version.txt
-    local legacy_files
-    mapfile -t legacy_files < <(find /opt -maxdepth 1 -type f -name "*_version.txt" 2>/dev/null)
-    if ((${#legacy_files[@]} == 1)); then
-      current="$(<"${legacy_files[0]}")"
-      echo "${current#v}" >"$current_file"
-      rm -f "${legacy_files[0]}"
-    fi
-  fi
-  current="${current#v}"
-
-  # Pinned version handling
-  if [[ -n "$pinned_version_in" ]]; then
-    local pin_clean="${pinned_version_in#v}"
-    local match_raw=""
-    for i in "${!clean_tags[@]}"; do
-      if [[ "${clean_tags[$i]}" == "$pin_clean" ]]; then
-        match_raw="${raw_tags[$i]}"
-        break
-      fi
-    done
-
-    if [[ -z "$match_raw" ]]; then
-      msg_error "Pinned version ${pinned_version_in} not found upstream"
-      return 1
-    fi
-
-    if [[ "$current" != "$pin_clean" ]]; then
-      CHECK_UPDATE_RELEASE="$match_raw"
-      msg_ok "Update available: ${app} ${current:-not installed} → ${pin_clean}"
-      return 0
-    fi
-
-    msg_ok "No update available: ${app} is already on pinned version (${current})"
-    return 1
-  fi
-
-  # No pinning → use latest
-  if [[ -z "$current" || "$current" != "$latest_clean" ]]; then
-    CHECK_UPDATE_RELEASE="$latest_raw"
-    msg_ok "Update available: ${app} ${current:-not installed} → ${latest_clean}"
-    return 0
-  fi
-
-  msg_ok "No update available: ${app} (${latest_clean})"
-  return 1
-}
-
-# ------------------------------------------------------------------------------
-# Creates and installs self-signed certificates.
-#
-# Description:
-#   - Create a self-signed certificate with option to override application name
-#
-# Variables:
-#   APP   - Application name (default: $APPLICATION variable)
-# ------------------------------------------------------------------------------
-create_self_signed_cert() {
-  local APP_NAME="${1:-${APPLICATION}}"
-  local CERT_DIR="/etc/ssl/${APP_NAME}"
-  local CERT_KEY="${CERT_DIR}/${APP_NAME}.key"
-  local CERT_CRT="${CERT_DIR}/${APP_NAME}.crt"
-
-  if [[ -f "$CERT_CRT" && -f "$CERT_KEY" ]]; then
-    return 0
-  fi
-
-  # Use ensure_dependencies for cleaner handling
-  ensure_dependencies openssl || {
-    msg_error "Failed to install OpenSSL"
-    return 1
-  }
-
-  mkdir -p "$CERT_DIR"
-  $STD openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 \
-    -subj "/C=US/ST=State/L=City/O=Organization/CN=${APP_NAME}" \
-    -keyout "$CERT_KEY" \
-    -out "$CERT_CRT" || {
-    msg_error "Failed to create self-signed certificate"
-    return 1
-  }
-
-  chmod 600 "$CERT_KEY"
-  chmod 644 "$CERT_CRT"
-}
-
-# ------------------------------------------------------------------------------
-# Downloads file with optional progress indicator using pv.
-#
-# Arguments:
-#   $1 - URL
-#   $2 - Destination path
-# ------------------------------------------------------------------------------
-
-function download_with_progress() {
-  local url="$1"
-  local output="$2"
-  if [ -n "$SPINNER_PID" ] && ps -p "$SPINNER_PID" >/dev/null; then kill "$SPINNER_PID" >/dev/null; fi
-
-  ensure_dependencies pv
-  set -o pipefail
-
-  # Content-Length aus HTTP-Header holen
-  local content_length
-  content_length=$(curl -fsSLI "$url" | awk '/Content-Length/ {print $2}' | tr -d '\r' || true)
-
-  if [[ -z "$content_length" ]]; then
-    if ! curl -fL# -o "$output" "$url"; then
-      msg_error "Download failed"
-      return 1
-    fi
-  else
-    if ! curl -fsSL "$url" | pv -s "$content_length" >"$output"; then
-      msg_error "Download failed"
-      return 1
-    fi
-  fi
-}
-
-# ------------------------------------------------------------------------------
-# Ensures /usr/local/bin is permanently in system PATH.
-#
-# Description:
-#   - Adds to /etc/profile.d if not present
-# ------------------------------------------------------------------------------
-
-function ensure_usr_local_bin_persist() {
-  local PROFILE_FILE="/etc/profile.d/custom_path.sh"
-
-  if [[ ! -f "$PROFILE_FILE" ]] && ! command -v pveversion &>/dev/null; then
-    echo 'export PATH="/usr/local/bin:$PATH"' >"$PROFILE_FILE"
-    chmod +x "$PROFILE_FILE"
-  fi
-}
-
-# ------------------------------------------------------------------------------
-# Downloads and deploys latest GitHub release (source, binary, tarball, asset).
-#
-# Description:
-#   - Fetches latest release metadata from GitHub API
-#   - Supports the following modes:
-#       - tarball: Source code tarball (default if omitted)
-#       - source: Alias for tarball (same behavior)
-#       - binary: .deb package install (arch-dependent)
-#       - prebuild: Prebuilt .tar.gz archive (e.g. Go binaries)
-#       - singlefile: Standalone binary (no archive, direct chmod +x install)
-#   - Handles download, extraction/installation and version tracking in ~/.<app>
-#
-# Parameters:
-#   $1   APP               - Application name (used for install path and version file)
-#   $2   REPO              - GitHub repository in form user/repo
-#   $3   MODE              - Release type:
-#                              tarball   → source tarball (.tar.gz)
-#                              binary    → .deb file (auto-arch matched)
-#                              prebuild  → prebuilt archive (e.g. tar.gz)
-#                              singlefile→ standalone binary (chmod +x)
-#   $4   VERSION           - Optional release tag (default: latest)
-#   $5   TARGET_DIR        - Optional install path (default: /opt/<app>)
-#   $6   ASSET_FILENAME    - Required for:
-#                              - prebuild  → archive filename or pattern
-#                              - singlefile→ binary filename or pattern
-#
-# Optional:
-#   - Set GITHUB_TOKEN env var to increase API rate limit (recommended for CI/CD).
-#
-# Examples:
-#   # 1. Minimal: Fetch and deploy source tarball
-#   fetch_and_deploy_gh_release "myapp" "myuser/myapp"
-#
-#   # 2. Binary install via .deb asset (architecture auto-detected)
-#   fetch_and_deploy_gh_release "myapp" "myuser/myapp" "binary"
-#
-#   # 3. Prebuilt archive (.tar.gz) with asset filename match
-#   fetch_and_deploy_gh_release "hanko" "teamhanko/hanko" "prebuild" "latest" "/opt/hanko" "hanko_Linux_x86_64.tar.gz"
-#
-#   # 4. Single binary (chmod +x) like Argus, Promtail etc.
-#   fetch_and_deploy_gh_release "argus" "release-argus/Argus" "singlefile" "0.26.3" "/opt/argus" "Argus-.*linux-amd64"
-# ------------------------------------------------------------------------------
-
-function fetch_and_deploy_gh_release() {
-  local app="$1"
-  local repo="$2"
-  local mode="${3:-tarball}" # tarball | binary | prebuild | singlefile
-  local version="${4:-latest}"
-  local target="${5:-/opt/$app}"
-  local asset_pattern="${6:-}"
-
-  local app_lc=$(echo "${app,,}" | tr -d ' ')
-  local version_file="$HOME/.${app_lc}"
-
-  local api_timeout="--connect-timeout 10 --max-time 60"
-  local download_timeout="--connect-timeout 15 --max-time 900"
-
-  local current_version=""
-  [[ -f "$version_file" ]] && current_version=$(<"$version_file")
-
-  ensure_dependencies jq
-
-  local api_url="https://api.github.com/repos/$repo/releases"
-  [[ "$version" != "latest" ]] && api_url="$api_url/tags/$version" || api_url="$api_url/latest"
-  local header=()
-  [[ -n "${GITHUB_TOKEN:-}" ]] && header=(-H "Authorization: token $GITHUB_TOKEN")
-
-  # dns pre check
-  local gh_host
-  gh_host=$(awk -F/ '{print $3}' <<<"$api_url")
-  if ! getent hosts "$gh_host" &>/dev/null; then
-    msg_error "DNS resolution failed for $gh_host – check /etc/resolv.conf or networking"
-    return 1
-  fi
-
-  local max_retries=3 retry_delay=2 attempt=1 success=false resp http_code
-
-  while ((attempt <= max_retries)); do
-    resp=$(curl $api_timeout -fsSL -w "%{http_code}" -o /tmp/gh_rel.json "${header[@]}" "$api_url") && success=true && break
-    sleep "$retry_delay"
-    ((attempt++))
-  done
-
-  if ! $success; then
-    msg_error "Failed to fetch release metadata from $api_url after $max_retries attempts"
-    return 1
-  fi
-
-  http_code="${resp:(-3)}"
-  [[ "$http_code" != "200" ]] && {
-    msg_error "GitHub API returned HTTP $http_code"
-    return 1
-  }
-
-  local json tag_name
-  json=$(</tmp/gh_rel.json)
-  tag_name=$(echo "$json" | jq -r '.tag_name // .name // empty')
-  [[ "$tag_name" =~ ^v ]] && version="${tag_name:1}" || version="$tag_name"
-
-  if [[ "$current_version" == "$version" ]]; then
-    $STD msg_ok "$app is already up-to-date (v$version)"
-    return 0
-  fi
-
-  local tmpdir
-  tmpdir=$(mktemp -d) || return 1
-  local filename="" url=""
-
-  msg_info "Fetching GitHub release: $app ($version)"
-
-  local clean_install=false
-  [[ -n "${CLEAN_INSTALL:-}" && "$CLEAN_INSTALL" == "1" ]] && clean_install=true
-
-  ### Tarball Mode ###
-  if [[ "$mode" == "tarball" || "$mode" == "source" ]]; then
-    url=$(echo "$json" | jq -r '.tarball_url // empty')
-    [[ -z "$url" ]] && url="https://github.com/$repo/archive/refs/tags/v$version.tar.gz"
-    filename="${app_lc}-${version}.tar.gz"
-
-    curl $download_timeout -fsSL -o "$tmpdir/$filename" "$url" || {
-      msg_error "Download failed: $url"
-      rm -rf "$tmpdir"
-      return 1
-    }
-
-    mkdir -p "$target"
-    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      rm -rf "${target:?}/"*
-    fi
-
-    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
-      msg_error "Failed to extract tarball"
-      rm -rf "$tmpdir"
-      return 1
-    }
-    local unpack_dir
-    unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
-
-    shopt -s dotglob nullglob
-    cp -r "$unpack_dir"/* "$target/"
-    shopt -u dotglob nullglob
-
-    ### Binary Mode ###
-  elif [[ "$mode" == "binary" ]]; then
-    local arch
-    arch=$(dpkg --print-architecture 2>/dev/null || uname -m)
-    [[ "$arch" == "x86_64" ]] && arch="amd64"
-    [[ "$arch" == "aarch64" ]] && arch="arm64"
-
-    local assets url_match=""
-    assets=$(echo "$json" | jq -r '.assets[].browser_download_url')
-
-    # If explicit filename pattern is provided (param $6), match that first
-    if [[ -n "$asset_pattern" ]]; then
-      for u in $assets; do
-        case "${u##*/}" in
-        $asset_pattern)
-          url_match="$u"
-          break
-          ;;
-        esac
-      done
-    fi
-
-    # If no match via explicit pattern, fall back to architecture heuristic
-    if [[ -z "$url_match" ]]; then
-      for u in $assets; do
-        if [[ "$u" =~ ($arch|amd64|x86_64|aarch64|arm64).*\.deb$ ]]; then
-          url_match="$u"
-          break
-        fi
-      done
-    fi
-
-    # Fallback: any .deb file
-    if [[ -z "$url_match" ]]; then
-      for u in $assets; do
-        [[ "$u" =~ \.deb$ ]] && url_match="$u" && break
-      done
-    fi
-
-    if [[ -z "$url_match" ]]; then
-      msg_error "No suitable .deb asset found for $app"
-      rm -rf "$tmpdir"
-      return 1
-    fi
-
-    filename="${url_match##*/}"
-    curl $download_timeout -fsSL -o "$tmpdir/$filename" "$url_match" || {
-      msg_error "Download failed: $url_match"
-      rm -rf "$tmpdir"
-      return 1
-    }
-
-    chmod 644 "$tmpdir/$filename"
-    $STD apt install -y "$tmpdir/$filename" || {
-      $STD dpkg -i "$tmpdir/$filename" || {
-        msg_error "Both apt and dpkg installation failed"
-        rm -rf "$tmpdir"
-        return 1
-      }
-    }
-
-    ### Prebuild Mode ###
-  elif [[ "$mode" == "prebuild" ]]; then
-    local pattern="${6%\"}"
-    pattern="${pattern#\"}"
-    [[ -z "$pattern" ]] && {
-      msg_error "Mode 'prebuild' requires 6th parameter (asset filename pattern)"
-      rm -rf "$tmpdir"
-      return 1
-    }
-
-    local asset_url=""
-    for u in $(echo "$json" | jq -r '.assets[].browser_download_url'); do
-      filename_candidate="${u##*/}"
-      case "$filename_candidate" in
-      $pattern)
-        asset_url="$u"
-        break
-        ;;
-      esac
-    done
-
-    [[ -z "$asset_url" ]] && {
-      msg_error "No asset matching '$pattern' found"
-      rm -rf "$tmpdir"
-      return 1
-    }
-
-    filename="${asset_url##*/}"
-    curl $download_timeout -fsSL -o "$tmpdir/$filename" "$asset_url" || {
-      msg_error "Download failed: $asset_url"
-      rm -rf "$tmpdir"
-      return 1
-    }
-
-    local unpack_tmp
-    unpack_tmp=$(mktemp -d)
-    mkdir -p "$target"
-    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      rm -rf "${target:?}/"*
-    fi
-
-    if [[ "$filename" == *.zip ]]; then
-      ensure_dependencies unzip
-      unzip -q "$tmpdir/$filename" -d "$unpack_tmp" || {
-        msg_error "Failed to extract ZIP archive"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 1
-      }
-    elif [[ "$filename" == *.tar.* || "$filename" == *.tgz ]]; then
-      tar --no-same-owner -xf "$tmpdir/$filename" -C "$unpack_tmp" || {
-        msg_error "Failed to extract TAR archive"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 1
-      }
-    else
-      msg_error "Unsupported archive format: $filename"
-      rm -rf "$tmpdir" "$unpack_tmp"
-      return 1
-    fi
-
-    local top_dirs
-    top_dirs=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1 -type d | wc -l)
-    local top_entries inner_dir
-    top_entries=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1)
-    if [[ "$(echo "$top_entries" | wc -l)" -eq 1 && -d "$top_entries" ]]; then
-      # Strip leading folder
-      inner_dir="$top_entries"
-      shopt -s dotglob nullglob
-      if compgen -G "$inner_dir/*" >/dev/null; then
-        cp -r "$inner_dir"/* "$target/" || {
-          msg_error "Failed to copy contents from $inner_dir to $target"
-          rm -rf "$tmpdir" "$unpack_tmp"
-          return 1
-        }
-      else
-        msg_error "Inner directory is empty: $inner_dir"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 1
-      fi
-      shopt -u dotglob nullglob
-    else
-      # Copy all contents
-      shopt -s dotglob nullglob
-      if compgen -G "$unpack_tmp/*" >/dev/null; then
-        cp -r "$unpack_tmp"/* "$target/" || {
-          msg_error "Failed to copy contents to $target"
-          rm -rf "$tmpdir" "$unpack_tmp"
-          return 1
-        }
-      else
-        msg_error "Unpacked archive is empty"
-        rm -rf "$tmpdir" "$unpack_tmp"
-        return 1
-      fi
-      shopt -u dotglob nullglob
-    fi
-
-    ### Singlefile Mode ###
-  elif [[ "$mode" == "singlefile" ]]; then
-    local pattern="${6%\"}"
-    pattern="${pattern#\"}"
-    [[ -z "$pattern" ]] && {
-      msg_error "Mode 'singlefile' requires 6th parameter (asset filename pattern)"
-      rm -rf "$tmpdir"
-      return 1
-    }
-
-    local asset_url=""
-    for u in $(echo "$json" | jq -r '.assets[].browser_download_url'); do
-      filename_candidate="${u##*/}"
-      case "$filename_candidate" in
-      $pattern)
-        asset_url="$u"
-        break
-        ;;
-      esac
-    done
-
-    [[ -z "$asset_url" ]] && {
-      msg_error "No asset matching '$pattern' found"
-      rm -rf "$tmpdir"
-      return 1
-    }
-
-    filename="${asset_url##*/}"
-    mkdir -p "$target"
-
-    local use_filename="${USE_ORIGINAL_FILENAME:-false}"
-    local target_file="$app"
-    [[ "$use_filename" == "true" ]] && target_file="$filename"
-
-    curl $download_timeout -fsSL -o "$target/$target_file" "$asset_url" || {
-      msg_error "Download failed: $asset_url"
-      rm -rf "$tmpdir"
-      return 1
-    }
-
-    if [[ "$target_file" != *.jar && -f "$target/$target_file" ]]; then
-      chmod +x "$target/$target_file"
-    fi
-
-  else
-    msg_error "Unknown mode: $mode"
-    rm -rf "$tmpdir"
-    return 1
-  fi
-
-  echo "$version" >"$version_file"
-  msg_ok "Deployed: $app ($version)"
-  rm -rf "$tmpdir"
-}
-
-# ------------------------------------------------------------------------------
-# Loads LOCAL_IP from persistent store or detects if missing.
-#
-# Description:
-#   - Loads from /run/local-ip.env or performs runtime lookup
-# ------------------------------------------------------------------------------
-
-function import_local_ip() {
-  local IP_FILE="/run/local-ip.env"
-  if [[ -f "$IP_FILE" ]]; then
-    # shellcheck disable=SC1090
-    source "$IP_FILE"
-  fi
-
-  if [[ -z "${LOCAL_IP:-}" ]]; then
-    get_current_ip() {
-      local targets=("8.8.8.8" "1.1.1.1" "192.168.1.1" "10.0.0.1" "172.16.0.1" "default")
-      local ip
-
-      for target in "${targets[@]}"; do
-        if [[ "$target" == "default" ]]; then
-          ip=$(ip route get 1 2>/dev/null | awk '{for(i=1;i<=NF;i++) if ($i=="src") print $(i+1)}')
-        else
-          ip=$(ip route get "$target" 2>/dev/null | awk '{for(i=1;i<=NF;i++) if ($i=="src") print $(i+1)}')
-        fi
-        if [[ -n "$ip" ]]; then
-          echo "$ip"
-          return 0
-        fi
-      done
-
-      return 1
-    }
-
-    LOCAL_IP="$(get_current_ip || true)"
-    if [[ -z "$LOCAL_IP" ]]; then
-      msg_error "Could not determine LOCAL_IP"
-      return 1
-    fi
-  fi
-
-  export LOCAL_IP
-}
-
-# ------------------------------------------------------------------------------
-# Installs Adminer (Debian/Ubuntu via APT, Alpine via direct download).
-#
-# Description:
-#   - Adds Adminer to Apache or web root
-#   - Supports Alpine and Debian-based systems
-# ------------------------------------------------------------------------------
-
-function setup_adminer() {
-  if grep -qi alpine /etc/os-release; then
-    msg_info "Setup Adminer (Alpine)"
-    mkdir -p /var/www/localhost/htdocs/adminer
-    curl -fsSL https://github.com/vrana/adminer/releases/latest/download/adminer.php \
-      -o /var/www/localhost/htdocs/adminer/index.php || {
-      msg_error "Failed to download Adminer"
-      return 1
-    }
-    cache_installed_version "adminer" "latest-alpine"
-    msg_ok "Setup Adminer (Alpine)"
-  else
-    msg_info "Setup Adminer (Debian/Ubuntu)"
-    ensure_dependencies adminer
-    $STD a2enconf adminer || {
-      msg_error "Failed to enable Adminer Apache config"
-      return 1
-    }
-    $STD systemctl reload apache2 || {
-      msg_error "Failed to reload Apache"
-      return 1
-    }
-    local VERSION
-    VERSION=$(dpkg -s adminer 2>/dev/null | grep '^Version:' | awk '{print $2}')
-    cache_installed_version "adminer" "${VERSION:-unknown}"
-    msg_ok "Setup Adminer (Debian/Ubuntu)"
-  fi
-}
-
-# ------------------------------------------------------------------------------
-# Installs or updates Composer globally (robust, idempotent).
-#
-# - Installs to /usr/local/bin/composer
-# - Removes old binaries/symlinks in /usr/bin, /bin, /root/.composer, etc.
-# - Ensures /usr/local/bin is in PATH (permanent)
-# - Auto-updates to latest version
-# ------------------------------------------------------------------------------
-
-function setup_composer() {
-  local COMPOSER_BIN="/usr/local/bin/composer"
-  export COMPOSER_ALLOW_SUPERUSER=1
-
-  # Get currently installed version
-  local INSTALLED_VERSION=""
-  if [[ -x "$COMPOSER_BIN" ]]; then
-    INSTALLED_VERSION=$("$COMPOSER_BIN" --version 2>/dev/null | awk '{print $3}')
-  fi
-
-  # Scenario 1: Already installed - just self-update
-  if [[ -n "$INSTALLED_VERSION" ]]; then
-    msg_info "Update Composer $INSTALLED_VERSION"
-    $STD "$COMPOSER_BIN" self-update --no-interaction || true
-    local UPDATED_VERSION
-    UPDATED_VERSION=$("$COMPOSER_BIN" --version 2>/dev/null | awk '{print $3}')
-    cache_installed_version "composer" "$UPDATED_VERSION"
-    msg_ok "Update Composer $UPDATED_VERSION"
-    return 0
-  fi
-
-  # Scenario 2: Fresh install
-  msg_info "Setup Composer"
-
-  for old in /usr/bin/composer /bin/composer /root/.composer/vendor/bin/composer; do
-    [[ -e "$old" && "$old" != "$COMPOSER_BIN" ]] && rm -f "$old"
-  done
-
-  ensure_usr_local_bin_persist
-  export PATH="/usr/local/bin:$PATH"
-
-  curl -fsSL https://getcomposer.org/installer -o /tmp/composer-setup.php || {
-    msg_error "Failed to download Composer installer"
-    return 1
-  }
-
-  $STD php /tmp/composer-setup.php --install-dir=/usr/local/bin --filename=composer || {
-    msg_error "Failed to install Composer"
-    rm -f /tmp/composer-setup.php
-    return 1
-  }
-  rm -f /tmp/composer-setup.php
-
-  if [[ ! -x "$COMPOSER_BIN" ]]; then
-    msg_error "Composer installation failed"
-    return 1
-  fi
-
-  chmod +x "$COMPOSER_BIN"
-  $STD "$COMPOSER_BIN" self-update --no-interaction || true
-
-  local FINAL_VERSION
-  FINAL_VERSION=$("$COMPOSER_BIN" --version 2>/dev/null | awk '{print $3}')
-  cache_installed_version "composer" "$FINAL_VERSION"
-  msg_ok "Setup Composer"
-}
-
-# ------------------------------------------------------------------------------
-# Installs FFmpeg from source or prebuilt binary (Debian/Ubuntu only).
-#
-# Description:
-#   - Downloads and builds FFmpeg from GitHub (https://github.com/FFmpeg/FFmpeg)
-#   - Supports specific version override via FFMPEG_VERSION (e.g. n7.1.1)
-#   - Supports build profile via FFMPEG_TYPE:
-#       - minimal : x264, vpx, mp3 only
-#       - medium  : adds subtitles, fonts, opus, vorbis
-#       - full    : adds dav1d, svt-av1, zlib, numa
-#       - binary  : downloads static build (johnvansickle.com)
-#   - Defaults to latest stable version and full feature set
-#
-# Notes:
-#   - Requires: curl, jq, build-essential, and matching codec libraries
-#   - Result is installed to /usr/local/bin/ffmpeg
-# ------------------------------------------------------------------------------
-
-function setup_ffmpeg() {
-  local TMP_DIR=$(mktemp -d)
-  local GITHUB_REPO="FFmpeg/FFmpeg"
-  local VERSION="${FFMPEG_VERSION:-latest}"
-  local TYPE="${FFMPEG_TYPE:-full}"
-  local BIN_PATH="/usr/local/bin/ffmpeg"
-
-  # Get currently installed version
-  local INSTALLED_VERSION=""
-  if command -v ffmpeg &>/dev/null; then
-    INSTALLED_VERSION=$(ffmpeg -version 2>/dev/null | head -n1 | awk '{print $3}')
-  fi
-
-  msg_info "Setup FFmpeg ${VERSION} ($TYPE)"
-
-  # Binary fallback mode
-  if [[ "$TYPE" == "binary" ]]; then
-    curl -fsSL https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz -o "$TMP_DIR/ffmpeg.tar.xz" || {
-      msg_error "Failed to download FFmpeg binary"
-      rm -rf "$TMP_DIR"
-      return 1
-    }
-    tar -xf "$TMP_DIR/ffmpeg.tar.xz" -C "$TMP_DIR" || {
-      msg_error "Failed to extract FFmpeg binary"
-      rm -rf "$TMP_DIR"
-      return 1
-    }
-    local EXTRACTED_DIR
-    EXTRACTED_DIR=$(find "$TMP_DIR" -maxdepth 1 -type d -name "ffmpeg-*")
-    cp "$EXTRACTED_DIR/ffmpeg" "$BIN_PATH"
-    cp "$EXTRACTED_DIR/ffprobe" /usr/local/bin/ffprobe
-    chmod +x "$BIN_PATH" /usr/local/bin/ffprobe
-    local FINAL_VERSION=$($BIN_PATH -version 2>/dev/null | head -n1 | awk '{print $3}')
-    rm -rf "$TMP_DIR"
-    cache_installed_version "ffmpeg" "$FINAL_VERSION"
-    ensure_usr_local_bin_persist
-    [[ -n "$INSTALLED_VERSION" ]] && msg_ok "Upgrade FFmpeg $INSTALLED_VERSION → $FINAL_VERSION" || msg_ok "Setup FFmpeg $FINAL_VERSION"
-    return 0
-  fi
-
-  ensure_dependencies jq
-
-  # Auto-detect latest stable version if none specified
-  if [[ "$VERSION" == "latest" || -z "$VERSION" ]]; then
-    local ffmpeg_tags
-    ffmpeg_tags=$(curl -fsSL --max-time 15 "https://api.github.com/repos/${GITHUB_REPO}/tags" 2>/dev/null || echo "")
-
-    if [[ -z "$ffmpeg_tags" ]]; then
-      msg_warn "Could not fetch FFmpeg versions from GitHub, trying binary fallback"
-      VERSION="" # Will trigger binary fallback below
-    else
-      VERSION=$(echo "$ffmpeg_tags" | jq -r '.[].name' 2>/dev/null |
-        grep -E '^n[0-9]+\.[0-9]+\.[0-9]+$' |
-        sort -V | tail -n1 || echo "")
-    fi
-  fi
-
-  if [[ -z "$VERSION" ]]; then
-    msg_info "Could not determine FFmpeg source version, using pre-built binary"
-    VERSION="" # Will use binary fallback
-  fi
-
-  # Dependency selection
-  local DEPS=(build-essential yasm nasm pkg-config)
-  case "$TYPE" in
-  minimal)
-    DEPS+=(libx264-dev libvpx-dev libmp3lame-dev)
-    ;;
-  medium)
-    DEPS+=(libx264-dev libvpx-dev libmp3lame-dev libfreetype6-dev libass-dev libopus-dev libvorbis-dev)
-    ;;
-  full)
-    DEPS+=(
-      libx264-dev libx265-dev libvpx-dev libmp3lame-dev
-      libfreetype6-dev libass-dev libopus-dev libvorbis-dev
-      libdav1d-dev libsvtav1-dev zlib1g-dev libnuma-dev
-      libva-dev libdrm-dev
-    )
-    ;;
-  *)
-    msg_error "Invalid FFMPEG_TYPE: $TYPE"
-    rm -rf "$TMP_DIR"
-    return 1
-    ;;
-  esac
-
-  ensure_dependencies "${DEPS[@]}"
-
-  # Try to download source if VERSION is set
-  if [[ -n "$VERSION" ]]; then
-    curl -fsSL "https://github.com/${GITHUB_REPO}/archive/refs/tags/${VERSION}.tar.gz" -o "$TMP_DIR/ffmpeg.tar.gz" || {
-      msg_warn "Failed to download FFmpeg source ${VERSION}, falling back to pre-built binary"
-      VERSION=""
-    }
-  fi
-
-  # If no source download (either VERSION empty or download failed), use binary
-  if [[ -z "$VERSION" ]]; then
-    msg_info "Setup FFmpeg from pre-built binary"
-    curl -fsSL https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz -o "$TMP_DIR/ffmpeg.tar.xz" || {
-      msg_error "Failed to download FFmpeg pre-built binary"
-      rm -rf "$TMP_DIR"
-      return 1
-    }
-
-    tar -xJf "$TMP_DIR/ffmpeg.tar.xz" -C "$TMP_DIR" || {
-      msg_error "Failed to extract FFmpeg binary archive"
-      rm -rf "$TMP_DIR"
-      return 1
-    }
-
-    if ! cp "$TMP_DIR/ffmpeg-"*/ffmpeg /usr/local/bin/ffmpeg 2>/dev/null; then
-      msg_error "Failed to install FFmpeg binary"
-      rm -rf "$TMP_DIR"
-      return 1
-    fi
-
-    cache_installed_version "ffmpeg" "static"
-    rm -rf "$TMP_DIR"
-    msg_ok "Setup FFmpeg from pre-built binary"
-    return 0
-  fi
-
-  tar -xzf "$TMP_DIR/ffmpeg.tar.gz" -C "$TMP_DIR" || {
-    msg_error "Failed to extract FFmpeg source"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-
-  cd "$TMP_DIR/FFmpeg-"* || {
-    msg_error "Source extraction failed"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-
-  local args=(
-    --enable-gpl
-    --enable-shared
-    --enable-nonfree
-    --disable-static
-    --enable-libx264
-    --enable-libvpx
-    --enable-libmp3lame
-  )
-
-  if [[ "$TYPE" != "minimal" ]]; then
-    args+=(--enable-libfreetype --enable-libass --enable-libopus --enable-libvorbis)
-  fi
-
-  if [[ "$TYPE" == "full" ]]; then
-    args+=(--enable-libx265 --enable-libdav1d --enable-zlib)
-    args+=(--enable-vaapi --enable-libdrm)
-  fi
-
-  if [[ ${#args[@]} -eq 0 ]]; then
-    msg_error "FFmpeg configure args array is empty"
-    rm -rf "$TMP_DIR"
-    return 1
-  fi
-
-  $STD ./configure "${args[@]}" || {
-    msg_error "FFmpeg configure failed"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-  $STD make -j"$(nproc)" || {
-    msg_error "FFmpeg compilation failed"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-  $STD make install || {
-    msg_error "FFmpeg installation failed"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-  echo "/usr/local/lib" >/etc/ld.so.conf.d/ffmpeg.conf
-  $STD ldconfig
-
-  ldconfig -p 2>/dev/null | grep libavdevice >/dev/null || {
-    msg_error "libavdevice not registered with dynamic linker"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-
-  if ! command -v ffmpeg &>/dev/null; then
-    msg_error "FFmpeg installation failed"
-    rm -rf "$TMP_DIR"
-    return 1
-  fi
-
-  local FINAL_VERSION
-  FINAL_VERSION=$(ffmpeg -version 2>/dev/null | head -n1 | awk '{print $3}')
-  rm -rf "$TMP_DIR"
-  cache_installed_version "ffmpeg" "$FINAL_VERSION"
-  ensure_usr_local_bin_persist
-  [[ -n "$INSTALLED_VERSION" ]] && msg_ok "Upgrade FFmpeg $INSTALLED_VERSION → $FINAL_VERSION" || msg_ok "Setup FFmpeg $FINAL_VERSION"
-}
-
-# ------------------------------------------------------------------------------
-# Installs Go (Golang) from official tarball.
-#
-# Description:
-#   - Determines system architecture
-#   - Downloads latest version if GO_VERSION not set
-#
-# Variables:
-#   GO_VERSION     - Version to install (e.g. 1.22.2 or latest)
-# ------------------------------------------------------------------------------
-
-function setup_go() {
-  local ARCH
-  case "$(uname -m)" in
-  x86_64) ARCH="amd64" ;;
-  aarch64) ARCH="arm64" ;;
-  *)
-    msg_error "Unsupported architecture: $(uname -m)"
-    return 1
-    ;;
-  esac
-
-  # Resolve "latest" version
-  local GO_VERSION="${GO_VERSION:-latest}"
-  if [[ "$GO_VERSION" == "latest" ]]; then
-    GO_VERSION=$(curl -fsSL https://go.dev/VERSION?m=text 2>/dev/null | head -n1 | sed 's/^go//') || {
-      msg_error "Could not determine latest Go version"
-      return 1
-    }
-    [[ -z "$GO_VERSION" ]] && {
-      msg_error "Latest Go version is empty"
-      return 1
-    }
-  fi
-
-  local GO_BIN="/usr/local/bin/go"
-  local GO_INSTALL_DIR="/usr/local/go"
-
-  # Get currently installed version
-  local CURRENT_VERSION=""
-  if [[ -x "$GO_BIN" ]]; then
-    CURRENT_VERSION=$("$GO_BIN" version 2>/dev/null | awk '{print $3}' | sed 's/go//')
-  fi
-
-  # Scenario 1: Already at target version
-  if [[ -n "$CURRENT_VERSION" && "$CURRENT_VERSION" == "$GO_VERSION" ]]; then
-    cache_installed_version "go" "$GO_VERSION"
-    return 0
-  fi
-
-  # Scenario 2: Different version or not installed
-  if [[ -n "$CURRENT_VERSION" && "$CURRENT_VERSION" != "$GO_VERSION" ]]; then
-    msg_info "Upgrade Go from $CURRENT_VERSION to $GO_VERSION"
-    remove_old_tool_version "go"
-  else
-    msg_info "Setup Go $GO_VERSION"
-  fi
-
-  local TARBALL="go${GO_VERSION}.linux-${ARCH}.tar.gz"
-  local URL="https://go.dev/dl/${TARBALL}"
-  local TMP_TAR=$(mktemp)
-
-  curl -fsSL "$URL" -o "$TMP_TAR" || {
-    msg_error "Failed to download Go $GO_VERSION"
-    rm -f "$TMP_TAR"
-    return 1
-  }
-
-  $STD tar -C /usr/local -xzf "$TMP_TAR" || {
-    msg_error "Failed to extract Go tarball"
-    rm -f "$TMP_TAR"
-    return 1
-  }
-
-  ln -sf /usr/local/go/bin/go /usr/local/bin/go
-  ln -sf /usr/local/go/bin/gofmt /usr/local/bin/gofmt
-  rm -f "$TMP_TAR"
-
-  cache_installed_version "go" "$GO_VERSION"
-  ensure_usr_local_bin_persist
-  msg_ok "Setup Go $GO_VERSION"
-}
-
-# ------------------------------------------------------------------------------
-# Installs or updates Ghostscript (gs) from source.
-#
-# Description:
-#   - Fetches latest release
-#   - Builds and installs system-wide
-# ------------------------------------------------------------------------------
-
-function setup_gs() {
-  local TMP_DIR=$(mktemp -d)
-  local CURRENT_VERSION=$(gs --version 2>/dev/null || echo "0")
-
-  ensure_dependencies jq
-
-  local RELEASE_JSON
-  RELEASE_JSON=$(curl -fsSL --max-time 15 https://api.github.com/repos/ArtifexSoftware/ghostpdl-downloads/releases/latest 2>/dev/null || echo "")
-
-  if [[ -z "$RELEASE_JSON" ]]; then
-    msg_warn "Cannot fetch latest Ghostscript version from GitHub API"
-    # Try to get from current version
-    if command -v gs &>/dev/null; then
-      gs --version | head -n1
-      cache_installed_version "ghostscript" "$CURRENT_VERSION"
-      return 0
-    fi
-    msg_error "Cannot determine Ghostscript version and no existing installation found"
-    return 1
-  fi
-  local LATEST_VERSION
-  LATEST_VERSION=$(echo "$RELEASE_JSON" | jq -r '.tag_name' | sed 's/^gs//')
-  local LATEST_VERSION_DOTTED
-  LATEST_VERSION_DOTTED=$(echo "$RELEASE_JSON" | jq -r '.name' | grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+')
-
-  if [[ -z "$LATEST_VERSION" || -z "$LATEST_VERSION_DOTTED" ]]; then
-    msg_warn "Could not determine latest Ghostscript version from GitHub - checking system"
-    # Fallback: try to use system version or return error
-    if [[ "$CURRENT_VERSION" == "0" ]]; then
-      msg_error "Ghostscript not installed and cannot determine latest version"
-      rm -rf "$TMP_DIR"
-      return 1
-    fi
-    rm -rf "$TMP_DIR"
-    return 0
-  fi
-
-  # Scenario 1: Already at latest version
-  if [[ -n "$LATEST_VERSION_DOTTED" ]] && dpkg --compare-versions "$CURRENT_VERSION" ge "$LATEST_VERSION_DOTTED" 2>/dev/null; then
-    cache_installed_version "ghostscript" "$LATEST_VERSION_DOTTED"
-    rm -rf "$TMP_DIR"
-    return 0
-  fi
-
-  # Scenario 2: New install or upgrade
-  if [[ "$CURRENT_VERSION" != "0" && "$CURRENT_VERSION" != "$LATEST_VERSION_DOTTED" ]]; then
-    msg_info "Upgrade Ghostscript from $CURRENT_VERSION to $LATEST_VERSION_DOTTED"
-  else
-    msg_info "Setup Ghostscript $LATEST_VERSION_DOTTED"
-  fi
-
-  curl -fsSL "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs${LATEST_VERSION}/ghostscript-${LATEST_VERSION_DOTTED}.tar.gz" -o "$TMP_DIR/ghostscript.tar.gz" || {
-    msg_error "Failed to download Ghostscript"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-
-  if ! tar -xzf "$TMP_DIR/ghostscript.tar.gz" -C "$TMP_DIR"; then
-    msg_error "Failed to extract Ghostscript archive"
-    rm -rf "$TMP_DIR"
-    return 1
-  fi
-
-  # Verify directory exists before cd
-  if [[ ! -d "$TMP_DIR/ghostscript-${LATEST_VERSION_DOTTED}" ]]; then
-    msg_error "Ghostscript source directory not found: $TMP_DIR/ghostscript-${LATEST_VERSION_DOTTED}"
-    rm -rf "$TMP_DIR"
-    return 1
-  fi
-
-  cd "$TMP_DIR/ghostscript-${LATEST_VERSION_DOTTED}" || {
-    msg_error "Failed to enter Ghostscript source directory"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-
-  ensure_dependencies build-essential libpng-dev zlib1g-dev
-
-  $STD ./configure || {
-    msg_error "Ghostscript configure failed"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-  $STD make -j"$(nproc)" || {
-    msg_error "Ghostscript compilation failed"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-  $STD make install || {
-    msg_error "Ghostscript installation failed"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-
-  hash -r
-  if [[ ! -x "$(command -v gs)" ]]; then
-    if [[ -x /usr/local/bin/gs ]]; then
-      ln -sf /usr/local/bin/gs /usr/bin/gs
-    fi
-  fi
-
-  rm -rf "$TMP_DIR"
-  cache_installed_version "ghostscript" "$LATEST_VERSION_DOTTED"
-  ensure_usr_local_bin_persist
-  msg_ok "Setup Ghostscript $LATEST_VERSION_DOTTED"
-}
-
-# ------------------------------------------------------------------------------
-# Sets up Hardware Acceleration on debian or ubuntu.
-#
-# Description:
-#   - Determites CPU/GPU/APU Vendor
-#   - Installs the correct libraries and packages
-#   - Sets up Hardware Acceleration
-#
-# Notes:
-#   - Some things are fetched from intel repositories due to not being in debian repositories.
-# ------------------------------------------------------------------------------
-function setup_hwaccel() {
-  msg_info "Setup Hardware Acceleration"
-
-  if ! command -v lspci &>/dev/null; then
-    $STD apt -y update || {
-      msg_error "Failed to update package list"
-      return 1
-    }
-    $STD apt -y install pciutils || {
-      msg_error "Failed to install pciutils"
-      return 1
-    }
-  fi
-
-  # Detect GPU vendor (Intel, AMD, NVIDIA)
-  local gpu_vendor
-  gpu_vendor=$(lspci 2>/dev/null | grep -Ei 'vga|3d|display' | grep -Eo 'Intel|AMD|NVIDIA' | head -n1 || echo "")
-
-  # Detect CPU vendor (relevant for AMD APUs)
-  local cpu_vendor
-  cpu_vendor=$(lscpu 2>/dev/null | grep -i 'Vendor ID' | awk '{print $3}' || echo "")
-
-  if [[ -z "$gpu_vendor" && -z "$cpu_vendor" ]]; then
-    msg_error "No GPU or CPU vendor detected (missing lspci/lscpu output)"
-    return 1
-  fi
-
-  # Detect OS with fallbacks
-  local os_id os_codename
-  os_id=$(grep -oP '(?<=^ID=).+' /etc/os-release 2>/dev/null | tr -d '"' || grep '^ID=' /etc/os-release 2>/dev/null | cut -d'=' -f2 | tr -d '"' || echo "debian")
-  os_codename=$(grep -oP '(?<=^VERSION_CODENAME=).+' /etc/os-release 2>/dev/null | tr -d '"' || grep '^VERSION_CODENAME=' /etc/os-release 2>/dev/null | cut -d'=' -f2 | tr -d '"' || echo "unknown")
-
-  # Validate os_id
-  if [[ -z "$os_id" ]]; then
-    os_id="debian"
-  fi
-
-  # Determine if we are on a VM or LXC
-  local in_ct="${CTTYPE:-0}"
-
-  case "$gpu_vendor" in
-  Intel)
-    if [[ "$os_id" == "ubuntu" ]]; then
-      $STD apt -y install intel-opencl-icd || {
-        msg_error "Failed to install intel-opencl-icd"
-        return 1
-      }
-    else
-      # For Debian: fetch Intel GPU drivers from GitHub
-      fetch_and_deploy_gh_release "" "intel/intel-graphics-compiler" "binary" "latest" "" "intel-igc-core-2_*_amd64.deb" || {
-        msg_warn "Failed to deploy Intel IGC core 2"
-      }
-      fetch_and_deploy_gh_release "" "intel/intel-graphics-compiler" "binary" "latest" "" "intel-igc-opencl-2_*_amd64.deb" || {
-        msg_warn "Failed to deploy Intel IGC OpenCL 2"
-      }
-      fetch_and_deploy_gh_release "" "intel/compute-runtime" "binary" "latest" "" "libigdgmm12_*_amd64.deb" || {
-        msg_warn "Failed to deploy Intel GDGMM12"
-      }
-      fetch_and_deploy_gh_release "" "intel/compute-runtime" "binary" "latest" "" "intel-opencl-icd_*_amd64.deb" || {
-        msg_warn "Failed to deploy Intel OpenCL ICD"
-      }
-    fi
-
-    $STD apt -y install va-driver-all ocl-icd-libopencl1 vainfo intel-gpu-tools || {
-      msg_error "Failed to install Intel GPU dependencies"
-      return 1
-    }
-    ;;
-  AMD)
-    $STD apt -y install mesa-va-drivers mesa-vdpau-drivers mesa-opencl-icd vainfo clinfo || {
-      msg_error "Failed to install AMD GPU dependencies"
-      return 1
-    }
-
-    # For AMD CPUs without discrete GPU (APUs)
-    if [[ "$cpu_vendor" == "AuthenticAMD" && -n "$gpu_vendor" ]]; then
-      $STD apt -y install libdrm-amdgpu1 firmware-amd-graphics || true
-    fi
-    ;;
-  NVIDIA)
-    # NVIDIA needs manual driver setup - skip for now
-    msg_info "NVIDIA GPU detected - manual driver setup required"
-    ;;
-  *)
-    # If no discrete GPU, but AMD CPU (e.g., Ryzen APU)
-    if [[ "$cpu_vendor" == "AuthenticAMD" ]]; then
-      $STD apt -y install mesa-opencl-icd ocl-icd-libopencl1 clinfo || {
-        msg_error "Failed to install Mesa OpenCL stack"
-        return 1
-      }
-    else
-      msg_warn "No supported GPU vendor detected - skipping GPU acceleration"
-    fi
-    ;;
-  esac
-
-  if [[ "$in_ct" == "0" ]]; then
-    chgrp video /dev/dri 2>/dev/null || true
-    chmod 755 /dev/dri 2>/dev/null || true
-    chmod 660 /dev/dri/* 2>/dev/null || true
-    $STD adduser "$(id -u -n)" video
-    $STD adduser "$(id -u -n)" render
-  fi
-
-  cache_installed_version "hwaccel" "1.0"
-  msg_ok "Setup Hardware Acceleration"
-}
-
-# ------------------------------------------------------------------------------
-# Installs ImageMagick 7 from source (Debian/Ubuntu only).
-#
-# Description:
-#   - Downloads the latest ImageMagick source tarball
-#   - Builds and installs ImageMagick to /usr/local
-#   - Configures dynamic linker (ldconfig)
-#
-# Notes:
-#   - Requires: build-essential, libtool, libjpeg-dev, libpng-dev, etc.
-# ------------------------------------------------------------------------------
-function setup_imagemagick() {
-  local TMP_DIR=$(mktemp -d)
-  local BINARY_PATH="/usr/local/bin/magick"
-
-  # Get currently installed version
-  local INSTALLED_VERSION=""
-  if command -v magick &>/dev/null; then
-    INSTALLED_VERSION=$(magick -version | awk '/^Version/ {print $3}')
-  fi
-
-  msg_info "Setup ImageMagick"
-
-  ensure_dependencies \
-    build-essential \
-    libtool \
-    libjpeg-dev \
-    libpng-dev \
-    libtiff-dev \
-    libwebp-dev \
-    libheif-dev \
-    libde265-dev \
-    libopenjp2-7-dev \
-    libxml2-dev \
-    liblcms2-dev \
-    libfreetype6-dev \
-    libraw-dev \
-    libfftw3-dev \
-    liblqr-1-0-dev \
-    libgsl-dev \
-    pkg-config \
-    ghostscript
-
-  curl -fsSL https://imagemagick.org/archive/ImageMagick.tar.gz -o "$TMP_DIR/ImageMagick.tar.gz" || {
-    msg_error "Failed to download ImageMagick"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-
-  tar -xzf "$TMP_DIR/ImageMagick.tar.gz" -C "$TMP_DIR" || {
-    msg_error "Failed to extract ImageMagick"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-
-  cd "$TMP_DIR"/ImageMagick-* || {
-    msg_error "Source extraction failed"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-
-  $STD ./configure --disable-static || {
-    msg_error "ImageMagick configure failed"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-  $STD make -j"$(nproc)" || {
-    msg_error "ImageMagick compilation failed"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-  $STD make install || {
-    msg_error "ImageMagick installation failed"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-  $STD ldconfig /usr/local/lib
-
-  if [[ ! -x "$BINARY_PATH" ]]; then
-    msg_error "ImageMagick installation failed"
-    rm -rf "$TMP_DIR"
-    return 1
-  fi
-
-  local FINAL_VERSION
-  FINAL_VERSION=$("$BINARY_PATH" -version | awk '/^Version/ {print $3}')
-  rm -rf "$TMP_DIR"
-  cache_installed_version "imagemagick" "$FINAL_VERSION"
-  ensure_usr_local_bin_persist
-
-  if [[ -n "$INSTALLED_VERSION" ]]; then
-    msg_ok "Upgrade ImageMagick $INSTALLED_VERSION → $FINAL_VERSION"
-  else
-    msg_ok "Setup ImageMagick $FINAL_VERSION"
-  fi
-}
-
-# ------------------------------------------------------------------------------
-# Installs Temurin JDK via Adoptium APT repository.
-#
-# Description:
-#   - Removes previous JDK if version mismatch
-#   - Installs or upgrades to specified JAVA_VERSION
-#
-# Variables:
-#   JAVA_VERSION   - Temurin JDK version to install (e.g. 17, 21)
-# ------------------------------------------------------------------------------
-
-function setup_java() {
-  local JAVA_VERSION="${JAVA_VERSION:-21}"
-  local DISTRO_ID DISTRO_CODENAME
-  DISTRO_ID=$(awk -F= '/^ID=/{print $2}' /etc/os-release | tr -d '"')
-  DISTRO_CODENAME=$(awk -F= '/VERSION_CODENAME/ { print $2 }' /etc/os-release)
-  local DESIRED_PACKAGE="temurin-${JAVA_VERSION}-jdk"
-
-  # Prepare repository (cleanup + validation)
-  prepare_repository_setup "adoptium" || {
-    msg_error "Failed to prepare Adoptium repository"
-    return 1
-  }
-
-  # Add repo if needed
-  if [[ ! -f /etc/apt/sources.list.d/adoptium.sources ]]; then
-    local SUITE
-    SUITE=$(get_fallback_suite "$DISTRO_ID" "$DISTRO_CODENAME" "https://packages.adoptium.net/artifactory/deb")
-    setup_deb822_repo \
-      "adoptium" \
-      "https://packages.adoptium.net/artifactory/api/gpg/key/public" \
-      "https://packages.adoptium.net/artifactory/deb" \
-      "$SUITE" \
-      "main"
-  fi
-
-  # Get currently installed version
-  local INSTALLED_VERSION=""
-  if dpkg -l | grep -q "temurin-.*-jdk" 2>/dev/null; then
-    INSTALLED_VERSION=$(dpkg -l 2>/dev/null | awk '/temurin-.*-jdk/{print $2}' | grep -oP 'temurin-\K[0-9]+' | head -n1 || echo "")
-  fi
-
-  # Validate INSTALLED_VERSION is not empty if matched
-  local JDK_COUNT=0
-  JDK_COUNT=$(dpkg -l 2>/dev/null | grep -c "temurin-.*-jdk" || true)
-  if [[ -z "$INSTALLED_VERSION" && "${JDK_COUNT:-0}" -gt 0 ]]; then
-    msg_warn "Found Temurin JDK but cannot determine version"
-    INSTALLED_VERSION="0"
-  fi
-
-  # Scenario 1: Already at correct version
-  if [[ "$INSTALLED_VERSION" == "$JAVA_VERSION" ]]; then
-    msg_info "Update Temurin JDK $JAVA_VERSION"
-    ensure_apt_working || return 1
-    upgrade_packages_with_retry "$DESIRED_PACKAGE" || {
-      msg_error "Failed to update Temurin JDK"
-      return 1
-    }
-    cache_installed_version "temurin-jdk" "$JAVA_VERSION"
-    msg_ok "Update Temurin JDK $JAVA_VERSION"
-    return 0
-  fi
-
-  # Scenario 2: Different version - remove old and install new
-  if [[ -n "$INSTALLED_VERSION" ]]; then
-    msg_info "Upgrade Temurin JDK from $INSTALLED_VERSION to $JAVA_VERSION"
-    $STD apt purge -y "temurin-${INSTALLED_VERSION}-jdk" || true
-  else
-    msg_info "Setup Temurin JDK $JAVA_VERSION"
-  fi
-
-  ensure_apt_working || return 1
-
-  # Install with retry logic
-  install_packages_with_retry "$DESIRED_PACKAGE" || {
-    msg_error "Failed to install Temurin JDK $JAVA_VERSION"
-    return 1
-  }
-
-  cache_installed_version "temurin-jdk" "$JAVA_VERSION"
-  msg_ok "Setup Temurin JDK $JAVA_VERSION"
-}
-
-# ------------------------------------------------------------------------------
-# Installs a local IP updater script using networkd-dispatcher.
-#
-# Description:
-#   - Stores current IP in /run/local-ip.env
-#   - Automatically runs on network changes
-# ------------------------------------------------------------------------------
-
-function setup_local_ip_helper() {
-  local BASE_DIR="/usr/local/community-scripts/ip-management"
-  local SCRIPT_PATH="$BASE_DIR/update_local_ip.sh"
-  local IP_FILE="/run/local-ip.env"
-  local DISPATCHER_SCRIPT="/etc/networkd-dispatcher/routable.d/10-update-local-ip.sh"
-
-  # Check if already set up
-  if [[ -f "$SCRIPT_PATH" && -f "$DISPATCHER_SCRIPT" ]]; then
-    msg_info "Update Local IP Helper"
-    cache_installed_version "local-ip-helper" "1.0"
-    msg_ok "Update Local IP Helper"
-  else
-    msg_info "Setup Local IP Helper"
-  fi
-
-  mkdir -p "$BASE_DIR"
-
-  # Install networkd-dispatcher if not present
-  if ! dpkg -s networkd-dispatcher >/dev/null 2>&1; then
-    ensure_dependencies networkd-dispatcher || {
-      msg_error "Failed to install networkd-dispatcher"
-      return 1
-    }
-  fi
-
-  # Write update_local_ip.sh
-  cat <<'EOF' >"$SCRIPT_PATH"
-#!/bin/bash
-set -euo pipefail
-
-IP_FILE="/run/local-ip.env"
-mkdir -p "$(dirname "$IP_FILE")"
-
-get_current_ip() {
-    local targets=("8.8.8.8" "1.1.1.1" "192.168.1.1" "10.0.0.1" "172.16.0.1" "default")
-    local ip
-
-    for target in "${targets[@]}"; do
-        if [[ "$target" == "default" ]]; then
-            ip=$(ip route get 1 2>/dev/null | awk '{for(i=1;i<=NF;i++) if ($i=="src") print $(i+1)}')
-        else
-            ip=$(ip route get "$target" 2>/dev/null | awk '{for(i=1;i<=NF;i++) if ($i=="src") print $(i+1)}')
-        fi
-        if [[ -n "$ip" ]]; then
-            echo "$ip"
-            return 0
-        fi
-    done
-
-    return 1
-}
-
-current_ip="$(get_current_ip)"
-
-if [[ -z "$current_ip" ]]; then
-    echo "[ERROR] Could not detect local IP" >&2
-    exit 1
-fi
-
-if [[ -f "$IP_FILE" ]]; then
-    source "$IP_FILE"
-    [[ "$LOCAL_IP" == "$current_ip" ]] && exit 0
-fi
-
-echo "LOCAL_IP=$current_ip" > "$IP_FILE"
-echo "[INFO] LOCAL_IP updated to $current_ip"
-EOF
-
-  chmod +x "$SCRIPT_PATH"
-
-  # Install dispatcher hook
-  mkdir -p "$(dirname "$DISPATCHER_SCRIPT")"
-  cat <<EOF >"$DISPATCHER_SCRIPT"
-#!/bin/bash
-$SCRIPT_PATH
-EOF
-
-  chmod +x "$DISPATCHER_SCRIPT"
-  systemctl enable -q --now networkd-dispatcher.service || {
-    msg_warn "Failed to enable networkd-dispatcher service"
-  }
-
-  cache_installed_version "local-ip-helper" "1.0"
-  msg_ok "Setup Local IP Helper"
-}
-
-# ------------------------------------------------------------------------------
-# Installs or updates MariaDB from official repo.
-#
-# Description:
-#   - Detects current MariaDB version and replaces it if necessary
-#   - Preserves existing database data
-#   - Dynamically determines latest GA version if "latest" is given
-#
-# Variables:
-#   MARIADB_VERSION - MariaDB version to install (e.g. 10.11, latest) (default: latest)
-# ------------------------------------------------------------------------------
-
-setup_mariadb() {
-  local MARIADB_VERSION="${MARIADB_VERSION:-latest}"
-
-  # Resolve "latest" to actual version
-  if [[ "$MARIADB_VERSION" == "latest" ]]; then
-    if ! curl -fsI --max-time 10 http://mirror.mariadb.org/repo/ >/dev/null 2>&1; then
-      msg_warn "MariaDB mirror not reachable - trying cached package list fallback"
-      # Fallback: try to use a known stable version
-      MARIADB_VERSION="12.0"
-    else
-      MARIADB_VERSION=$(curl -fsSL --max-time 15 http://mirror.mariadb.org/repo/ 2>/dev/null |
-        grep -Eo '[0-9]+\.[0-9]+\.[0-9]+/' |
-        grep -vE 'rc/|rolling/' |
-        sed 's|/||' |
-        sort -Vr |
-        head -n1 || echo "")
-
-      if [[ -z "$MARIADB_VERSION" ]]; then
-        msg_warn "Could not parse latest GA MariaDB version from mirror - using fallback"
-        MARIADB_VERSION="12.0"
-      fi
-    fi
-  fi
-
-  # Get currently installed version
-  local CURRENT_VERSION=""
-  CURRENT_VERSION=$(is_tool_installed "mariadb" 2>/dev/null) || true
-
-  # Scenario 1: Already installed at target version - just update packages
-  if [[ -n "$CURRENT_VERSION" && "$CURRENT_VERSION" == "$MARIADB_VERSION" ]]; then
-    msg_info "Update MariaDB $MARIADB_VERSION"
-
-    # Ensure APT is working
-    ensure_apt_working || return 1
-
-    # Check if repository needs to be refreshed
-    if [[ -f /etc/apt/sources.list.d/mariadb.sources ]]; then
-      local REPO_VERSION=""
-      REPO_VERSION=$(grep -oP 'repo/\K[0-9]+\.[0-9]+' /etc/apt/sources.list.d/mariadb.sources 2>/dev/null || echo "")
-      if [[ -n "$REPO_VERSION" && "$REPO_VERSION" != "${MARIADB_VERSION%.*}" ]]; then
-        msg_warn "Repository version mismatch, updating..."
-        manage_tool_repository "mariadb" "$MARIADB_VERSION" "http://mirror.mariadb.org/repo/$MARIADB_VERSION" \
-          "https://mariadb.org/mariadb_release_signing_key.asc" || {
-          msg_error "Failed to update MariaDB repository"
-          return 1
-        }
-      fi
-    fi
-
-    # Perform upgrade with retry logic
-    ensure_apt_working || return 1
-    upgrade_packages_with_retry "mariadb-server" "mariadb-client" || {
-      msg_error "Failed to upgrade MariaDB packages"
-      return 1
-    }
-    cache_installed_version "mariadb" "$MARIADB_VERSION"
-    msg_ok "Update MariaDB $MARIADB_VERSION"
-    return 0
-  fi
-
-  # Scenario 2: Different version installed - clean upgrade
-  if [[ -n "$CURRENT_VERSION" && "$CURRENT_VERSION" != "$MARIADB_VERSION" ]]; then
-    msg_info "Upgrade MariaDB from $CURRENT_VERSION to $MARIADB_VERSION"
-    remove_old_tool_version "mariadb"
-  fi
-
-  # Scenario 3: Fresh install or version change
-  msg_info "Setup MariaDB $MARIADB_VERSION"
-
-  # Prepare repository (cleanup + validation)
-  prepare_repository_setup "mariadb" || {
-    msg_error "Failed to prepare MariaDB repository"
-    return 1
-  }
-
-  # Install required dependencies first
-  local mariadb_deps=()
-  for dep in gawk rsync socat libdbi-perl pv; do
-    if apt-cache search "^${dep}$" 2>/dev/null | grep -q .; then
-      mariadb_deps+=("$dep")
-    fi
-  done
-
-  if [[ ${#mariadb_deps[@]} -gt 0 ]]; then
-    $STD apt install -y "${mariadb_deps[@]}" 2>/dev/null || true
-  fi
-
-  # Setup repository
-  manage_tool_repository "mariadb" "$MARIADB_VERSION" "http://mirror.mariadb.org/repo/$MARIADB_VERSION" \
-    "https://mariadb.org/mariadb_release_signing_key.asc" || {
-    msg_error "Failed to setup MariaDB repository"
-    return 1
-  }
-
-  # Set debconf selections for all potential versions
-  local MARIADB_MAJOR_MINOR
-  MARIADB_MAJOR_MINOR=$(echo "$MARIADB_VERSION" | awk -F. '{print $1"."$2}')
-  if [[ -n "$MARIADB_MAJOR_MINOR" ]]; then
-    echo "mariadb-server-$MARIADB_MAJOR_MINOR mariadb-server/feedback boolean false" | debconf-set-selections
-  fi
-
-  # Install packages with retry logic
-  export DEBIAN_FRONTEND=noninteractive
-  if ! install_packages_with_retry "mariadb-server" "mariadb-client"; then
-    # Fallback: try without specific version
-    msg_warn "Failed to install MariaDB packages from upstream repo, trying distro fallback..."
-    cleanup_old_repo_files "mariadb"
-    $STD apt update || {
-      msg_warn "APT update also failed, continuing with cache"
-    }
-    install_packages_with_retry "mariadb-server" "mariadb-client" || {
-      msg_error "Failed to install MariaDB packages (both upstream and distro)"
-      return 1
-    }
-  fi
-
-  cache_installed_version "mariadb" "$MARIADB_VERSION"
-  msg_ok "Setup MariaDB $MARIADB_VERSION"
-}
-
-# ------------------------------------------------------------------------------
-# Creates MariaDB database with user, charset and optional extra grants/modes
-#
-# Description:
-#   - Generates password if empty
-#   - Creates database with utf8mb4_unicode_ci
-#   - Creates local user with password
-#   - Grants full access to this DB
-#   - Optional: apply extra GRANT statements (comma-separated)
-#   - Optional: apply custom GLOBAL sql_mode
-#   - Saves credentials to file
-#   - Exports variables for use in calling script
-#
-# Usage:
-#   MARIADB_DB_NAME="myapp_db" MARIADB_DB_USER="myapp_user" setup_mariadb_db
-#   MARIADB_DB_NAME="domain_monitor" MARIADB_DB_USER="domainmonitor" setup_mariadb_db
-#   MARIADB_DB_NAME="myapp" MARIADB_DB_USER="myapp" MARIADB_DB_EXTRA_GRANTS="GRANT SELECT ON \`mysql\`.\`time_zone_name\`" setup_mariadb_db
-#   MARIADB_DB_NAME="ghostfolio" MARIADB_DB_USER="ghostfolio" MARIADB_DB_SQL_MODE="" setup_mariadb_db
-#
-# Variables:
-#   MARIADB_DB_NAME         - Database name (required)
-#   MARIADB_DB_USER         - Database user (required)
-#   MARIADB_DB_PASS         - User password (optional, auto-generated if empty)
-#   MARIADB_DB_EXTRA_GRANTS - Comma-separated GRANT statements (optional)
-#                             Example: "GRANT SELECT ON \`mysql\`.\`time_zone_name\`"
-#   MARIADB_DB_SQL_MODE     - Optional global sql_mode override (e.g. "", "STRICT_TRANS_TABLES")
-#   MARIADB_DB_CREDS_FILE   - Credentials file path (optional, default: ~/${APPLICATION}.creds)
-#
-# Exports:
-#   MARIADB_DB_NAME, MARIADB_DB_USER, MARIADB_DB_PASS
-# ------------------------------------------------------------------------------
-
-function setup_mariadb_db() {
-  if [[ -z "${MARIADB_DB_NAME:-}" || -z "${MARIADB_DB_USER:-}" ]]; then
-    msg_error "MARIADB_DB_NAME and MARIADB_DB_USER must be set before calling setup_mariadb_db"
-    return 1
-  fi
-
-  if [[ -z "${MARIADB_DB_PASS:-}" ]]; then
-    MARIADB_DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
-  fi
-
-  msg_info "Setting up MariaDB Database"
-
-  $STD mariadb -u root -e "CREATE DATABASE \`$MARIADB_DB_NAME\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
-  $STD mariadb -u root -e "CREATE USER '$MARIADB_DB_USER'@'localhost' IDENTIFIED BY '$MARIADB_DB_PASS';"
-  $STD mariadb -u root -e "GRANT ALL ON \`$MARIADB_DB_NAME\`.* TO '$MARIADB_DB_USER'@'localhost';"
-
-  # Optional extra grants
-  if [[ -n "${MARIADB_DB_EXTRA_GRANTS:-}" ]]; then
-    IFS=',' read -ra G_LIST <<<"${MARIADB_DB_EXTRA_GRANTS:-}"
-    for g in "${G_LIST[@]}"; do
-      g=$(echo "$g" | xargs)
-      $STD mariadb -u root -e "$g TO '$MARIADB_DB_USER'@'localhost';"
-    done
-  fi
-
-  # Optional sql_mode override
-  if [[ -n "${MARIADB_DB_SQL_MODE:-}" ]]; then
-    $STD mariadb -u root -e "SET GLOBAL sql_mode='${MARIADB_DB_SQL_MODE:-}';"
-  fi
-
-  $STD mariadb -u root -e "FLUSH PRIVILEGES;"
-
-  local app_name="${APPLICATION,,}"
-  local CREDS_FILE="${MARIADB_DB_CREDS_FILE:-${HOME}/${app_name}.creds}"
-  {
-    echo "MariaDB Credentials"
-    echo "Database: $MARIADB_DB_NAME"
-    echo "User: $MARIADB_DB_USER"
-    echo "Password: $MARIADB_DB_PASS"
-  } >>"$CREDS_FILE"
-
-  msg_ok "Set up MariaDB Database"
-
-  export MARIADB_DB_NAME
-  export MARIADB_DB_USER
-  export MARIADB_DB_PASS
-}
-
-# ------------------------------------------------------------------------------
-# Installs or updates MongoDB to specified major version.
-#
-# Description:
-#   - Preserves data across installations
-#   - Adds official MongoDB repo
-#
-# Variables:
-#   MONGO_VERSION  - MongoDB major version to install (e.g. 7.0, 8.0)
-# ------------------------------------------------------------------------------
-
-function setup_mongodb() {
-  local MONGO_VERSION="${MONGO_VERSION:-8.0}"
-  local DISTRO_ID DISTRO_CODENAME
-  DISTRO_ID=$(get_os_info id)
-  DISTRO_CODENAME=$(get_os_info codename)
-
-  # Check AVX support
-  if ! grep -qm1 'avx[^ ]*' /proc/cpuinfo; then
-    local major="${MONGO_VERSION%%.*}"
-    if ((major > 5)); then
-      msg_error "MongoDB ${MONGO_VERSION} requires AVX support, which is not available on this system."
-      return 1
-    fi
-  fi
-
-  case "$DISTRO_ID" in
-  ubuntu)
-    MONGO_BASE_URL="https://repo.mongodb.org/apt/ubuntu"
-    ;;
-  debian)
-    MONGO_BASE_URL="https://repo.mongodb.org/apt/debian"
-    ;;
-  *)
-    msg_error "Unsupported distribution: $DISTRO_ID"
-    return 1
-    ;;
-  esac
-
-  # Get currently installed version
-  local INSTALLED_VERSION=""
-  INSTALLED_VERSION=$(is_tool_installed "mongodb" 2>/dev/null) || true
-
-  # Scenario 1: Already at target version - just update packages
-  if [[ -n "$INSTALLED_VERSION" && "$INSTALLED_VERSION" == "$MONGO_VERSION" ]]; then
-    msg_info "Update MongoDB $MONGO_VERSION"
-
-    ensure_apt_working || return 1
-
-    # Perform upgrade with retry logic
-    upgrade_packages_with_retry "mongodb-org" || {
-      msg_error "Failed to upgrade MongoDB"
-      return 1
-    }
-    cache_installed_version "mongodb" "$MONGO_VERSION"
-    msg_ok "Update MongoDB $MONGO_VERSION"
-    return 0
-  fi
-
-  # Scenario 2: Different version installed - clean upgrade
-  if [[ -n "$INSTALLED_VERSION" && "$INSTALLED_VERSION" != "$MONGO_VERSION" ]]; then
-    msg_info "Upgrade MongoDB from $INSTALLED_VERSION to $MONGO_VERSION"
-    remove_old_tool_version "mongodb"
-  else
-    msg_info "Setup MongoDB $MONGO_VERSION"
-  fi
-
-  cleanup_orphaned_sources
-
-  # Prepare repository (cleanup + validation)
-  prepare_repository_setup "mongodb" || {
-    msg_error "Failed to prepare MongoDB repository"
-    return 1
-  }
-
-  # Setup repository
-  manage_tool_repository "mongodb" "$MONGO_VERSION" "$MONGO_BASE_URL" \
-    "https://www.mongodb.org/static/pgp/server-${MONGO_VERSION}.asc" || {
-    msg_error "Failed to setup MongoDB repository"
-    return 1
-  }
-
-  # Wait for repo to settle
-  $STD apt update || {
-    msg_error "APT update failed — invalid MongoDB repo for ${DISTRO_ID}-${DISTRO_CODENAME}?"
-    return 1
-  }
-
-  # Install MongoDB with retry logic
-  install_packages_with_retry "mongodb-org" || {
-    msg_error "Failed to install MongoDB packages"
-    return 1
-  }
-
-  # Verify MongoDB was installed correctly
-  if ! command -v mongod >/dev/null 2>&1; then
-    msg_error "MongoDB binary not found after installation"
-    return 1
-  fi
-
-  mkdir -p /var/lib/mongodb
-  chown -R mongodb:mongodb /var/lib/mongodb
-
-  $STD systemctl enable mongod || {
-    msg_warn "Failed to enable mongod service"
-  }
-  safe_service_restart mongod
-
-  # Verify MongoDB version
-  local INSTALLED_VERSION
-  INSTALLED_VERSION=$(mongod --version 2>/dev/null | grep -oP 'db version v\K[0-9]+\.[0-9]+' | head -n1 || echo "0.0")
-  verify_tool_version "MongoDB" "$MONGO_VERSION" "$INSTALLED_VERSION" || true
-
-  cache_installed_version "mongodb" "$MONGO_VERSION"
-  msg_ok "Setup MongoDB $MONGO_VERSION"
-}
-
-# ------------------------------------------------------------------------------
-# Installs or upgrades MySQL and configures APT repo.
-#
-# Description:
-#   - Detects existing MySQL installation
-#   - Purges conflicting packages before installation
-#   - Supports clean upgrade
-#   - Handles Debian Trixie libaio1t64 transition
-#
-# Variables:
-#   MYSQL_VERSION  - MySQL version to install (e.g. 5.7, 8.0) (default: 8.0)
-# ------------------------------------------------------------------------------
-
-function setup_mysql() {
-  local MYSQL_VERSION="${MYSQL_VERSION:-8.0}"
-  local DISTRO_ID DISTRO_CODENAME
-  DISTRO_ID=$(awk -F= '/^ID=/{print $2}' /etc/os-release | tr -d '"')
-  DISTRO_CODENAME=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
-
-  # Get currently installed version
-  local CURRENT_VERSION=""
-  CURRENT_VERSION=$(is_tool_installed "mysql" 2>/dev/null) || true
-
-  # Scenario 1: Already at target version - just update packages
-  if [[ -n "$CURRENT_VERSION" && "$CURRENT_VERSION" == "$MYSQL_VERSION" ]]; then
-    msg_info "Update MySQL $MYSQL_VERSION"
-
-    ensure_apt_working || return 1
-
-    # Perform upgrade with retry logic (non-fatal if fails)
-    upgrade_packages_with_retry "mysql-server" "mysql-client" || true
-
-    cache_installed_version "mysql" "$MYSQL_VERSION"
-    msg_ok "Update MySQL $MYSQL_VERSION"
-    return 0
-  fi
-
-  # Scenario 2: Different version installed - clean upgrade
-  if [[ -n "$CURRENT_VERSION" && "$CURRENT_VERSION" != "$MYSQL_VERSION" ]]; then
-    msg_info "Upgrade MySQL from $CURRENT_VERSION to $MYSQL_VERSION"
-    remove_old_tool_version "mysql"
-  else
-    msg_info "Setup MySQL $MYSQL_VERSION"
-  fi
-
-  # Prepare repository (cleanup + validation)
-  prepare_repository_setup "mysql" || {
-    msg_error "Failed to prepare MySQL repository"
-    return 1
-  }
-
-  # Debian 13+ Fix: MySQL 8.0 incompatible with libaio1t64, use 8.4 LTS
-  if [[ "$DISTRO_ID" == "debian" && "$DISTRO_CODENAME" =~ ^(trixie|forky|sid)$ ]]; then
-    msg_info "Debian ${DISTRO_CODENAME} detected → using MySQL 8.4 LTS (libaio1t64 compatible)"
-
-    if ! curl -fsSL https://repo.mysql.com/RPM-GPG-KEY-mysql-2023 | gpg --dearmor -o /etc/apt/keyrings/mysql.gpg 2>/dev/null; then
-      msg_error "Failed to import MySQL GPG key"
-      return 1
-    fi
-
-    cat >/etc/apt/sources.list.d/mysql.sources <<EOF
-Types: deb
-URIs: https://repo.mysql.com/apt/debian/
-Suites: bookworm
-Components: mysql-8.4-lts
-Architectures: $(dpkg --print-architecture)
-Signed-By: /etc/apt/keyrings/mysql.gpg
-EOF
-
-    $STD apt update || {
-      msg_error "Failed to update APT for MySQL 8.4 LTS"
-      return 1
-    }
-
-    # Install with retry logic
-    if ! install_packages_with_retry "mysql-community-server" "mysql-community-client"; then
-      msg_warn "MySQL 8.4 LTS installation failed – falling back to MariaDB"
-      cleanup_old_repo_files "mysql"
-      $STD apt update
-      install_packages_with_retry "mariadb-server" "mariadb-client" || {
-        msg_error "Failed to install database engine (MySQL/MariaDB fallback)"
-        return 1
-      }
-      msg_ok "Setup Database Engine (MariaDB fallback on Debian ${DISTRO_CODENAME})"
-      return 0
-    fi
-
-    cache_installed_version "mysql" "8.4"
-    msg_ok "Setup MySQL 8.4 LTS (Debian ${DISTRO_CODENAME})"
-    return 0
-  fi
-
-  # Standard setup for other distributions
-  local SUITE
-  if [[ "$DISTRO_ID" == "debian" ]]; then
-    case "$DISTRO_CODENAME" in
-    bookworm | bullseye) SUITE="$DISTRO_CODENAME" ;;
-    *) SUITE="bookworm" ;;
-    esac
-  else
-    SUITE=$(get_fallback_suite "$DISTRO_ID" "$DISTRO_CODENAME" "https://repo.mysql.com/apt/${DISTRO_ID}")
-  fi
-
-  # Setup repository
-  manage_tool_repository "mysql" "$MYSQL_VERSION" "https://repo.mysql.com/apt/${DISTRO_ID}" \
-    "https://repo.mysql.com/RPM-GPG-KEY-mysql-2023" || {
-    msg_error "Failed to setup MySQL repository"
-    return 1
-  }
-
-  ensure_apt_working || return 1
-
-  # Try multiple package names with retry logic
-  export DEBIAN_FRONTEND=noninteractive
-  local mysql_install_success=false
-
-  if apt-cache search "^mysql-server$" 2>/dev/null | grep -q . &&
-    install_packages_with_retry "mysql-server" "mysql-client"; then
-    mysql_install_success=true
-  elif apt-cache search "^mysql-community-server$" 2>/dev/null | grep -q . &&
-    install_packages_with_retry "mysql-community-server" "mysql-community-client"; then
-    mysql_install_success=true
-  elif apt-cache search "^mysql$" 2>/dev/null | grep -q . &&
-    install_packages_with_retry "mysql"; then
-    mysql_install_success=true
-  fi
-
-  if [[ "$mysql_install_success" == false ]]; then
-    msg_error "MySQL ${MYSQL_VERSION} package not available for suite ${SUITE}"
-    return 1
-  fi
-
-  # Verify mysql command is accessible
-  if ! command -v mysql >/dev/null 2>&1; then
-    hash -r
-    if ! command -v mysql >/dev/null 2>&1; then
-      msg_error "MySQL installed but mysql command still not found"
-      return 1
-    fi
-  fi
-
-  cache_installed_version "mysql" "$MYSQL_VERSION"
-  msg_ok "Setup MySQL $MYSQL_VERSION"
-}
-
-# ------------------------------------------------------------------------------
-# Installs Node.js and optional global modules.
-#
-# Description:
-#   - Installs specified Node.js version using NodeSource APT repo
-#   - Optionally installs or updates global npm modules
-#
-# Variables:
-#   NODE_VERSION   - Node.js version to install (default: 22)
-#   NODE_MODULE    - Comma-separated list of global modules (e.g. "yarn,@vue/cli@5.0.0")
-# ------------------------------------------------------------------------------
-
-function setup_nodejs() {
-  local NODE_VERSION="${NODE_VERSION:-22}"
-  local NODE_MODULE="${NODE_MODULE:-}"
-
-  # ALWAYS clean up legacy installations first (nvm, etc.) to prevent conflicts
-  cleanup_legacy_install "nodejs"
-
-  # Get currently installed version
-  local CURRENT_NODE_VERSION=""
-  CURRENT_NODE_VERSION=$(is_tool_installed "nodejs" 2>/dev/null) || true
-
-  # Ensure jq is available for JSON parsing
-  if ! command -v jq &>/dev/null; then
-    $STD apt update
-    $STD apt install -y jq || {
-      msg_error "Failed to install jq"
-      return 1
-    }
-  fi
-
-  # Scenario 1: Already installed at target version - just update packages/modules
-  if [[ -n "$CURRENT_NODE_VERSION" && "$CURRENT_NODE_VERSION" == "$NODE_VERSION" ]]; then
-    msg_info "Update Node.js $NODE_VERSION"
-
-    ensure_apt_working || return 1
-
-    # Just update npm to latest
-    $STD npm install -g npm@latest 2>/dev/null || true
-
-    cache_installed_version "nodejs" "$NODE_VERSION"
-    msg_ok "Update Node.js $NODE_VERSION"
-  else
-    # Scenario 2: Different version installed - clean upgrade
-    if [[ -n "$CURRENT_NODE_VERSION" && "$CURRENT_NODE_VERSION" != "$NODE_VERSION" ]]; then
-      msg_info "Upgrade Node.js from $CURRENT_NODE_VERSION to $NODE_VERSION"
-      remove_old_tool_version "nodejs"
-    else
-      msg_info "Setup Node.js $NODE_VERSION"
-    fi
-
-    # Remove ALL Debian nodejs packages BEFORE adding NodeSource repo
-    if dpkg -l 2>/dev/null | grep -qE "^ii.*(nodejs|libnode|node-cjs|node-acorn|node-balanced|node-brace|node-minimatch|node-undici|node-xtend|node-corepack)"; then
-      msg_info "Removing Debian-packaged Node.js and dependencies"
-      $STD apt purge -y nodejs nodejs-doc libnode* node-* 2>/dev/null || true
-      $STD apt autoremove -y 2>/dev/null || true
-      $STD apt clean 2>/dev/null || true
-    fi
-
-    # Remove any APT pinning (not needed)
-    rm -f /etc/apt/preferences.d/nodesource 2>/dev/null || true
-
-    # Prepare repository (cleanup + validation)
-    prepare_repository_setup "nodesource" || {
-      msg_error "Failed to prepare Node.js repository"
-      return 1
-    }
-
-    # Setup NodeSource repository
-    manage_tool_repository "nodejs" "$NODE_VERSION" "https://deb.nodesource.com/node_${NODE_VERSION}.x" "https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key" || {
-      msg_error "Failed to setup Node.js repository"
-      return 1
-    }
-
-    # CRITICAL: Force APT cache refresh AFTER repository setup
-    # This ensures NodeSource is the only nodejs source in APT cache
-    $STD apt update
-
-    # Install dependencies (NodeSource is now the only nodejs source)
-    ensure_dependencies curl ca-certificates gnupg
-
-    # Install Node.js from NodeSource
-    install_packages_with_retry "nodejs" || {
-      msg_error "Failed to install Node.js ${NODE_VERSION} from NodeSource"
-      return 1
-    }
-
-    # Verify Node.js was installed correctly
-    if ! command -v node >/dev/null 2>&1; then
-      msg_error "Node.js binary not found after installation"
-      return 1
-    fi
-
-    local INSTALLED_NODE_VERSION
-    INSTALLED_NODE_VERSION=$(node -v 2>/dev/null | grep -oP '^v\K[0-9]+' || echo "0")
-    verify_tool_version "Node.js" "$NODE_VERSION" "$INSTALLED_NODE_VERSION" || true
-
-    # Verify npm is available (should come with NodeSource nodejs)
-    if ! command -v npm >/dev/null 2>&1; then
-      msg_error "npm not found after Node.js installation - repository issue?"
-      return 1
-    fi
-
-    # Update to latest npm (with version check to avoid incompatibility)
-    local NPM_VERSION
-    NPM_VERSION=$(npm -v 2>/dev/null || echo "0")
-    if [[ "$NPM_VERSION" != "0" ]]; then
-      $STD npm install -g npm@latest 2>/dev/null || {
-        msg_warn "Failed to update npm to latest version (continuing with bundled npm $NPM_VERSION)"
-      }
-    fi
-
-    cache_installed_version "nodejs" "$NODE_VERSION"
-    msg_ok "Setup Node.js $NODE_VERSION"
-  fi
-
-  export NODE_OPTIONS="--max-old-space-size=4096"
-
-  # Ensure valid working directory for npm (avoids uv_cwd error)
-  if [[ ! -d /opt ]]; then
-    mkdir -p /opt
-  fi
-  cd /opt || {
-    msg_error "Failed to set safe working directory before npm install"
-    return 1
-  }
-
-  # Install global Node modules
-  if [[ -n "$NODE_MODULE" ]]; then
-    IFS=',' read -ra MODULES <<<"$NODE_MODULE"
-    local failed_modules=0
-    for mod in "${MODULES[@]}"; do
-      local MODULE_NAME MODULE_REQ_VERSION MODULE_INSTALLED_VERSION
-      if [[ "$mod" == @*/*@* ]]; then
-        # Scoped package with version, e.g. @vue/cli-service@latest
-        MODULE_NAME="${mod%@*}"
-        MODULE_REQ_VERSION="${mod##*@}"
-      elif [[ "$mod" == *"@"* ]]; then
-        # Unscoped package with version, e.g. yarn@latest
-        MODULE_NAME="${mod%@*}"
-        MODULE_REQ_VERSION="${mod##*@}"
-      else
-        # No version specified
-        MODULE_NAME="$mod"
-        MODULE_REQ_VERSION="latest"
-      fi
-
-      # Check if the module is already installed
-      if $STD npm list -g --depth=0 "$MODULE_NAME" 2>&1 | grep -q "$MODULE_NAME@"; then
-        MODULE_INSTALLED_VERSION="$($STD npm list -g --depth=0 "$MODULE_NAME" 2>&1 | grep "$MODULE_NAME@" | awk -F@ '{print $2}' | tr -d '[:space:]')"
-        if [[ "$MODULE_REQ_VERSION" != "latest" && "$MODULE_REQ_VERSION" != "$MODULE_INSTALLED_VERSION" ]]; then
-          msg_info "Updating $MODULE_NAME from v$MODULE_INSTALLED_VERSION to v$MODULE_REQ_VERSION"
-          if ! $STD npm install -g "${MODULE_NAME}@${MODULE_REQ_VERSION}" 2>/dev/null; then
-            msg_warn "Failed to update $MODULE_NAME to version $MODULE_REQ_VERSION"
-            ((failed_modules++))
-            continue
-          fi
-        elif [[ "$MODULE_REQ_VERSION" == "latest" ]]; then
-          msg_info "Updating $MODULE_NAME to latest version"
-          if ! $STD npm install -g "${MODULE_NAME}@latest" 2>/dev/null; then
-            msg_warn "Failed to update $MODULE_NAME to latest version"
-            ((failed_modules++))
-            continue
-          fi
-        fi
-      else
-        msg_info "Installing $MODULE_NAME@$MODULE_REQ_VERSION"
-        if ! $STD npm install -g "${MODULE_NAME}@${MODULE_REQ_VERSION}" 2>/dev/null; then
-          msg_warn "Failed to install $MODULE_NAME@$MODULE_REQ_VERSION"
-          ((failed_modules++))
-          continue
-        fi
-      fi
-    done
-    if [[ $failed_modules -eq 0 ]]; then
-      msg_ok "Installed Node.js modules: $NODE_MODULE"
-    else
-      msg_warn "Installed Node.js modules with $failed_modules failure(s): $NODE_MODULE"
-    fi
-  fi
-}
-
-# ------------------------------------------------------------------------------
-# Installs PHP with selected modules and configures Apache/FPM support.
-#
-# Description:
-#   - Adds Sury PHP repo if needed
-#   - Installs default and user-defined modules
-#   - Patches php.ini for CLI, Apache, and FPM as needed
-#
-# Variables:
-#   PHP_VERSION                - PHP version to install (default: 8.4)
-#   PHP_MODULE                 - Additional comma-separated modules
-#   PHP_APACHE                 - Set YES to enable PHP with Apache
-#   PHP_FPM                    - Set YES to enable PHP-FPM
-#   PHP_MEMORY_LIMIT           - (default: 512M)
-#   PHP_UPLOAD_MAX_FILESIZE    - (default: 128M)
-#   PHP_POST_MAX_SIZE          - (default: 128M)
-#   PHP_MAX_EXECUTION_TIME     - (default: 300)
-# ------------------------------------------------------------------------------
-
-function setup_php() {
-  local PHP_VERSION="${PHP_VERSION:-8.4}"
-  local PHP_MODULE="${PHP_MODULE:-}"
-  local PHP_APACHE="${PHP_APACHE:-NO}"
-  local PHP_FPM="${PHP_FPM:-NO}"
-  local DISTRO_ID DISTRO_CODENAME
-  DISTRO_ID=$(awk -F= '/^ID=/{print $2}' /etc/os-release | tr -d '"')
-  DISTRO_CODENAME=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
-
-  local DEFAULT_MODULES="bcmath,cli,curl,gd,intl,mbstring,opcache,readline,xml,zip"
-  local COMBINED_MODULES
-
-  local PHP_MEMORY_LIMIT="${PHP_MEMORY_LIMIT:-512M}"
-  local PHP_UPLOAD_MAX_FILESIZE="${PHP_UPLOAD_MAX_FILESIZE:-128M}"
-  local PHP_POST_MAX_SIZE="${PHP_POST_MAX_SIZE:-128M}"
-  local PHP_MAX_EXECUTION_TIME="${PHP_MAX_EXECUTION_TIME:-300}"
-
-  # Merge default + user-defined modules
-  if [[ -n "$PHP_MODULE" ]]; then
-    COMBINED_MODULES="${DEFAULT_MODULES},${PHP_MODULE}"
-  else
-    COMBINED_MODULES="${DEFAULT_MODULES}"
-  fi
-
-  # Deduplicate
-  COMBINED_MODULES=$(echo "$COMBINED_MODULES" | tr ',' '\n' | awk '!seen[$0]++' | paste -sd, -)
-
-  # Get current PHP-CLI version
-  local CURRENT_PHP=""
-  CURRENT_PHP=$(is_tool_installed "php" 2>/dev/null) || true
-
-  # CRITICAL: If wrong version is installed, remove it FIRST before any pinning
-  if [[ -n "$CURRENT_PHP" && "$CURRENT_PHP" != "$PHP_VERSION" ]]; then
-    msg_info "Removing conflicting PHP ${CURRENT_PHP} (need ${PHP_VERSION})"
-    stop_all_services "php.*-fpm"
-    $STD apt-get purge -y "php*" 2>/dev/null || true
-    $STD apt-get autoremove -y 2>/dev/null || true
-  fi
-
-  # NOW create pinning for the desired version
-  mkdir -p /etc/apt/preferences.d
-  cat <<EOF >/etc/apt/preferences.d/php-pin
-Package: php${PHP_VERSION}*
-Pin: version ${PHP_VERSION}.*
-Pin-Priority: 1001
-
-Package: php[0-9].*
-Pin: release o=packages.sury.org-php
-Pin-Priority: -1
-EOF
-
-  # Setup repository
-  prepare_repository_setup "php" "deb.sury.org-php" || {
-    msg_error "Failed to prepare PHP repository"
-    return 1
-  }
-
-  manage_tool_repository "php" "$PHP_VERSION" "" "https://packages.sury.org/debsuryorg-archive-keyring.deb" || {
-    msg_error "Failed to setup PHP repository"
-    return 1
-  }
-
-  ensure_apt_working || return 1
-  $STD apt-get update
-
-  # Get available PHP version from repository
-  local AVAILABLE_PHP_VERSION=""
-  AVAILABLE_PHP_VERSION=$(apt-cache show "php${PHP_VERSION}" 2>/dev/null | grep -m1 "^Version:" | awk '{print $2}' | cut -d- -f1) || true
-
-  if [[ -z "$AVAILABLE_PHP_VERSION" ]]; then
-    msg_error "PHP ${PHP_VERSION} not found in configured repositories"
-    return 1
-  fi
-
-  # Build module list - without version pinning (preferences.d handles it)
-  local MODULE_LIST="php${PHP_VERSION}"
-
-  IFS=',' read -ra MODULES <<<"$COMBINED_MODULES"
-  for mod in "${MODULES[@]}"; do
-    MODULE_LIST+=" php${PHP_VERSION}-${mod}"
-  done
-
-  if [[ "$PHP_FPM" == "YES" ]]; then
-    MODULE_LIST+=" php${PHP_VERSION}-fpm"
-  fi
-
-  # install apache2 with PHP support if requested
-  if [[ "$PHP_APACHE" == "YES" ]]; then
-    if ! dpkg -l 2>/dev/null | grep -q "libapache2-mod-php${PHP_VERSION}"; then
-      msg_info "Installing Apache with PHP ${PHP_VERSION} module"
-      install_packages_with_retry "apache2" || {
-        msg_error "Failed to install Apache"
-        return 1
-      }
-      install_packages_with_retry "libapache2-mod-php${PHP_VERSION}" || {
-        msg_warn "Failed to install libapache2-mod-php${PHP_VERSION}, continuing without Apache module"
-      }
-    fi
-  fi
-
-  # Install PHP packages (pinning via preferences.d ensures correct version)
-  msg_info "Installing PHP ${PHP_VERSION} packages"
-  if ! install_packages_with_retry $MODULE_LIST; then
-    msg_warn "Failed to install PHP packages, attempting individual installation"
-
-    # Install main package first (critical)
-    install_packages_with_retry "php${PHP_VERSION}" || {
-      msg_error "Failed to install php${PHP_VERSION}"
-      return 1
-    }
-
-    # Try to install Apache module individually if requested
-    if [[ "$PHP_APACHE" == "YES" ]]; then
-      install_packages_with_retry "libapache2-mod-php${PHP_VERSION}" || {
-        msg_warn "Could not install libapache2-mod-php${PHP_VERSION}"
-      }
-    fi
-
-    # Try to install modules individually - skip those that don't exist
-    for pkg in "${MODULES[@]}"; do
-      if apt-cache search "^php${PHP_VERSION}-${pkg}\$" 2>/dev/null | grep -q "^php${PHP_VERSION}-${pkg}"; then
-        install_packages_with_retry "php${PHP_VERSION}-${pkg}" || {
-          msg_warn "Could not install php${PHP_VERSION}-${pkg}"
-        }
-      fi
-    done
-
-    if [[ "$PHP_FPM" == "YES" ]]; then
-      if apt-cache search "^php${PHP_VERSION}-fpm\$" 2>/dev/null | grep -q "^php${PHP_VERSION}-fpm"; then
-        install_packages_with_retry "php${PHP_VERSION}-fpm" || {
-          msg_warn "Could not install php${PHP_VERSION}-fpm"
-        }
-      fi
-    fi
-  fi
-  cache_installed_version "php" "$PHP_VERSION"
-
-  # Patch all relevant php.ini files
-  local PHP_INI_PATHS=("/etc/php/${PHP_VERSION}/cli/php.ini")
-  [[ "$PHP_FPM" == "YES" ]] && PHP_INI_PATHS+=("/etc/php/${PHP_VERSION}/fpm/php.ini")
-  [[ "$PHP_APACHE" == "YES" ]] && PHP_INI_PATHS+=("/etc/php/${PHP_VERSION}/apache2/php.ini")
-  for ini in "${PHP_INI_PATHS[@]}"; do
-    if [[ -f "$ini" ]]; then
-      $STD sed -i "s|^memory_limit = .*|memory_limit = ${PHP_MEMORY_LIMIT}|" "$ini"
-      $STD sed -i "s|^upload_max_filesize = .*|upload_max_filesize = ${PHP_UPLOAD_MAX_FILESIZE}|" "$ini"
-      $STD sed -i "s|^post_max_size = .*|post_max_size = ${PHP_POST_MAX_SIZE}|" "$ini"
-      $STD sed -i "s|^max_execution_time = .*|max_execution_time = ${PHP_MAX_EXECUTION_TIME}|" "$ini"
-    fi
-  done
-
-  # Patch Apache configuration if needed
-  if [[ "$PHP_APACHE" == "YES" ]]; then
-    for mod in $(ls /etc/apache2/mods-enabled/ 2>/dev/null | grep -E '^php[0-9]\.[0-9]\.conf$' | sed 's/\.conf//'); do
-      if [[ "$mod" != "php${PHP_VERSION}" ]]; then
-        $STD a2dismod "$mod" || true
-      fi
-    done
-    $STD a2enmod mpm_prefork
-    $STD a2enmod "php${PHP_VERSION}"
-    safe_service_restart apache2 || true
-  fi
-
-  # Enable and restart PHP-FPM if requested
-  if [[ "$PHP_FPM" == "YES" ]]; then
-    if systemctl list-unit-files | grep -q "php${PHP_VERSION}-fpm.service"; then
-      $STD systemctl enable php${PHP_VERSION}-fpm
-      safe_service_restart php${PHP_VERSION}-fpm
-    fi
-  fi
-
-  # Verify PHP installation - critical check
-  if ! command -v php >/dev/null 2>&1; then
-    msg_error "PHP installation verification failed - php command not found"
-    return 1
-  fi
-
-  local INSTALLED_VERSION=$(php -v 2>/dev/null | awk '/^PHP/{print $2}' | cut -d. -f1,2)
-
-  # Critical: if major.minor doesn't match, fail and cleanup
-  if [[ "$INSTALLED_VERSION" != "$PHP_VERSION" ]]; then
-    msg_error "PHP version mismatch: requested ${PHP_VERSION} but got ${INSTALLED_VERSION}"
-    msg_error "This indicates a critical package installation issue"
-    # Don't cache wrong version
-    return 1
-  fi
-
-  cache_installed_version "php" "$INSTALLED_VERSION"
-  msg_ok "Setup PHP ${INSTALLED_VERSION}"
-}
-
-# ------------------------------------------------------------------------------
-# Installs or upgrades PostgreSQL and optional extensions/modules.
-#
-# Description:
-#   - Detects existing PostgreSQL version
-#   - Dumps all databases before upgrade
-#   - Adds PGDG repo and installs specified version
-#   - Installs optional PG_MODULES (e.g. postgis, contrib)
-#   - Restores dumped data post-upgrade
-#
-# Variables:
-#   PG_VERSION     - Major PostgreSQL version (e.g. 15, 16) (default: 16)
-function setup_postgresql() {
-  local PG_VERSION="${PG_VERSION:-16}"
-  local PG_MODULES="${PG_MODULES:-}"
-  local DISTRO_ID DISTRO_CODENAME
-  DISTRO_ID=$(awk -F= '/^ID=/{print $2}' /etc/os-release | tr -d '"')
-  DISTRO_CODENAME=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
-
-  # Get currently installed version
-  local CURRENT_PG_VERSION=""
-  if command -v psql >/dev/null; then
-    CURRENT_PG_VERSION="$(psql -V 2>/dev/null | awk '{print $3}' | cut -d. -f1)"
-  fi
-
-  # Scenario 1: Already at correct version
-  if [[ "$CURRENT_PG_VERSION" == "$PG_VERSION" ]]; then
-    msg_info "Update PostgreSQL $PG_VERSION"
-    ensure_apt_working || return 1
-
-    # Perform upgrade with retry logic (non-fatal if fails)
-    upgrade_packages_with_retry "postgresql-${PG_VERSION}" "postgresql-client-${PG_VERSION}" 2>/dev/null || true
-    cache_installed_version "postgresql" "$PG_VERSION"
-    msg_ok "Update PostgreSQL $PG_VERSION"
-
-    # Still install modules if specified
-    if [[ -n "$PG_MODULES" ]]; then
-      IFS=',' read -ra MODULES <<<"$PG_MODULES"
-      for module in "${MODULES[@]}"; do
-        $STD apt install -y "postgresql-${PG_VERSION}-${module}" 2>/dev/null || true
-      done
-    fi
-    return 0
-  fi
-
-  # Scenario 2: Different version - backup, remove old, install new
-  if [[ -n "$CURRENT_PG_VERSION" ]]; then
-    msg_info "Upgrade PostgreSQL from $CURRENT_PG_VERSION to $PG_VERSION"
-    msg_info "Creating backup of PostgreSQL $CURRENT_PG_VERSION databases..."
-    $STD runuser -u postgres -- pg_dumpall >/var/lib/postgresql/backup_$(date +%F)_v${CURRENT_PG_VERSION}.sql || {
-      msg_error "Failed to backup PostgreSQL databases"
-      return 1
-    }
-    $STD systemctl stop postgresql || true
-    $STD apt purge -y "postgresql-${CURRENT_PG_VERSION}" "postgresql-client-${CURRENT_PG_VERSION}" 2>/dev/null || true
-  else
-    msg_info "Setup PostgreSQL $PG_VERSION"
-  fi
-
-  # Scenario 3: Fresh install or after removal - setup repo and install
-  prepare_repository_setup "pgdg" "postgresql" || {
-    msg_error "Failed to prepare PostgreSQL repository"
-    return 1
-  }
-
-  local SUITE
-  case "$DISTRO_CODENAME" in
-  trixie | forky | sid)
-    # For Debian Testing/Unstable, try PostgreSQL repo first, fallback to native packages
-    if verify_repo_available "https://apt.postgresql.org/pub/repos/apt" "trixie-pgdg"; then
-      SUITE="trixie-pgdg"
-
-      setup_deb822_repo \
-        "pgdg" \
-        "https://www.postgresql.org/media/keys/ACCC4CF8.asc" \
-        "https://apt.postgresql.org/pub/repos/apt" \
-        "$SUITE" \
-        "main"
-
-      if ! $STD apt update; then
-        msg_warn "Failed to update PostgreSQL repository, falling back to native packages"
-        SUITE=""
-      fi
-    else
-      SUITE=""
-    fi
-
-    # If no repo or packages not installable, use native Debian packages
-    if [[ -z "$SUITE" ]] || ! apt-cache show "postgresql-${PG_VERSION}" 2>/dev/null | grep -q "Version:"; then
-      msg_info "Using native Debian packages for $DISTRO_CODENAME"
-
-      # Install ssl-cert dependency if available
-      if apt-cache search "^ssl-cert$" 2>/dev/null | grep -q .; then
-        $STD apt install -y ssl-cert 2>/dev/null || true
-      fi
-
-      if ! $STD apt install -y postgresql postgresql-client 2>/dev/null; then
-        msg_error "Failed to install native PostgreSQL packages"
-        return 1
-      fi
-
-      if ! command -v psql >/dev/null 2>&1; then
-        msg_error "PostgreSQL installed but psql command not found"
-        return 1
-      fi
-
-      # Restore database backup if we upgraded from previous version
-      if [[ -n "$CURRENT_PG_VERSION" ]]; then
-        msg_info "Restoring PostgreSQL databases from backup..."
-        $STD runuser -u postgres -- psql </var/lib/postgresql/backup_$(date +%F)_v${CURRENT_PG_VERSION}.sql 2>/dev/null || {
-          msg_warn "Failed to restore database backup - this may be expected for major version upgrades"
-        }
-      fi
-
-      $STD systemctl enable --now postgresql 2>/dev/null || true
-
-      # Get actual installed version
-      INSTALLED_VERSION="$(psql -V 2>/dev/null | awk '{print $3}' | cut -d. -f1)"
-
-      # Add PostgreSQL binaries to PATH
-      if ! grep -q '/usr/lib/postgresql' /etc/environment 2>/dev/null; then
-        echo 'PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/postgresql/'"${INSTALLED_VERSION}"'/bin"' >/etc/environment
-      fi
-
-      cache_installed_version "postgresql" "$INSTALLED_VERSION"
-      msg_ok "Setup PostgreSQL $INSTALLED_VERSION (native)"
-
-      # Install optional modules if specified
-      if [[ -n "$PG_MODULES" ]]; then
-        IFS=',' read -ra MODULES <<<"$PG_MODULES"
-        for module in "${MODULES[@]}"; do
-          $STD apt install -y "postgresql-${INSTALLED_VERSION}-${module}" 2>/dev/null || true
-        done
-      fi
-      return 0
-    fi
-    ;;
-  *)
-    SUITE=$(get_fallback_suite "$DISTRO_ID" "$DISTRO_CODENAME" "https://apt.postgresql.org/pub/repos/apt")
-    SUITE="${SUITE}-pgdg"
-    ;;
-  esac
-
-  setup_deb822_repo \
-    "pgdg" \
-    "https://www.postgresql.org/media/keys/ACCC4CF8.asc" \
-    "https://apt.postgresql.org/pub/repos/apt" \
-    "$SUITE" \
-    "main"
-
-  if ! $STD apt update; then
-    msg_error "APT update failed for PostgreSQL repository"
-    return 1
-  fi
-
-  # Install ssl-cert dependency if available
-  if apt-cache search "^ssl-cert$" 2>/dev/null | grep -q .; then
-    $STD apt install -y ssl-cert 2>/dev/null || true
-  fi
-
-  # Try multiple PostgreSQL package patterns with retry logic
-  local pg_install_success=false
-
-  if apt-cache search "^postgresql-${PG_VERSION}$" 2>/dev/null | grep -q . &&
-    install_packages_with_retry "postgresql-${PG_VERSION}" "postgresql-client-${PG_VERSION}"; then
-    pg_install_success=true
-  fi
-
-  if [[ "$pg_install_success" == false ]] &&
-    apt-cache search "^postgresql-server-${PG_VERSION}$" 2>/dev/null | grep -q . &&
-    $STD apt install -y "postgresql-server-${PG_VERSION}" "postgresql-client-${PG_VERSION}" 2>/dev/null; then
-    pg_install_success=true
-  fi
-
-  if [[ "$pg_install_success" == false ]] &&
-    apt-cache search "^postgresql$" 2>/dev/null | grep -q . &&
-    $STD apt install -y postgresql postgresql-client 2>/dev/null; then
-    pg_install_success=true
-  fi
-
-  if [[ "$pg_install_success" == false ]]; then
-    msg_error "PostgreSQL package not available for suite ${SUITE}"
-    return 1
-  fi
-
-  if ! command -v psql >/dev/null 2>&1; then
-    msg_error "PostgreSQL installed but psql command not found"
-    return 1
-  fi
-
-  # Restore database backup if we upgraded from previous version
-  if [[ -n "$CURRENT_PG_VERSION" ]]; then
-    msg_info "Restoring PostgreSQL databases from backup..."
-    $STD runuser -u postgres -- psql </var/lib/postgresql/backup_$(date +%F)_v${CURRENT_PG_VERSION}.sql 2>/dev/null || {
-      msg_warn "Failed to restore database backup - this may be expected for major version upgrades"
-    }
-  fi
-
-  $STD systemctl enable --now postgresql 2>/dev/null || true
-
-  # Add PostgreSQL binaries to PATH
-  if ! grep -q '/usr/lib/postgresql' /etc/environment 2>/dev/null; then
-    echo 'PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/postgresql/'"${PG_VERSION}"'/bin"' >/etc/environment
-  fi
-
-  cache_installed_version "postgresql" "$PG_VERSION"
-  msg_ok "Setup PostgreSQL $PG_VERSION"
-
-  # Install optional modules
-  if [[ -n "$PG_MODULES" ]]; then
-    IFS=',' read -ra MODULES <<<"$PG_MODULES"
-    for module in "${MODULES[@]}"; do
-      $STD apt install -y "postgresql-${PG_VERSION}-${module}" 2>/dev/null || true
-    done
-  fi
-}
-
-# ------------------------------------------------------------------------------
-# Creates PostgreSQL database with user and optional extensions
-#
-# Description:
-#   - Creates PostgreSQL role with login and password
-#   - Creates database with UTF8 encoding and template0
-#   - Installs optional extensions (postgis, pgvector, etc.)
-#   - Configures ALTER ROLE settings for Django/Rails compatibility
-#   - Saves credentials to file
-#   - Exports variables for use in calling script
-#
-# Usage:
-#   PG_DB_NAME="myapp_db" PG_DB_USER="myapp_user" setup_postgresql_db
-#   PG_DB_NAME="immich" PG_DB_USER="immich" PG_DB_EXTENSIONS="pgvector" setup_postgresql_db
-#   PG_DB_NAME="ghostfolio" PG_DB_USER="ghostfolio" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
-#   PG_DB_NAME="adventurelog" PG_DB_USER="adventurelog" PG_DB_EXTENSIONS="postgis" setup_postgresql_db
-#
-# Variables:
-#   PG_DB_NAME             - Database name (required)
-#   PG_DB_USER             - Database user (required)
-#   PG_DB_PASS             - Database password (optional, auto-generated if empty)
-#   PG_DB_EXTENSIONS       - Comma-separated list of extensions (optional, e.g. "postgis,pgvector")
-#   PG_DB_GRANT_SUPERUSER  - Grant SUPERUSER privilege (optional, "true" to enable, security risk!)
-#   PG_DB_SCHEMA_PERMS     - Grant schema-level permissions (optional, "true" to enable)
-#   PG_DB_SKIP_ALTER_ROLE  - Skip ALTER ROLE settings (optional, "true" to skip)
-#   PG_DB_CREDS_FILE       - Credentials file path (optional, default: ~/${APPLICATION}.creds)
-#
-# Exports:
-#   PG_DB_NAME, PG_DB_USER, PG_DB_PASS - For use in calling script
-# ------------------------------------------------------------------------------
-
-function setup_postgresql_db() {
-  # Validation
-  if [[ -z "${PG_DB_NAME:-}" || -z "${PG_DB_USER:-}" ]]; then
-    msg_error "PG_DB_NAME and PG_DB_USER must be set before calling setup_postgresql_db"
-    return 1
-  fi
-
-  # Generate password if not provided
-  if [[ -z "${PG_DB_PASS:-}" ]]; then
-    PG_DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
-  fi
-
-  msg_info "Setting up PostgreSQL Database"
-  $STD sudo -u postgres psql -c "CREATE ROLE $PG_DB_USER WITH LOGIN PASSWORD '$PG_DB_PASS';"
-  $STD sudo -u postgres psql -c "CREATE DATABASE $PG_DB_NAME WITH OWNER $PG_DB_USER ENCODING 'UTF8' TEMPLATE template0;"
-
-  # Install extensions (comma-separated)
-  if [[ -n "${PG_DB_EXTENSIONS:-}" ]]; then
-    IFS=',' read -ra EXT_LIST <<<"${PG_DB_EXTENSIONS:-}"
-    for ext in "${EXT_LIST[@]}"; do
-      ext=$(echo "$ext" | xargs) # Trim whitespace
-      $STD sudo -u postgres psql -d "$PG_DB_NAME" -c "CREATE EXTENSION IF NOT EXISTS $ext;"
-    done
-  fi
-
-  # ALTER ROLE settings for Django/Rails compatibility (unless skipped)
-  if [[ "${PG_DB_SKIP_ALTER_ROLE:-}" != "true" ]]; then
-    $STD sudo -u postgres psql -c "ALTER ROLE $PG_DB_USER SET client_encoding TO 'utf8';"
-    $STD sudo -u postgres psql -c "ALTER ROLE $PG_DB_USER SET default_transaction_isolation TO 'read committed';"
-    $STD sudo -u postgres psql -c "ALTER ROLE $PG_DB_USER SET timezone TO 'UTC';"
-  fi
-
-  # Schema permissions (if requested)
-  if [[ "${PG_DB_SCHEMA_PERMS:-}" == "true" ]]; then
-    $STD sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE $PG_DB_NAME TO $PG_DB_USER;"
-    $STD sudo -u postgres psql -c "ALTER USER $PG_DB_USER CREATEDB;"
-    $STD sudo -u postgres psql -d "$PG_DB_NAME" -c "GRANT ALL ON SCHEMA public TO $PG_DB_USER;"
-    $STD sudo -u postgres psql -d "$PG_DB_NAME" -c "GRANT CREATE ON SCHEMA public TO $PG_DB_USER;"
-    $STD sudo -u postgres psql -d "$PG_DB_NAME" -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO $PG_DB_USER;"
-    $STD sudo -u postgres psql -d "$PG_DB_NAME" -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO $PG_DB_USER;"
-  fi
-
-  # Superuser grant (if requested - WARNING!)
-  if [[ "${PG_DB_GRANT_SUPERUSER:-}" == "true" ]]; then
-    msg_warn "Granting SUPERUSER privilege (security risk!)"
-    $STD sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE $PG_DB_NAME to $PG_DB_USER;"
-    $STD sudo -u postgres psql -c "ALTER USER $PG_DB_USER WITH SUPERUSER;"
-  fi
-
-  # Save credentials
-  local app_name="${APPLICATION,,}"
-  local CREDS_FILE="${PG_DB_CREDS_FILE:-${HOME}/${app_name}.creds}"
-  {
-    echo "PostgreSQL Credentials"
-    echo "Database: $PG_DB_NAME"
-    echo "User: $PG_DB_USER"
-    echo "Password: $PG_DB_PASS"
-  } >>"$CREDS_FILE"
-
-  msg_ok "Set up PostgreSQL Database"
-
-  # Export for use in calling script
-  export PG_DB_NAME
-  export PG_DB_USER
-  export PG_DB_PASS
-}
-
-# ------------------------------------------------------------------------------
-# Installs rbenv and ruby-build, installs Ruby and optionally Rails.
-#
-# Description:
-#   - Downloads rbenv and ruby-build from GitHub
-#   - Compiles and installs target Ruby version
-#   - Optionally installs Rails via gem
-#
-# Variables:
-#   RUBY_VERSION         - Ruby version to install (default: 3.4.4)
-#   RUBY_INSTALL_RAILS   - true/false to install Rails (default: true)
-# ------------------------------------------------------------------------------
-
-function setup_ruby() {
-  local RUBY_VERSION="${RUBY_VERSION:-3.4.4}"
-  local RUBY_INSTALL_RAILS="${RUBY_INSTALL_RAILS:-true}"
-  local RBENV_DIR="$HOME/.rbenv"
-  local RBENV_BIN="$RBENV_DIR/bin/rbenv"
-  local PROFILE_FILE="$HOME/.profile"
-  local TMP_DIR=$(mktemp -d)
-
-  # Get currently installed Ruby version
-  local CURRENT_RUBY_VERSION=""
-  if [[ -x "$RBENV_BIN" ]]; then
-    CURRENT_RUBY_VERSION=$("$RBENV_BIN" global 2>/dev/null || echo "")
-  fi
-
-  # Scenario 1: Already at correct Ruby version
-  if [[ "$CURRENT_RUBY_VERSION" == "$RUBY_VERSION" ]]; then
-    msg_info "Update Ruby $RUBY_VERSION"
-    cache_installed_version "ruby" "$RUBY_VERSION"
-    msg_ok "Update Ruby $RUBY_VERSION"
-    return 0
-  fi
-
-  # Scenario 2: Different version - reinstall
-  if [[ -n "$CURRENT_RUBY_VERSION" ]]; then
-    msg_info "Upgrade Ruby from $CURRENT_RUBY_VERSION to $RUBY_VERSION"
-  else
-    msg_info "Setup Ruby $RUBY_VERSION"
-  fi
-
-  ensure_apt_working || return 1
-
-  # Install build dependencies with fallbacks
-  local ruby_deps=()
-  local dep_variations=(
-    "jq"
-    "autoconf"
-    "patch"
-    "build-essential"
-    "libssl-dev"
-    "libyaml-dev"
-    "libreadline-dev|libreadline6-dev"
-    "zlib1g-dev"
-    "libgmp-dev"
-    "libncurses-dev|libncurses5-dev"
-    "libffi-dev"
-    "libgdbm-dev"
-    "libdb-dev"
-    "uuid-dev"
-  )
-
-  for dep_pattern in "${dep_variations[@]}"; do
-    if [[ "$dep_pattern" == *"|"* ]]; then
-      IFS='|' read -ra variations <<<"$dep_pattern"
-      for var in "${variations[@]}"; do
-        if apt-cache search "^${var}$" 2>/dev/null | grep -q .; then
-          ruby_deps+=("$var")
-          break
-        fi
-      done
-    else
-      if apt-cache search "^${dep_pattern}$" 2>/dev/null | grep -q .; then
-        ruby_deps+=("$dep_pattern")
-      fi
-    fi
-  done
-
-  if [[ ${#ruby_deps[@]} -gt 0 ]]; then
-    $STD apt install -y "${ruby_deps[@]}" 2>/dev/null || true
-  else
-    msg_error "No Ruby build dependencies available"
-    rm -rf "$TMP_DIR"
-    return 1
-  fi
-
-  # Download and build rbenv if needed
-  if [[ ! -x "$RBENV_BIN" ]]; then
-    local RBENV_RELEASE
-    local rbenv_json
-    rbenv_json=$(curl -fsSL --max-time 15 https://api.github.com/repos/rbenv/rbenv/releases/latest 2>/dev/null || echo "")
-
-    if [[ -z "$rbenv_json" ]]; then
-      msg_error "Failed to fetch latest rbenv version from GitHub"
-      rm -rf "$TMP_DIR"
-      return 1
-    fi
-
-    RBENV_RELEASE=$(echo "$rbenv_json" | jq -r '.tag_name' 2>/dev/null | sed 's/^v//' || echo "")
-
-    if [[ -z "$RBENV_RELEASE" ]]; then
-      msg_error "Could not parse rbenv version from GitHub response"
-      rm -rf "$TMP_DIR"
-      return 1
-    fi
-
-    curl -fsSL "https://github.com/rbenv/rbenv/archive/refs/tags/v${RBENV_RELEASE}.tar.gz" -o "$TMP_DIR/rbenv.tar.gz" || {
-      msg_error "Failed to download rbenv"
-      rm -rf "$TMP_DIR"
-      return 1
-    }
-
-    tar -xzf "$TMP_DIR/rbenv.tar.gz" -C "$TMP_DIR" || {
-      msg_error "Failed to extract rbenv"
-      rm -rf "$TMP_DIR"
-      return 1
-    }
-
-    mkdir -p "$RBENV_DIR"
-    cp -r "$TMP_DIR/rbenv-${RBENV_RELEASE}/." "$RBENV_DIR/"
-    (cd "$RBENV_DIR" && src/configure && $STD make -C src) || {
-      msg_error "Failed to build rbenv"
-      rm -rf "$TMP_DIR"
-      return 1
-    }
-
-    # Setup profile
-    if ! grep -q 'rbenv init' "$PROFILE_FILE" 2>/dev/null; then
-      echo 'export PATH="$HOME/.rbenv/bin:$PATH"' >>"$PROFILE_FILE"
-      echo 'eval "$(rbenv init -)"' >>"$PROFILE_FILE"
-    fi
-  fi
-
-  # Install ruby-build plugin
-  if [[ ! -d "$RBENV_DIR/plugins/ruby-build" ]]; then
-    local RUBY_BUILD_RELEASE
-    local ruby_build_json
-    ruby_build_json=$(curl -fsSL --max-time 15 https://api.github.com/repos/rbenv/ruby-build/releases/latest 2>/dev/null || echo "")
-
-    if [[ -z "$ruby_build_json" ]]; then
-      msg_error "Failed to fetch latest ruby-build version from GitHub"
-      rm -rf "$TMP_DIR"
-      return 1
-    fi
-
-    RUBY_BUILD_RELEASE=$(echo "$ruby_build_json" | jq -r '.tag_name' 2>/dev/null | sed 's/^v//' || echo "")
-
-    if [[ -z "$RUBY_BUILD_RELEASE" ]]; then
-      msg_error "Could not parse ruby-build version from GitHub response"
-      rm -rf "$TMP_DIR"
-      return 1
-    fi
-
-    curl -fsSL "https://github.com/rbenv/ruby-build/archive/refs/tags/v${RUBY_BUILD_RELEASE}.tar.gz" -o "$TMP_DIR/ruby-build.tar.gz" || {
-      msg_error "Failed to download ruby-build"
-      rm -rf "$TMP_DIR"
-      return 1
-    }
-
-    tar -xzf "$TMP_DIR/ruby-build.tar.gz" -C "$TMP_DIR" || {
-      msg_error "Failed to extract ruby-build"
-      rm -rf "$TMP_DIR"
-      return 1
-    }
-
-    mkdir -p "$RBENV_DIR/plugins/ruby-build"
-    cp -r "$TMP_DIR/ruby-build-${RUBY_BUILD_RELEASE}/." "$RBENV_DIR/plugins/ruby-build/"
-  fi
-
-  # Setup PATH and install Ruby version
-  export PATH="$RBENV_DIR/bin:$PATH"
-  eval "$("$RBENV_BIN" init - bash)" 2>/dev/null || true
-
-  if ! "$RBENV_BIN" versions --bare 2>/dev/null | grep -qx "$RUBY_VERSION"; then
-    $STD "$RBENV_BIN" install "$RUBY_VERSION" || {
-      msg_error "Failed to install Ruby $RUBY_VERSION"
-      rm -rf "$TMP_DIR"
-      return 1
-    }
-  fi
-
-  "$RBENV_BIN" global "$RUBY_VERSION" || {
-    msg_error "Failed to set Ruby $RUBY_VERSION as global version"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-
-  hash -r
-
-  # Install Rails if requested
-  if [[ "$RUBY_INSTALL_RAILS" == "true" ]]; then
-    $STD gem install rails || {
-      msg_warn "Failed to install Rails - Ruby installation successful"
-    }
-  fi
-
-  rm -rf "$TMP_DIR"
-  cache_installed_version "ruby" "$RUBY_VERSION"
-  msg_ok "Setup Ruby $RUBY_VERSION"
-}
-
-# ------------------------------------------------------------------------------
-# Installs or upgrades ClickHouse database server.
-#
-# Description:
-#   - Adds ClickHouse official repository
-#   - Installs specified version
-#   - Configures systemd service
-#   - Supports Debian/Ubuntu with fallback mechanism
-#
-# Variables:
-#   CLICKHOUSE_VERSION  - ClickHouse version to install (default: latest)
-# ------------------------------------------------------------------------------
-
-function setup_clickhouse() {
-  local CLICKHOUSE_VERSION="${CLICKHOUSE_VERSION:-latest}"
-  local DISTRO_ID DISTRO_CODENAME
-  DISTRO_ID=$(awk -F= '/^ID=/{print $2}' /etc/os-release | tr -d '"')
-  DISTRO_CODENAME=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
-
-  # Resolve "latest" version
-  if [[ "$CLICKHOUSE_VERSION" == "latest" ]]; then
-    CLICKHOUSE_VERSION=$(curl -fsSL --max-time 15 https://packages.clickhouse.com/tgz/stable/ 2>/dev/null |
-      grep -oP 'clickhouse-common-static-\K[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' |
-      sort -V | tail -n1 || echo "")
-
-    # Fallback to GitHub API if package server failed
-    if [[ -z "$CLICKHOUSE_VERSION" ]]; then
-      CLICKHOUSE_VERSION=$(curl -fsSL --max-time 15 https://api.github.com/repos/ClickHouse/ClickHouse/releases/latest 2>/dev/null |
-        grep -oP '"tag_name":\s*"v\K[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -n1 || echo "")
-    fi
-
-    [[ -z "$CLICKHOUSE_VERSION" ]] && {
-      msg_error "Could not determine latest ClickHouse version from any source"
-      return 1
-    }
-  fi
-
-  # Get currently installed version
-  local CURRENT_VERSION=""
-  if command -v clickhouse-server >/dev/null 2>&1; then
-    CURRENT_VERSION=$(clickhouse-server --version 2>/dev/null | grep -oP 'version \K[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
-  fi
-
-  # Scenario 1: Already at target version - just update packages
-  if [[ -n "$CURRENT_VERSION" && "$CURRENT_VERSION" == "$CLICKHOUSE_VERSION" ]]; then
-    msg_info "Update ClickHouse $CLICKHOUSE_VERSION"
-    ensure_apt_working || return 1
-
-    # Perform upgrade with retry logic (non-fatal if fails)
-    upgrade_packages_with_retry "clickhouse-server" "clickhouse-client" || true
-    cache_installed_version "clickhouse" "$CLICKHOUSE_VERSION"
-    msg_ok "Update ClickHouse $CLICKHOUSE_VERSION"
-    return 0
-  fi
-
-  # Scenario 2: Different version - clean upgrade
-  if [[ -n "$CURRENT_VERSION" && "$CURRENT_VERSION" != "$CLICKHOUSE_VERSION" ]]; then
-    msg_info "Upgrade ClickHouse from $CURRENT_VERSION to $CLICKHOUSE_VERSION"
-    stop_all_services "clickhouse-server"
-    remove_old_tool_version "clickhouse"
-  else
-    msg_info "Setup ClickHouse $CLICKHOUSE_VERSION"
-  fi
-
-  ensure_dependencies apt-transport-https ca-certificates dirmngr gnupg
-
-  # Prepare repository (cleanup + validation)
-  prepare_repository_setup "clickhouse" || {
-    msg_error "Failed to prepare ClickHouse repository"
-    return 1
-  }
-
-  # Setup repository (ClickHouse uses 'stable' suite)
-  setup_deb822_repo \
-    "clickhouse" \
-    "https://packages.clickhouse.com/rpm/lts/repodata/repomd.xml.key" \
-    "https://packages.clickhouse.com/deb" \
-    "stable" \
-    "main"
-
-  # Install packages with retry logic
-  export DEBIAN_FRONTEND=noninteractive
-  $STD apt update || {
-    msg_error "APT update failed for ClickHouse repository"
-    return 1
-  }
-
-  install_packages_with_retry "clickhouse-server" "clickhouse-client" || {
-    msg_error "Failed to install ClickHouse packages"
-    return 1
-  }
-
-  # Verify installation
-  if ! command -v clickhouse-server >/dev/null 2>&1; then
-    msg_error "ClickHouse installation completed but clickhouse-server command not found"
-    return 1
-  fi
-
-  # Setup data directory
-  mkdir -p /var/lib/clickhouse
-  if id clickhouse >/dev/null 2>&1; then
-    chown -R clickhouse:clickhouse /var/lib/clickhouse
-  fi
-
-  # Enable and start service
-  $STD systemctl enable clickhouse-server || {
-    msg_warn "Failed to enable clickhouse-server service"
-  }
-  safe_service_restart clickhouse-server || true
-
-  cache_installed_version "clickhouse" "$CLICKHOUSE_VERSION"
-  msg_ok "Setup ClickHouse $CLICKHOUSE_VERSION"
-}
-
-# ------------------------------------------------------------------------------
-# Installs Rust toolchain and optional global crates via cargo.
-#
-# Description:
-#   - Installs rustup (if missing)
-#   - Installs or updates desired Rust toolchain (stable, nightly, or versioned)
-#   - Installs or updates specified global crates using `cargo install`
-#
-# Notes:
-#   - Skips crate install if exact version is already present
-#   - Updates crate if newer version or different version is requested
-#
-# Variables:
-#   RUST_TOOLCHAIN  - Rust toolchain to install (default: stable)
-#   RUST_CRATES     - Comma-separated list of crates (e.g. "cargo-edit,wasm-pack@0.12.1")
-# ------------------------------------------------------------------------------
-
-function setup_rust() {
-  local RUST_TOOLCHAIN="${RUST_TOOLCHAIN:-stable}"
-  local RUST_CRATES="${RUST_CRATES:-}"
-  local CARGO_BIN="${HOME}/.cargo/bin"
-
-  # Get currently installed version
-  local CURRENT_VERSION=""
-  if command -v rustc &>/dev/null; then
-    CURRENT_VERSION=$(rustc --version 2>/dev/null | awk '{print $2}')
-  fi
-
-  # Scenario 1: Rustup not installed - fresh install
-  if ! command -v rustup &>/dev/null; then
-    msg_info "Setup Rust ($RUST_TOOLCHAIN)"
-    curl -fsSL https://sh.rustup.rs | $STD sh -s -- -y --default-toolchain "$RUST_TOOLCHAIN" || {
-      msg_error "Failed to install Rust"
-      return 1
-    }
-    export PATH="$CARGO_BIN:$PATH"
-    echo 'export PATH="$HOME/.cargo/bin:$PATH"' >>"$HOME/.profile"
-
-    # Verify installation
-    if ! command -v rustc >/dev/null 2>&1; then
-      msg_error "Rust binary not found after installation"
-      return 1
-    fi
-
-    local RUST_VERSION=$(rustc --version 2>/dev/null | awk '{print $2}')
-    if [[ -z "$RUST_VERSION" ]]; then
-      msg_error "Failed to determine Rust version"
-      return 1
-    fi
-
-    cache_installed_version "rust" "$RUST_VERSION"
-    msg_ok "Setup Rust $RUST_VERSION"
-  else
-    # Scenario 2: Rustup already installed - update/maintain
-    msg_info "Update Rust ($RUST_TOOLCHAIN)"
-
-    # Ensure default toolchain is set
-    $STD rustup default "$RUST_TOOLCHAIN" 2>/dev/null || {
-      # If default fails, install the toolchain first
-      $STD rustup install "$RUST_TOOLCHAIN" || {
-        msg_error "Failed to install Rust toolchain $RUST_TOOLCHAIN"
-        return 1
-      }
-      $STD rustup default "$RUST_TOOLCHAIN" || {
-        msg_error "Failed to set default Rust toolchain"
-        return 1
-      }
-    }
-
-    # Update to latest patch version
-    $STD rustup update "$RUST_TOOLCHAIN" </dev/null || true
-
-    # Ensure PATH is updated for current shell session
-    export PATH="$CARGO_BIN:$PATH"
-
-    local RUST_VERSION=$(rustc --version 2>/dev/null | awk '{print $2}')
-    if [[ -z "$RUST_VERSION" ]]; then
-      msg_error "Failed to determine Rust version after update"
-      return 1
-    fi
-
-    cache_installed_version "rust" "$RUST_VERSION"
-    msg_ok "Update Rust $RUST_VERSION"
-  fi
-
-  # Install global crates
-  if [[ -n "$RUST_CRATES" ]]; then
-    msg_info "Processing Rust crates: $RUST_CRATES"
-    IFS=',' read -ra CRATES <<<"$RUST_CRATES"
-    for crate in "${CRATES[@]}"; do
-      crate=$(echo "$crate" | xargs) # trim whitespace
-      [[ -z "$crate" ]] && continue  # skip empty entries
-
-      local NAME VER INSTALLED_VER CRATE_LIST
-      if [[ "$crate" == *"@"* ]]; then
-        NAME="${crate%@*}"
-        VER="${crate##*@}"
-      else
-        NAME="$crate"
-        VER=""
-      fi
-
-      # Get list of installed crates once
-      CRATE_LIST=$(cargo install --list 2>/dev/null || echo "")
-
-      # Check if already installed
-      if echo "$CRATE_LIST" | grep -q "^${NAME} "; then
-        INSTALLED_VER=$(echo "$CRATE_LIST" | grep "^${NAME} " | head -1 | awk '{print $2}' | tr -d 'v:')
-
-        if [[ -n "$VER" && "$VER" != "$INSTALLED_VER" ]]; then
-          msg_info "Upgrading $NAME from v$INSTALLED_VER to v$VER"
-          $STD cargo install "$NAME" --version "$VER" --force || {
-            msg_error "Failed to install $NAME@$VER"
-            return 1
-          }
-          msg_ok "Upgraded $NAME to v$VER"
-        elif [[ -z "$VER" ]]; then
-          msg_info "Upgrading $NAME to latest"
-          $STD cargo install "$NAME" --force || {
-            msg_error "Failed to upgrade $NAME"
-            return 1
-          }
-          local NEW_VER=$(cargo install --list 2>/dev/null | grep "^${NAME} " | head -1 | awk '{print $2}' | tr -d 'v:')
-          msg_ok "Upgraded $NAME to v$NEW_VER"
-        else
-          msg_ok "$NAME v$INSTALLED_VER already installed"
-        fi
-      else
-        msg_info "Installing $NAME${VER:+@$VER}"
-        if [[ -n "$VER" ]]; then
-          $STD cargo install "$NAME" --version "$VER" || {
-            msg_error "Failed to install $NAME@$VER"
-            return 1
-          }
-          msg_ok "Installed $NAME v$VER"
-        else
-          $STD cargo install "$NAME" || {
-            msg_error "Failed to install $NAME"
-            return 1
-          }
-          local NEW_VER=$(cargo install --list 2>/dev/null | grep "^${NAME} " | head -1 | awk '{print $2}' | tr -d 'v:')
-          msg_ok "Installed $NAME v$NEW_VER"
-        fi
-      fi
-    done
-    msg_ok "Processed Rust crates"
-  fi
-}
-
-# ------------------------------------------------------------------------------
-# Installs or upgrades uv (Python package manager) from GitHub releases.
-#   - Downloads platform-specific tarball (no install.sh!)
-#   - Extracts uv binary
-#   - Places it in /usr/local/bin
-#   - Optionally installs a specific Python version via uv
-# ------------------------------------------------------------------------------
-
-function setup_uv() {
-  local UV_BIN="/usr/local/bin/uv"
-  local UVX_BIN="/usr/local/bin/uvx"
-  local TMP_DIR=$(mktemp -d)
-  local CACHED_VERSION
-
-  # trap for TMP Cleanup
-  trap "rm -rf '$TMP_DIR'" EXIT
-
-  CACHED_VERSION=$(get_cached_version "uv")
-
-  # Architecture Detection
-  local ARCH=$(uname -m)
-  local OS_TYPE=""
-  local UV_TAR=""
-
-  if grep -qi "alpine" /etc/os-release; then
-    OS_TYPE="musl"
-  else
-    OS_TYPE="gnu"
-  fi
-
-  case "$ARCH" in
-  x86_64)
-    UV_TAR="uv-x86_64-unknown-linux-${OS_TYPE}.tar.gz"
-    ;;
-  aarch64)
-    UV_TAR="uv-aarch64-unknown-linux-${OS_TYPE}.tar.gz"
-    ;;
-  i686)
-    UV_TAR="uv-i686-unknown-linux-${OS_TYPE}.tar.gz"
-    ;;
-  *)
-    msg_error "Unsupported architecture: $ARCH (supported: x86_64, aarch64, i686)"
-    return 1
-    ;;
-  esac
-
-  ensure_dependencies jq
-
-  # Fetch latest version
-  local releases_json
-  releases_json=$(curl -fsSL --max-time 15 \
-    "https://api.github.com/repos/astral-sh/uv/releases/latest" 2>/dev/null || echo "")
-
-  if [[ -z "$releases_json" ]]; then
-    msg_error "Could not fetch latest uv version from GitHub API"
-    return 1
-  fi
-
-  local LATEST_VERSION
-  LATEST_VERSION=$(echo "$releases_json" | jq -r '.tag_name' 2>/dev/null | sed 's/^v//')
-
-  if [[ -z "$LATEST_VERSION" ]]; then
-    msg_error "Could not parse uv version from GitHub API response"
-    return 1
-  fi
-
-  # Get currently installed version
-  local INSTALLED_VERSION=""
-  if [[ -x "$UV_BIN" ]]; then
-    INSTALLED_VERSION=$("$UV_BIN" --version 2>/dev/null | awk '{print $2}')
-  fi
-
-  # Scenario 1: Already at latest version
-  if [[ -n "$INSTALLED_VERSION" && "$INSTALLED_VERSION" == "$LATEST_VERSION" ]]; then
-    cache_installed_version "uv" "$LATEST_VERSION"
-
-    # Check if uvx is needed and missing
-    if [[ "${USE_UVX:-NO}" == "YES" ]] && [[ ! -x "$UVX_BIN" ]]; then
-      msg_info "Installing uvx wrapper"
-      _install_uvx_wrapper || return 1
-      msg_ok "uvx wrapper installed"
-    fi
-
-    return 0
-  fi
-
-  # Scenario 2: New install or upgrade
-  if [[ -n "$INSTALLED_VERSION" && "$INSTALLED_VERSION" != "$LATEST_VERSION" ]]; then
-    msg_info "Upgrade uv from $INSTALLED_VERSION to $LATEST_VERSION"
-  else
-    msg_info "Setup uv $LATEST_VERSION"
-  fi
-
-  local UV_URL="https://github.com/astral-sh/uv/releases/download/${LATEST_VERSION}/${UV_TAR}"
-
-  $STD curl -fsSL "$UV_URL" -o "$TMP_DIR/uv.tar.gz" || {
-    msg_error "Failed to download uv from $UV_URL"
-    return 1
-  }
-
-  # Extract
-  $STD tar -xzf "$TMP_DIR/uv.tar.gz" -C "$TMP_DIR" || {
-    msg_error "Failed to extract uv"
-    return 1
-  }
-
-  # Find and install uv binary (tarball extracts to uv-VERSION-ARCH/ directory)
-  local UV_BINARY=$(find "$TMP_DIR" -name "uv" -type f -executable | head -n1)
-  if [[ ! -f "$UV_BINARY" ]]; then
-    msg_error "Could not find uv binary in extracted tarball"
-    return 1
-  fi
-
-  $STD install -m 755 "$UV_BINARY" "$UV_BIN" || {
-    msg_error "Failed to install uv binary"
-    return 1
-  }
-
-  ensure_usr_local_bin_persist
-  export PATH="/usr/local/bin:$PATH"
-
-  # Optional: Install uvx wrapper
-  if [[ "${USE_UVX:-NO}" == "YES" ]]; then
-    msg_info "Installing uvx wrapper"
-    _install_uvx_wrapper || {
-      msg_error "Failed to install uvx wrapper"
-      return 1
-    }
-    msg_ok "uvx wrapper installed"
-  fi
-
-  # Optional: Generate shell completions
-  $STD uv generate-shell-completion bash >/etc/bash_completion.d/uv 2>/dev/null || true
-  if [[ -d /usr/share/zsh/site-functions ]]; then
-    $STD uv generate-shell-completion zsh >/usr/share/zsh/site-functions/_uv 2>/dev/null || true
-  fi
-
-  # Optional: Install specific Python version if requested
-  if [[ -n "${PYTHON_VERSION:-}" ]]; then
-    msg_info "Installing Python $PYTHON_VERSION via uv"
-    $STD uv python install "$PYTHON_VERSION" || {
-      msg_error "Failed to install Python $PYTHON_VERSION"
-      return 1
-    }
-    msg_ok "Python $PYTHON_VERSION installed"
-  fi
-
-  cache_installed_version "uv" "$LATEST_VERSION"
-  msg_ok "Setup uv $LATEST_VERSION"
-}
-
-# Helper function to install uvx wrapper
-_install_uvx_wrapper() {
-  local UVX_BIN="/usr/local/bin/uvx"
-
-  cat >"$UVX_BIN" <<'EOF'
-#!/bin/bash
-# uvx - Run Python applications from PyPI as command-line tools
-# Wrapper for: uv tool run
-exec /usr/local/bin/uv tool run "$@"
-EOF
-
-  chmod +x "$UVX_BIN"
-  return 0
-}
-
-# ------------------------------------------------------------------------------
-# Installs or updates yq (mikefarah/yq - Go version).
-#
-# Description:
-#   - Checks if yq is installed and from correct source
-#   - Compares with latest release on GitHub
-#   - Updates if outdated or wrong implementation
-# ------------------------------------------------------------------------------
-
-function setup_yq() {
-  local TMP_DIR=$(mktemp -d)
-  local BINARY_PATH="/usr/local/bin/yq"
-  local GITHUB_REPO="mikefarah/yq"
-
-  ensure_dependencies jq
-  ensure_usr_local_bin_persist
-
-  # Remove non-mikefarah implementations
-  if command -v yq &>/dev/null; then
-    if ! yq --version 2>&1 | grep -q 'mikefarah'; then
-      rm -f "$(command -v yq)"
-    fi
-  fi
-
-  local LATEST_VERSION
-  local releases_json
-  releases_json=$(curl -fsSL --max-time 15 "https://api.github.com/repos/${GITHUB_REPO}/releases/latest" 2>/dev/null || echo "")
-
-  if [[ -z "$releases_json" ]]; then
-    msg_error "Could not fetch latest yq version from GitHub API"
-    rm -rf "$TMP_DIR"
-    return 1
-  fi
-
-  LATEST_VERSION=$(echo "$releases_json" | jq -r '.tag_name' 2>/dev/null | sed 's/^v//' || echo "")
-
-  if [[ -z "$LATEST_VERSION" ]]; then
-    msg_error "Could not parse yq version from GitHub API response"
-    rm -rf "$TMP_DIR"
-    return 1
-  fi
-
-  # Get currently installed version
-  local INSTALLED_VERSION=""
-  if command -v yq &>/dev/null && yq --version 2>&1 | grep -q 'mikefarah'; then
-    INSTALLED_VERSION=$(yq --version 2>/dev/null | awk '{print $NF}' | sed 's/^v//')
-  fi
-
-  # Scenario 1: Already at latest version
-  if [[ -n "$INSTALLED_VERSION" && "$INSTALLED_VERSION" == "$LATEST_VERSION" ]]; then
-    cache_installed_version "yq" "$LATEST_VERSION"
-    rm -rf "$TMP_DIR"
-    return 0
-  fi
-
-  # Scenario 2: New install or upgrade
-  if [[ -n "$INSTALLED_VERSION" && "$INSTALLED_VERSION" != "$LATEST_VERSION" ]]; then
-    msg_info "Upgrade yq from $INSTALLED_VERSION to $LATEST_VERSION"
-  else
-    msg_info "Setup yq $LATEST_VERSION"
-  fi
-
-  curl -fsSL "https://github.com/${GITHUB_REPO}/releases/download/v${LATEST_VERSION}/yq_linux_amd64" -o "$TMP_DIR/yq" || {
-    msg_error "Failed to download yq"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-
-  chmod +x "$TMP_DIR/yq"
-  mv "$TMP_DIR/yq" "$BINARY_PATH" || {
-    msg_error "Failed to install yq"
-    rm -rf "$TMP_DIR"
-    return 1
-  }
-
-  rm -rf "$TMP_DIR"
-  hash -r
-
-  local FINAL_VERSION
-  FINAL_VERSION=$("$BINARY_PATH" --version 2>/dev/null | awk '{print $NF}' | sed 's/^v//')
-  cache_installed_version "yq" "$FINAL_VERSION"
-  msg_ok "Setup yq $FINAL_VERSION"
-}