Bot Updating Templated Files

fix READMe PROXY conf directory

.github/CONTRIBUTING.md

@@ -6,7 +6,7 @@
 * Read, and fill the Pull Request template
   * If this is a fix for a typo (in code, documentation, or the README) please file an issue and let us sort it out. We do not need a PR
   * If the PR is addressing an existing issue include, closes #\<issue number>, in the body of the PR commit message
-* If you want to discuss changes, you can also bring it up in [#dev-talk](https://discordapp.com/channels/354974912613449730/757585807061155840) in our [Discord server](https://discord.gg/YWrKVTn)
+* If you want to discuss changes, you can also bring it up in [#dev-talk](https://discordapp.com/channels/354974912613449730/757585807061155840) in our [Discord server](https://linuxserver.io/discord)
 
 ## Common files
 
@@ -105,10 +105,10 @@ docker build \
   -t linuxserver/swag:latest .
 ```
 
-The ARM variants can be built on x86_64 hardware using `multiarch/qemu-user-static`
+The ARM variants can be built on x86_64 hardware and vice versa using `lscr.io/linuxserver/qemu-static`
 
 ```bash
-docker run --rm --privileged multiarch/qemu-user-static:register --reset
+docker run --rm --privileged lscr.io/linuxserver/qemu-static --reset
 ```
 
 Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64`.

.github/ISSUE_TEMPLATE/config.yml

@@ -1,11 +1,11 @@
 blank_issues_enabled: false
 contact_links:
   - name: Discord chat support
-    url: https://discord.gg/YWrKVTn
+    url: https://linuxserver.io/discord
     about: Realtime support / chat with the community and the team.
 
-  - name: Discourse discussion forum
-    url: https://discourse.linuxserver.io
+  - name: Github Discussions
+    url: https://github.com/orgs/linuxserver/discussions
     about: Post on our community forum.
 
   - name: Documentation

.github/PULL_REQUEST_TEMPLATE.md

@@ -3,7 +3,6 @@
 [linuxserverurl]: https://linuxserver.io
 [![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)][linuxserverurl]
 
-
 <!--- Before submitting a pull request please check the following -->
 
 <!---  If this is a fix for a typo (in code, documentation, or the README) please file an issue and let us sort it out. We do not need a PR  -->
@@ -12,7 +11,6 @@
 <!---  You have included links to any files / patches etc your PR may be using in the body of the PR commit message -->
 <!--- We maintain a changelog of major revisions to the container at the end of readme-vars.yml in the root of this repository, please add your changes there if appropriate -->
 
-
 <!--- Coding guidelines: -->
 <!--- 1. Installed packages in the Dockerfiles should be in alphabetical order -->
 <!--- 2. Changes to Dockerfile should be replicated in Dockerfile.armhf and Dockerfile.aarch64 if applicable -->
@@ -21,11 +19,16 @@
 
 ------------------------------
 
- - [ ] I have read the [contributing](https://github.com/linuxserver/docker-swag/blob/master/.github/CONTRIBUTING.md) guideline and understand that I have made the correct modifications
+- [ ] I have read the [contributing](https://github.com/linuxserver/docker-swag/blob/master/.github/CONTRIBUTING.md) guideline and understand that I have made the correct modifications
+
+<!--- LLM disclosure: -->
+
+- [ ] An LLM assisted me in writing the code or text for this PR
+- [ ] An LLM agent wrote the code or text for this PR
 
 ------------------------------
 
-<!--- We welcome all PR’s though this doesn’t guarantee it will be accepted. -->
+<!--- We welcome all PRs though this doesn’t guarantee it will be accepted. -->
 
 ## Description:
 <!--- Describe your changes in detail -->
@@ -38,6 +41,5 @@
 <!--- Include details of your testing environment, and the tests you ran to -->
 <!--- see how your change affects other areas of the code, etc. -->
 
-
 ## Source / References:
 <!--- Please include any forum posts/github links relevant to the PR -->

.github/workflows/call_issue_pr_tracker.yml

@@ -8,6 +8,9 @@ on:
   pull_request_review:
     types: [submitted,edited,dismissed]
 
+permissions:
+  contents: read
+
 jobs:
   manage-project:
     permissions:

.github/workflows/call_issues_cron.yml

@@ -4,6 +4,9 @@ on:
     - cron:  '35 15 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   stale:
     permissions:

.github/workflows/external_trigger.yml

@@ -3,11 +3,14 @@ name: External Trigger Main
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   external-trigger-master:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: linuxserver/github-workflows/.github/actions/checkout@v1
 
       - name: External Trigger
         if: github.ref == 'refs/heads/master'
@@ -15,7 +18,10 @@ jobs:
           SKIP_EXTERNAL_TRIGGER: ${{ vars.SKIP_EXTERNAL_TRIGGER }}
         run: |
           printf "# External trigger for docker-swag\n\n" >> $GITHUB_STEP_SUMMARY
-          if grep -q "^swag_master" <<< "${SKIP_EXTERNAL_TRIGGER}"; then
+          if grep -q "^swag_master_" <<< "${SKIP_EXTERNAL_TRIGGER}"; then
+            echo "> [!NOTE]" >> $GITHUB_STEP_SUMMARY
+            echo "> Github organizational variable \`SKIP_EXTERNAL_TRIGGER\` contains \`swag_master_\`; will skip trigger if version matches." >> $GITHUB_STEP_SUMMARY
+          elif grep -q "^swag_master" <<< "${SKIP_EXTERNAL_TRIGGER}"; then
             echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
             echo "> Github organizational variable \`SKIP_EXTERNAL_TRIGGER\` contains \`swag_master\`; skipping trigger." >> $GITHUB_STEP_SUMMARY
             exit 0
@@ -25,6 +31,11 @@ jobs:
           printf "\n## Retrieving external version\n\n" >> $GITHUB_STEP_SUMMARY
           EXT_RELEASE=$(curl -sL "https://pypi.python.org/pypi/certbot/json" |jq -r '. | .info.version')
           echo "Type is \`pip_version\`" >> $GITHUB_STEP_SUMMARY
+          if grep -q "^swag_master_${EXT_RELEASE}" <<< "${SKIP_EXTERNAL_TRIGGER}"; then
+            echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+            echo "> Github organizational variable \`SKIP_EXTERNAL_TRIGGER\` matches current external release; skipping trigger." >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
           if [ -z "${EXT_RELEASE}" ] || [ "${EXT_RELEASE}" == "null" ]; then
             echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
             echo "> Can't retrieve external version, exiting" >> $GITHUB_STEP_SUMMARY
@@ -35,24 +46,43 @@ jobs:
               "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
             exit 1
           fi
-          EXT_RELEASE=$(echo ${EXT_RELEASE} | sed 's/[~,%@+;:/]//g')
-          echo "External version: \`${EXT_RELEASE}\`" >> $GITHUB_STEP_SUMMARY
+          EXT_RELEASE_SANITIZED=$(echo ${EXT_RELEASE} | sed 's/[~,%@+;:/]//g')
+          echo "Sanitized external version: \`${EXT_RELEASE_SANITIZED}\`" >> $GITHUB_STEP_SUMMARY
           echo "Retrieving last pushed version" >> $GITHUB_STEP_SUMMARY
           image="linuxserver/swag"
           tag="latest"
           token=$(curl -sX GET \
             "https://ghcr.io/token?scope=repository%3Alinuxserver%2Fswag%3Apull" \
             | jq -r '.token')
-            multidigest=$(curl -s \
+          multidigest=$(curl -s \
+            --header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
+            --header "Accept: application/vnd.oci.image.index.v1+json" \
+            --header "Authorization: Bearer ${token}" \
+            "https://ghcr.io/v2/${image}/manifests/${tag}")
+          if jq -e '.layers // empty' <<< "${multidigest}" >/dev/null 2>&1; then
+            # If there's a layer element it's a single-arch manifest so just get that digest
+            digest=$(jq -r '.config.digest' <<< "${multidigest}")
+          else
+            # Otherwise it's multi-arch or has manifest annotations
+            if jq -e '.manifests[]?.annotations // empty' <<< "${multidigest}" >/dev/null 2>&1; then
+              # Check for manifest annotations and delete if found
+              multidigest=$(jq 'del(.manifests[] | select(.annotations))' <<< "${multidigest}")
+            fi
+            if [[ $(jq '.manifests | length' <<< "${multidigest}") -gt 1 ]]; then
+              # If there's still more than one digest, it's multi-arch
+              multidigest=$(jq -r ".manifests[] | select(.platform.architecture == \"amd64\").digest?" <<< "${multidigest}")
+            else
+              # Otherwise it's single arch
+              multidigest=$(jq -r ".manifests[].digest?" <<< "${multidigest}")
+            fi
+            if digest=$(curl -s \
               --header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
+              --header "Accept: application/vnd.oci.image.manifest.v1+json" \
               --header "Authorization: Bearer ${token}" \
-              "https://ghcr.io/v2/${image}/manifests/${tag}" \
-              | jq -r 'first(.manifests[].digest)')
-            digest=$(curl -s \
-              --header "Accept: application/vnd.docker.distribution.manifest.v2+json" \
-              --header "Authorization: Bearer ${token}" \
-              "https://ghcr.io/v2/${image}/manifests/${multidigest}" \
-              | jq -r '.config.digest')
+              "https://ghcr.io/v2/${image}/manifests/${multidigest}"); then
+              digest=$(jq -r '.config.digest' <<< "${digest}");
+            fi
+          fi
           image_info=$(curl -sL \
             --header "Authorization: Bearer ${token}" \
             "https://ghcr.io/v2/${image}/blobs/${digest}")
@@ -73,8 +103,8 @@ jobs:
             exit 1
           fi
           echo "Last pushed version: \`${IMAGE_VERSION}\`" >> $GITHUB_STEP_SUMMARY
-          if [ "${EXT_RELEASE}" == "${IMAGE_VERSION}" ]; then
-            echo "Version \`${EXT_RELEASE}\` already pushed, exiting" >> $GITHUB_STEP_SUMMARY
+          if [ "${EXT_RELEASE_SANITIZED}" == "${IMAGE_VERSION}" ]; then
+            echo "Sanitized version \`${EXT_RELEASE_SANITIZED}\` already pushed, exiting" >> $GITHUB_STEP_SUMMARY
             exit 0
           elif [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/lastBuild/api/json | jq -r '.building') == "true" ]; then
             echo "New version \`${EXT_RELEASE}\` found; but there already seems to be an active build on Jenkins; exiting" >> $GITHUB_STEP_SUMMARY
@@ -89,8 +119,8 @@ jobs:
                 "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
             else
               printf "\n## Trigger new build\n\n" >> $GITHUB_STEP_SUMMARY
-              echo "New version \`${EXT_RELEASE}\` found; old version was \`${IMAGE_VERSION}\`. Triggering new build" >> $GITHUB_STEP_SUMMARY
-              if "${artifacts_found}" == "true" ]]; then
+              echo "New sanitized version \`${EXT_RELEASE_SANITIZED}\` found; old version was \`${IMAGE_VERSION}\`. Triggering new build" >> $GITHUB_STEP_SUMMARY
+              if [[ "${artifacts_found}" == "true" ]]; then
                 echo "All artifacts seem to be uploaded." >> $GITHUB_STEP_SUMMARY
               fi
               response=$(curl -iX POST \
@@ -109,7 +139,7 @@ jobs:
                 --data-urlencode "description=GHA external trigger https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
                 --data-urlencode "Submit=Submit"
               echo "**** Notifying Discord ****"
-              TRIGGER_REASON="A version change was detected for swag tag latest. Old version:${IMAGE_VERSION} New version:${EXT_RELEASE}"
+              TRIGGER_REASON="A version change was detected for swag tag latest. Old version:${IMAGE_VERSION} New version:${EXT_RELEASE_SANITIZED}"
               curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 9802903,
                 "description": "**Build Triggered** \n**Reason:** '"${TRIGGER_REASON}"' \n**Build URL:** '"${buildurl}display/redirect"' \n"}],
                 "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}

.github/workflows/external_trigger_scheduler.yml

@@ -5,11 +5,14 @@ on:
     - cron:  '2 * * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   external-trigger-scheduler:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: linuxserver/github-workflows/.github/actions/checkout@v1
         with:
           fetch-depth: '0'
 

.github/workflows/greetings.yml

@@ -2,12 +2,18 @@ name: Greetings
 
 on: [pull_request_target, issues]
 
+permissions:
+  contents: read
+
 jobs:
   greeting:
+    permissions:
+      issues: write
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/first-interaction@v1
+    - uses: linuxserver/github-workflows/.github/actions/first-interaction@v1
       with:
-        issue-message: 'Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.'
-        pr-message: 'Thanks for opening this pull request! Be sure to follow the [pull request template](https://github.com/linuxserver/docker-swag/blob/master/.github/PULL_REQUEST_TEMPLATE.md)!'
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        issue_message: 'Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.'
+        pr_message: 'Thanks for opening this pull request! Be sure to follow the [pull request template](https://github.com/linuxserver/docker-swag/blob/master/.github/PULL_REQUEST_TEMPLATE.md)!'
+        repo_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/package_trigger_scheduler.yml

@@ -5,11 +5,14 @@ on:
     - cron:  '1 3 * * 6'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   package-trigger-scheduler:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: linuxserver/github-workflows/.github/actions/checkout@v1
         with:
           fetch-depth: '0'
 
@@ -27,9 +30,18 @@ jobs:
             fi
             printf "\n## Evaluating \`%s\`\n\n" ${br} >> $GITHUB_STEP_SUMMARY
             JENKINS_VARS=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/jenkins-vars.yml)
-            if [[ "${br}" == $(yq -r '.ls_branch' <<< "${JENKINS_VARS}") ]]; then
+            if ! curl -sfX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/Jenkinsfile >/dev/null 2>&1; then
+              echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+              echo "> No Jenkinsfile found. Branch is either deprecated or is an early dev branch." >> $GITHUB_STEP_SUMMARY
+              skipped_branches="${skipped_branches}${br} "
+            elif [[ "${br}" == $(yq -r '.ls_branch' <<< "${JENKINS_VARS}") ]]; then
               echo "Branch appears to be live; checking workflow." >> $GITHUB_STEP_SUMMARY
-              if [[ $(yq -r '.skip_package_check' <<< "${JENKINS_VARS}") == "true" ]]; then
+              README_VARS=$(curl -sX GET https://raw.githubusercontent.com/linuxserver/docker-swag/${br}/readme-vars.yml)
+              if [[ $(yq -r '.project_deprecation_status' <<< "${README_VARS}") == "true" ]]; then
+                echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+                echo "> Branch appears to be deprecated; skipping trigger." >> $GITHUB_STEP_SUMMARY
+                skipped_branches="${skipped_branches}${br} "
+              elif [[ $(yq -r '.skip_package_check' <<< "${JENKINS_VARS}") == "true" ]]; then
                 echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
                 echo "> Skipping branch ${br} due to \`skip_package_check\` being set in \`jenkins-vars.yml\`." >> $GITHUB_STEP_SUMMARY
                 skipped_branches="${skipped_branches}${br} "
@@ -37,7 +49,7 @@ jobs:
                 echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
                 echo "> Github organizational variable \`SKIP_PACKAGE_TRIGGER\` contains \`swag_${br}\`; skipping trigger." >> $GITHUB_STEP_SUMMARY
                 skipped_branches="${skipped_branches}${br} "
-              elif [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/${br}/lastBuild/api/json | jq -r '.building') == "true" ]; then
+              elif [ $(curl -s https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/${br}/lastBuild/api/json | jq -r '.building' 2>/dev/null) == "true" ]; then
                 echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
                 echo "> There already seems to be an active build on Jenkins; skipping package trigger for ${br}" >> $GITHUB_STEP_SUMMARY
                 skipped_branches="${skipped_branches}${br} "
@@ -49,6 +61,11 @@ jobs:
                 response=$(curl -iX POST \
                   https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/${br}/buildWithParameters?PACKAGE_CHECK=true \
                   --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} | grep -i location | sed "s|^[L|l]ocation: \(.*\)|\1|")
+                if [[ -z "${response}" ]]; then
+                  echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+                  echo "> Jenkins build could not be triggered. Skipping branch."
+                  continue
+                fi
                 echo "Jenkins [job queue url](${response%$'\r'})" >> $GITHUB_STEP_SUMMARY
                 echo "Sleeping 10 seconds until job starts" >> $GITHUB_STEP_SUMMARY
                 sleep 10
@@ -56,11 +73,14 @@ jobs:
                 buildurl="${buildurl%$'\r'}"
                 echo "Jenkins job [build url](${buildurl})" >> $GITHUB_STEP_SUMMARY
                 echo "Attempting to change the Jenkins job description" >> $GITHUB_STEP_SUMMARY
-                curl -iX POST \
+                if ! curl -ifX POST \
                   "${buildurl}submitDescription" \
                   --user ${{ secrets.JENKINS_USER }}:${{ secrets.JENKINS_TOKEN }} \
                   --data-urlencode "description=GHA package trigger https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
-                  --data-urlencode "Submit=Submit"
+                  --data-urlencode "Submit=Submit"; then
+                  echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY
+                  echo "> Unable to change the Jenkins job description."
+                fi
                 sleep 20
               fi
             else
@@ -70,13 +90,14 @@ jobs:
           if [[ -n "${triggered_branches}" ]] || [[ -n "${skipped_branches}" ]]; then
             if [[ -n "${triggered_branches}" ]]; then
               NOTIFY_BRANCHES="**Triggered:** ${triggered_branches} \n"
+              NOTIFY_BUILD_URL="**Build URL:** https://ci.linuxserver.io/blue/organizations/jenkins/Docker-Pipeline-Builders%2Fdocker-swag/activity/ \n"
+              echo "**** Package check build(s) triggered for branch(es): ${triggered_branches} ****"
             fi
             if [[ -n "${skipped_branches}" ]]; then
               NOTIFY_BRANCHES="${NOTIFY_BRANCHES}**Skipped:** ${skipped_branches} \n"
             fi
-            echo "**** Package check build(s) triggered for branch(es): ${triggered_branches} ****"
             echo "**** Notifying Discord ****"
             curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 9802903,
-              "description": "**Package Check Build(s) Triggered for swag** \n'"${NOTIFY_BRANCHES}"'**Build URL:** '"https://ci.linuxserver.io/blue/organizations/jenkins/Docker-Pipeline-Builders%2Fdocker-swag/activity/"' \n"}],
+              "description": "**Package Check Build(s) for swag** \n'"${NOTIFY_BRANCHES}"''"${NOTIFY_BUILD_URL}"'"}],
               "username": "Github Actions"}' ${{ secrets.DISCORD_WEBHOOK }}
           fi

.gitignore

@@ -1 +1,2 @@
+.idea
 .jenkins-external

AGENTS.md

@@ -0,0 +1,127 @@
+<!-- DO NOT EDIT THIS FILE MANUALLY -->
+<!-- This file is globally distributed to all container image projects from https://github.com/linuxserver/docker-jenkins-builder -->
+# AGENTS.md - LinuxServer.io container image repository
+
+This file is for AI coding agents (and the humans driving them) working in a LinuxServer.io `docker-*` image repository. Read it fully before proposing or making any change.
+
+We welcome contributions, including AI-assisted ones, but this is a volunteer-run project that ships 150+ images to millions of users from one shared template. A change that looks like an improvement in isolation is often wrong for us. When this file and your instincts disagree, this file wins. When this file is silent, copy what the surrounding code already does.
+
+## 1. Decide where the change belongs before writing any code
+
+Our images are built for **broad consumption**. Every package, env var and init step we add is something we have to maintain, rebuild weekly and support forever, for every user, whether they use it or not. We do not ship Swiss Army Knife images. Work down this list and stop at the first match:
+
+1. **It is a bug or feature in the application itself** (not in our packaging): it belongs upstream with the app's developers. Do not patch, fork or work around upstream application behaviour in the image.
+2. **It is an unsupported or reasonable-endeavours environment** (Podman, k8s, Portainer, Watchtower, NFS/SMB `/config`, LXC, custom entrypoints, etc. See the [Support Policy](https://docs.linuxserver.io/misc/support-policy/)): we will not add logic to the image to accommodate it.
+3. **It only matters to one user or one setup**: use a private [custom script](https://docs.linuxserver.io/general/container-customization/#custom-scripts) in `/custom-cont-init.d` or [custom service](https://docs.linuxserver.io/general/container-customization/#custom-services) in `/custom-services.d`. No PR needed.
+4. **It is useful to a subset of users** (an extra package, plugin dependency, alternative UI, hardware driver, third party integration, extra daemon, niche toggle): it is a **[Docker Mod](https://github.com/linuxserver/docker-mods)**, not a change to this repo. Check whether one already exists first (`universal-*` mods work on every image; `<image>-*` mods are image specific). If not, create one from the template in the docker-mods repo; each mod lives on its own branch there.
+5. **The large majority of this image's users benefit, or the image is actually broken**: a PR to this repo is appropriate. Examples: the app fails to start, a new upstream release needs a new runtime dependency, a base image rebase, a permissions bug, a wrong default, incorrect docs in `readme-vars.yml`.
+
+If you are an agent and the requested change lands on 1-4, **stop and tell your operator** where it belongs instead of writing the PR. "It is only a few lines" is not a reason to put it in the image. If in doubt, a human should open an issue or ask in `#contibutor-discussion` on [Discord](https://linuxserver.io/discord) before doing the work.
+
+### If it is a mod
+
+Mods are the pressure valve that keeps the images small. Roughly what lives there today, and therefore does **not** belong in an image: extra OS/pip packages and language toolchains, GPU/hardware driver stacks, alternative web UIs and themes, third party plugins and scanners, integrations with external services (Cloudflare, CrowdSec, Apprise, GeoIP, VPN providers), Docker socket automation, sidecar daemons (redis, tunnels), post-processing scripts, and env-var-to-config-file shims.
+
+- Follow the README and `template` branch in [docker-mods](https://github.com/linuxserver/docker-mods). A mod is a `FROM scratch` single layer of files extracted over `/` at container start, wired into s6 as `init-mod-<image>-<mod>-*` / `svc-mod-<image>-<mod>` units.
+- Mods never call `apk`/`apt`/`pip` directly; they append to `/mod-repo-packages-to-install.list` or `/mod-pip-packages-to-install.list` and let the base image do one batched install. Handle Alpine and Ubuntu package names where the mod is universal.
+- Most good mods are a 10-40 line script. If yours is not, reconsider the approach.
+- A mod is also the proving ground. If a mod becomes something nearly everyone uses, the team may absorb it into the image later and turn the mod into a no-op with a deprecation notice. That is the team's call, not a reason to skip the mod step.
+
+## 2. Repository layout and what you must not edit
+
+| Path | Notes |
+| --- | --- |
+| `Dockerfile`, `Dockerfile.aarch64` (sometimes `Dockerfile.riscv64`) | One per architecture. **Any change must be replicated to all of them.** They normally differ only in base image tag and arch strings. |
+| `root/` | Copied to `/` in the image. s6-overlay v3 services live in `root/etc/s6-overlay/s6-rc.d/`, defaults in `root/defaults/`, one-time upgrade steps in `root/migrations/`. |
+| `readme-vars.yml` | **Source of truth for the README, docs site, Unraid template and changelog.** Edit this. |
+| `jenkins-vars.yml` | Build pipeline variables (version detection, CI test settings). Rarely needs touching. |
+| `README.md` | **Generated. Never edit.** |
+| `Jenkinsfile` | **Generated. Never edit.** |
+| `package_versions.txt` | **Generated by CI. Never edit.** |
+| `.github/**`, `.editorconfig`, `LICENSE`, `AGENTS.md` | **Generated / globally distributed. Never edit here.** Changes go to [docker-jenkins-builder](https://github.com/linuxserver/docker-jenkins-builder). |
+
+Do not add new top level files or tooling: no `docker-compose.yml`, `Makefile`, test suites, linter configs, pre-commit hooks, extra workflows, `CHANGELOG.md`, `SECURITY.md`, devcontainers, or helper scripts. The repo is intentionally small.
+
+Some repos have multiple live branches that publish different tags (`nightly`, `develop`, `libtorrentv1`, etc.). Each is maintained independently. Target the branch the change applies to, never merge one into another, and do not assume `master` or `main` is the only one that matters.
+
+## 3. Code style: keep it simple, match what is there
+
+The goal of every image is the thinnest possible layer between our base image and the upstream app: install it, drop a sane default config into `/config` on first run, fix permissions, start it. Prefer deleting logic to adding it. The base image already handles PUID/PGID, `UMASK`, `TZ`, `FILE__` secrets, mods, custom scripts, cron and device permissions; never reimplement those.
+
+### Dockerfiles
+
+- Base is always `ghcr.io/linuxserver/baseimage-*`. Do not change distro, switch to upstream/distroless images, or add multi-stage complexity unless a maintainer asked for it. Base image rebases are done by the team.
+- Follow the existing shape exactly: a single `RUN` chain joined with `&& \`, each step announced with `echo "**** doing thing ****"`, two space indentation, a `**** cleanup ****` step at the end removing `/tmp/*` and package caches.
+- Packages are listed **one per line in alphabetical order**. Build-only dependencies go in a `build-dependencies` virtual package (Alpine) or are purged (Ubuntu) in the same layer.
+- Do not hardcode or pin the application version. Keep the `if [ -z ${APP_VERSION+x} ]; then ...` pattern; CI supplies the version as a build arg and `jenkins-vars.yml` defines how it is detected.
+- Do not add `HEALTHCHECK`, `USER`, `ENTRYPOINT` or `CMD`. The base image owns init (`/init`), and the container must start as root unless the image already documents non-root support.
+- Do not touch the `LABEL maintainer` or `build_version` lines.
+
+### Init scripts and services (`root/etc/s6-overlay/s6-rc.d/`)
+
+- Naming: `init-<app>-config` (oneshot) and `svc-<app>` (longrun). Wire them in using empty files in `dependencies.d/` and `user/contents.d/`, exactly as the existing ones do. Oneshots have `type`, `up` (the path to `run`) and `run`. No legacy `cont-init.d` / `services.d`.
+- Every script starts with:
+
+  ```bash
+  #!/usr/bin/with-contenv bash
+  # shellcheck shell=bash
+  ```
+
+- Bash, four space indentation, `[[ ]]` tests, `"${VAR}"` quoting, short lowercase `#` comments. Scripts must be shellcheck clean.
+- Use `lsiown` instead of `chown`, run the app as `abc` via `s6-setuidgid abc`, and `exec` the final process so s6 supervises it. Keep `s6-notifyoncheck` readiness checks where they exist.
+- If `readme-vars.yml` has `nonroot_supported: true` or `readonly_supported: true`, every new privileged operation (chown, writing outside `/config` and `/run`, `s6-setuidgid`) must be guarded the same way the existing code does it (`if [[ -z ${LSIO_NON_ROOT_USER} ]]; then` etc.). Do not break those modes.
+- User data and config live in `/config`. Copy defaults only if the file does not already exist; never overwrite user config on startup. If an existing user's config must change, add a numbered script in `root/migrations/`.
+- Avoid recursive `lsiown` on large data paths (media, downloads); it makes startup take minutes for real users.
+- New environment variables are a last resort. If the app can be configured through its own config file or UI, that is the answer. We do not wrap app settings in env vars.
+
+## 4. Documentation and changelog
+
+- All user-facing docs changes go in `readme-vars.yml` (`app_setup_block`, `param_env_vars`, `opt_param_*`, etc.). Reference: [`_container-vars-blank`](https://github.com/linuxserver/docker-jenkins-builder/blob/master/ansible/vars/_container-vars-blank).
+- Any change to a Dockerfile or to anything under `root/` needs a new entry at the **top** of `changelogs:` in `readme-vars.yml`, one short factual line:
+
+  ```yaml
+  - {date: "DD.MM.YY:", desc: "Add libfoo to fix thumbnail generation."}
+  ```
+
+- Optionally regenerate the templated files to check your vars render (see the [jenkins-builder README](https://github.com/linuxserver/docker-jenkins-builder#running-against-local-project)), but do not hand edit the output.
+
+## 5. Test it for real
+
+A change that has not been built and run is not ready. At minimum:
+
+```bash
+docker build --no-cache --pull -t lscr.io/linuxserver/<app>:test .
+docker run --rm -e PUID=1000 -e PGID=1000 -e TZ=Etc/UTC -v "$(pwd)/testconfig:/config" -p <port>:<port> lscr.io/linuxserver/<app>:test
+```
+
+Confirm the init completes (`[ls.io-init] done.`), the app comes up, and it survives a restart against an **existing** `/config`, not just a fresh one. If you touched the aarch64 Dockerfile with anything arch specific, build that too (`lscr.io/linuxserver/qemu-static`). If you, the agent, cannot run Docker, say so plainly in your output; do not claim testing that did not happen.
+
+## 6. Pull requests
+
+- **Disclose AI use.** If any part of the PR (code, description, or the investigation behind it) was produced with an AI tool, say so in the PR description: which tool, and what it was used for. Agents: add this line yourself, do not leave it to the operator. Undisclosed AI-generated PRs will be closed. Disclosure does not count against a PR; a human who cannot explain their own PR does.
+- **A human is accountable.** The person opening the PR must have read and understood every line, built and run the image, and be able to answer review questions in their own words. Do not paste maintainer questions into a chatbot and paste the answers back. Fully autonomous agents must not open PRs or issues on our repos.
+- **One focused change per PR.** The smallest diff that fixes the problem. No drive-by refactors, reformatting, comment rewording, "modernisation", dependency shuffling, or fixes for things nobody reported.
+- **No typo / wording-only PRs.** Open an issue instead and we will sort it out.
+- **Finish before you open.** Do not open drafts and iterate in public with a stream of fixup commits.
+- **Fill in the PR template honestly**, keep its structure, and tick the contributing checkbox only if it is true. Description, benefit to the wider userbase, how it was tested (real commands, real output), and links. Write it short and plain: no generated summaries, emoji headers, or bullet lists restating the diff.
+- Reference the issue with `closes #<number>` when there is one. For anything non trivial, there should be an human-submitted issue or Discord discussion first.
+- Commit messages are short, plain, imperative sentences (`Add libfoo for thumbnail support`). No conventional-commit prefixes, no emoji.
+- A PR is a proposal; it may be declined even if it works. The most common reason is section 1 of this file.
+
+## 7. Issues
+
+- GitHub issues are for reproducible bugs in **our image** and for feature requests.
+- Agents must not file issues on a user's behalf from a guess. An issue needs a real reproduction on the latest image, with mods and custom scripts disabled, the compose/run command and full container logs from startup, using the issue template.
+- Do not submit AI-generated root cause analyses or "security audits" of the image as issues. Scanner output about CVEs in upstream or distro packages is not actionable; images are rebuilt regularly to pull in distro fixes.
+- Support questions must always be submitted by a human and go to [Discord](https://linuxserver.io/discord) or the [forum](https://github.com/orgs/linuxserver/discussions); see [how to get support](https://docs.linuxserver.io/general/how-to-get-support/).
+
+## 8. Quick self check before you finish
+
+- [ ] This change benefits most users of this image, and is not a mod, custom script, or upstream issue.
+- [ ] Only hand-maintained files were edited (`Dockerfile*`, `root/**`, `readme-vars.yml`, rarely `jenkins-vars.yml`).
+- [ ] Every Dockerfile variant got the same change; packages are alphabetical.
+- [ ] Style matches the neighbouring code; shebang and shellcheck directive present; non-root / read-only guards preserved.
+- [ ] Changelog entry added at the top of `changelogs:` with today's date as `DD.MM.YY:`.
+- [ ] Image was built and run, including against an existing `/config`.
+- [ ] The diff contains nothing the task did not require.
+- [ ] PR description discloses AI use and a human has reviewed everything.

Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM ghcr.io/linuxserver/baseimage-alpine-nginx:3.20
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:3.24
 
 # set version label
 ARG BUILD_DATE
@@ -10,8 +10,10 @@ LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DA
 LABEL maintainer="nemchik"
 
 # environment settings
-ENV DHLEVEL=2048 ONLY_SUBDOMAINS=false AWS_CONFIG_FILE=/config/dns-conf/route53.ini
-ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2
+ENV DHLEVEL=2048 \
+  ONLY_SUBDOMAINS=false \
+  AWS_CONFIG_FILE=/config/dns-conf/route53.ini \
+  S6_BEHAVIOUR_IF_STAGE2_FAILS=2
 
 RUN \
   echo "**** install build packages ****" && \
@@ -27,6 +29,7 @@ RUN \
   apk add --no-cache \
     fail2ban \
     gnupg \
+    inotify-tools \
     iptables-legacy \
     memcached \
     nginx-mod-http-brotli \
@@ -46,37 +49,34 @@ RUN \
     nginx-mod-stream \
     nginx-mod-stream-geoip2 \
     nginx-vim \
-    php83-bcmath \
-    php83-bz2 \
-    php83-dom \
-    php83-exif \
-    php83-ftp \
-    php83-gd \
-    php83-gmp \
-    php83-imap \
-    php83-intl \
-    php83-ldap \
-    php83-mysqli \
-    php83-mysqlnd \
-    php83-opcache \
-    php83-pdo_mysql \
-    php83-pdo_odbc \
-    php83-pdo_pgsql \
-    php83-pdo_sqlite \
-    php83-pear \
-    php83-pecl-apcu \
-    php83-pecl-mcrypt \
-    php83-pecl-memcached \
-    php83-pecl-redis \
-    php83-pgsql \
-    php83-posix \
-    php83-soap \
-    php83-sockets \
-    php83-sodium \
-    php83-sqlite3 \
-    php83-tokenizer \
-    php83-xmlreader \
-    php83-xsl \
+    php85-bcmath \
+    php85-bz2 \
+    php85-dom \
+    php85-exif \
+    php85-ftp \
+    php85-gd \
+    php85-gmp \
+    php85-intl \
+    php85-ldap \
+    php85-mysqli \
+    php85-mysqlnd \
+    php85-pdo_mysql \
+    php85-pdo_odbc \
+    php85-pdo_pgsql \
+    php85-pdo_sqlite \
+    php85-pear \
+    php85-pecl-apcu \
+    php85-pecl-memcached \
+    php85-pecl-redis \
+    php85-pgsql \
+    php85-posix \
+    php85-soap \
+    php85-sockets \
+    php85-sodium \
+    php85-sqlite3 \
+    php85-tokenizer \
+    php85-xmlreader \
+    php85-xsl \
     whois && \
   echo "**** install certbot plugins ****" && \
   if [ -z ${CERTBOT_VERSION+x} ]; then \
@@ -86,7 +86,7 @@ RUN \
   pip install -U --no-cache-dir \
     pip \
     wheel && \
-  pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.20/ \
+  pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.24/ \
     certbot==${CERTBOT_VERSION} \
     certbot-dns-acmedns \
     certbot-dns-aliyun \
@@ -112,12 +112,14 @@ RUN \
     certbot-dns-google \
     certbot-dns-he \
     certbot-dns-hetzner \
+    certbot-dns-hetzner-cloud \
     certbot-dns-infomaniak \
     certbot-dns-inwx \
     certbot-dns-ionos \
     certbot-dns-linode \
     certbot-dns-loopia \
     certbot-dns-luadns \
+    certbot-dns-mijn-host \
     certbot-dns-namecheap \
     certbot-dns-netcup \
     certbot-dns-njalla \
@@ -148,9 +150,9 @@ RUN \
   rm -f /etc/nginx/conf.d/stream.conf && \
   echo "**** correct ip6tables legacy issue ****" && \
   rm \
-    /sbin/ip6tables && \
+    /usr/sbin/ip6tables && \
   ln -s \
-    /sbin/ip6tables-nft /sbin/ip6tables && \
+    /usr/sbin/ip6tables-nft /usr/sbin/ip6tables && \
   echo "**** remove unnecessary fail2ban filters ****" && \
   rm \
     /etc/fail2ban/jail.d/alpine-ssh.conf && \

Dockerfile.aarch64

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm64v8-3.20
+FROM ghcr.io/linuxserver/baseimage-alpine-nginx:arm64v8-3.24
 
 # set version label
 ARG BUILD_DATE
@@ -10,8 +10,10 @@ LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DA
 LABEL maintainer="nemchik"
 
 # environment settings
-ENV DHLEVEL=2048 ONLY_SUBDOMAINS=false AWS_CONFIG_FILE=/config/dns-conf/route53.ini
-ENV S6_BEHAVIOUR_IF_STAGE2_FAILS=2
+ENV DHLEVEL=2048 \
+  ONLY_SUBDOMAINS=false \
+  AWS_CONFIG_FILE=/config/dns-conf/route53.ini \
+  S6_BEHAVIOUR_IF_STAGE2_FAILS=2
 
 RUN \
   echo "**** install build packages ****" && \
@@ -27,6 +29,7 @@ RUN \
   apk add --no-cache \
     fail2ban \
     gnupg \
+    inotify-tools \
     iptables-legacy \
     memcached \
     nginx-mod-http-brotli \
@@ -46,37 +49,34 @@ RUN \
     nginx-mod-stream \
     nginx-mod-stream-geoip2 \
     nginx-vim \
-    php83-bcmath \
-    php83-bz2 \
-    php83-dom \
-    php83-exif \
-    php83-ftp \
-    php83-gd \
-    php83-gmp \
-    php83-imap \
-    php83-intl \
-    php83-ldap \
-    php83-mysqli \
-    php83-mysqlnd \
-    php83-opcache \
-    php83-pdo_mysql \
-    php83-pdo_odbc \
-    php83-pdo_pgsql \
-    php83-pdo_sqlite \
-    php83-pear \
-    php83-pecl-apcu \
-    php83-pecl-mcrypt \
-    php83-pecl-memcached \
-    php83-pecl-redis \
-    php83-pgsql \
-    php83-posix \
-    php83-soap \
-    php83-sockets \
-    php83-sodium \
-    php83-sqlite3 \
-    php83-tokenizer \
-    php83-xmlreader \
-    php83-xsl \
+    php85-bcmath \
+    php85-bz2 \
+    php85-dom \
+    php85-exif \
+    php85-ftp \
+    php85-gd \
+    php85-gmp \
+    php85-intl \
+    php85-ldap \
+    php85-mysqli \
+    php85-mysqlnd \
+    php85-pdo_mysql \
+    php85-pdo_odbc \
+    php85-pdo_pgsql \
+    php85-pdo_sqlite \
+    php85-pear \
+    php85-pecl-apcu \
+    php85-pecl-memcached \
+    php85-pecl-redis \
+    php85-pgsql \
+    php85-posix \
+    php85-soap \
+    php85-sockets \
+    php85-sodium \
+    php85-sqlite3 \
+    php85-tokenizer \
+    php85-xmlreader \
+    php85-xsl \
     whois && \
   echo "**** install certbot plugins ****" && \
   if [ -z ${CERTBOT_VERSION+x} ]; then \
@@ -86,7 +86,7 @@ RUN \
   pip install -U --no-cache-dir \
     pip \
     wheel && \
-  pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.20/ \
+  pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.24/ \
     certbot==${CERTBOT_VERSION} \
     certbot-dns-acmedns \
     certbot-dns-aliyun \
@@ -112,12 +112,14 @@ RUN \
     certbot-dns-google \
     certbot-dns-he \
     certbot-dns-hetzner \
+    certbot-dns-hetzner-cloud \
     certbot-dns-infomaniak \
     certbot-dns-inwx \
     certbot-dns-ionos \
     certbot-dns-linode \
     certbot-dns-loopia \
     certbot-dns-luadns \
+    certbot-dns-mijn-host \
     certbot-dns-namecheap \
     certbot-dns-netcup \
     certbot-dns-njalla \
@@ -148,9 +150,9 @@ RUN \
   rm -f /etc/nginx/conf.d/stream.conf && \
   echo "**** correct ip6tables legacy issue ****" && \
   rm \
-    /sbin/ip6tables && \
+    /usr/sbin/ip6tables && \
   ln -s \
-    /sbin/ip6tables-nft /sbin/ip6tables && \
+    /usr/sbin/ip6tables-nft /usr/sbin/ip6tables && \
   echo "**** remove unnecessary fail2ban filters ****" && \
   rm \
     /etc/fail2ban/jail.d/alpine-ssh.conf && \

README.md

@@ -3,9 +3,8 @@
 [![linuxserver.io](https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver_medium.png)](https://linuxserver.io)
 
 [![Blog](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=Blog)](https://blog.linuxserver.io "all the things you can do with our containers including How-To guides, opinions and much more!")
-[![Discord](https://img.shields.io/discord/354974912613449730.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=Discord&logo=discord)](https://discord.gg/YWrKVTn "realtime support / chat with the community and the team.")
-[![Discourse](https://img.shields.io/discourse/https/discourse.linuxserver.io/topics.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&logo=discourse)](https://discourse.linuxserver.io "post on our community forum.")
-[![Fleet](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=Fleet)](https://fleet.linuxserver.io "an online web interface which displays all of our maintained images.")
+[![Discord](https://img.shields.io/discord/354974912613449730.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=Discord&logo=discord)](https://linuxserver.io/discord "realtime support / chat with the community and the team.")
+[![Discussions](https://img.shields.io/badge/Github-Discussions-94398d?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&logo=github)](https://github.com/orgs/linuxserver/discussions "post on our community forum.")
 [![GitHub](https://img.shields.io/static/v1.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=linuxserver.io&message=GitHub&logo=github)](https://github.com/linuxserver "view the source for all of our repositories.")
 [![Open Collective](https://img.shields.io/opencollective/all/linuxserver.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=Supporters&logo=open%20collective)](https://opencollective.com/linuxserver "please consider helping us by either donating or contributing to our budget")
 
@@ -20,9 +19,8 @@ The [LinuxServer.io](https://linuxserver.io) team brings you another container r
 Find us at:
 
 * [Blog](https://blog.linuxserver.io) - all the things you can do with our containers including How-To guides, opinions and much more!
-* [Discord](https://discord.gg/YWrKVTn) - realtime support / chat with the community and the team.
-* [Discourse](https://discourse.linuxserver.io) - post on our community forum.
-* [Fleet](https://fleet.linuxserver.io) - an online web interface which displays all of our maintained images.
+* [Discord](https://linuxserver.io/discord) - realtime support / chat with the community and the team.
+* [Discussions](https://github.com/orgs/linuxserver/discussions) - post on our community forum.
 * [GitHub](https://github.com/linuxserver) - view the source for all of our repositories.
 * [Open Collective](https://opencollective.com/linuxserver) - please consider helping us by either donating or contributing to our budget
 
@@ -37,7 +35,6 @@ Find us at:
 [![Docker Pulls](https://img.shields.io/docker/pulls/linuxserver/swag.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=pulls&logo=docker)](https://hub.docker.com/r/linuxserver/swag)
 [![Docker Stars](https://img.shields.io/docker/stars/linuxserver/swag.svg?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=stars&logo=docker)](https://hub.docker.com/r/linuxserver/swag)
 [![Jenkins Build](https://img.shields.io/jenkins/build?labelColor=555555&logoColor=ffffff&style=for-the-badge&jobUrl=https%3A%2F%2Fci.linuxserver.io%2Fjob%2FDocker-Pipeline-Builders%2Fjob%2Fdocker-swag%2Fjob%2Fmaster%2F&logo=jenkins)](https://ci.linuxserver.io/job/Docker-Pipeline-Builders/job/docker-swag/job/master/)
-[![LSIO CI](https://img.shields.io/badge/dynamic/yaml?color=94398d&labelColor=555555&logoColor=ffffff&style=for-the-badge&label=CI&query=CI&url=https%3A%2F%2Fci-tests.linuxserver.io%2Flinuxserver%2Fswag%2Flatest%2Fci-status.yml)](https://ci-tests.linuxserver.io/linuxserver/swag/latest/index.html)
 
 SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.
 
@@ -55,7 +52,6 @@ The architectures supported by this image are:
 | :----: | :----: | ---- |
 | x86-64 | ✅ | amd64-\<version tag\> |
 | arm64 | ✅ | arm64v8-\<version tag\> |
-| armhf | ❌ | |
 
 ## Application Setup
 
@@ -71,8 +67,8 @@ The architectures supported by this image are:
     1. Certs that only cover your main subdomain (ie. `yoursubdomain.duckdns.org`, leave the `SUBDOMAINS` variable empty)
     2. Certs that cover sub-subdomains of your main subdomain (ie. `*.yoursubdomain.duckdns.org`, set the `SUBDOMAINS` variable to `wildcard`)
 * `--cap-add=NET_ADMIN` is required for fail2ban to modify iptables
-* After setup, navigate to `https://yourdomain.url` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default.conf`).
-* Certs are checked nightly and if expiration is within 30 days, renewal is attempted. If your cert is about to expire in less than 30 days, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing. It is recommended to input your e-mail in docker parameters so you receive expiration notices from Let's Encrypt in those circumstances.
+* After setup, navigate to `https://example.com` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default.conf`).
+* Certs are checked twice daily using ACME Renewal Information (ARI) to determine the optimal renewal window. If your cert is about to expire, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing.
 
 ### Certbot Plugins
 
@@ -100,7 +96,7 @@ It is recommended to attempt obtaining a certificate with `STAGING=true` first t
 ### Site config and reverse proxy
 
 * The default site config resides at `/config/nginx/site-confs/default.conf`. Feel free to modify this file, and you can add other conf files to this directory. However, if you delete the `default` file, a new default will be created on container start.
-* Preset reverse proxy config files are added for popular apps. See the `README.md` file under `/config/nginx/proxy_confs` for instructions on how to enable them. The preset confs reside in and get imported from [this repo](https://github.com/linuxserver/reverse-proxy-confs).
+* Preset reverse proxy config files are added for popular apps. See the `README.md` file under `/config/nginx/proxy-confs` for instructions on how to enable them. The preset confs reside in and get imported from [this repo](https://github.com/linuxserver/reverse-proxy-confs).
 * If you wish to hide your site from search engine crawlers, you may find it useful to add this configuration line to your site config, within the server block, above the line where ssl.conf is included
 `add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";`
 This will *ask* Google et al not to index and list your site. Be careful with this, as you will eventually be de-listed if you leave this line in on a site you wish to be present on search engines
@@ -130,7 +126,7 @@ This will *ask* Google et al not to index and list your site. Be careful with th
 * You can check which jails are active via `docker exec -it swag fail2ban-client status`
 * You can check the status of a specific jail via `docker exec -it swag fail2ban-client status <jail name>`
 * You can unban an IP via `docker exec -it swag fail2ban-client set <jail name> unbanip <IP>`
-* A list of commands can be found here: <https://www.fail2ban.org/wiki/index.php/Commands>
+* A list of commands for fail2ban-client can be found [here](https://manpages.ubuntu.com/manpages/noble/man1/fail2ban-client.1.html)
 
 ### Updating configs
 
@@ -146,14 +142,36 @@ This will *ask* Google et al not to index and list your site. Be careful with th
 * Proxy sample files WILL be updated, however your renamed (enabled) proxy files will not.
 * You can check the new sample and adjust your active config as needed.
 
+### QUIC support
+
+This image supports QUIC (also known as HTTP/3) but it must be explicitly enabled in each proxy conf, and the default conf, because if the listener is enabled and you don't expose 443/UDP, it can break connections with some browsers.
+
+To enable QUIC, expose 443/UDP to your clients, then uncomment both QUIC listeners in all of your active proxy confs, as well as the default conf, and restart the container.
+
+You should also uncomment the `Alt-Svc` header in your `ssl.conf` so that browsers are aware that you offer QUIC connectivity.
+
+It is [recommended](https://quic-go.net/docs/quic/optimizations/#udp-buffer-sizes) to increase the UDP send/recieve buffer **on the host** by setting the `net.core.rmem_max` and `net.core.wmem_max` sysctls. Suggested values are 4-16Mb (4194304-16777216 bytes). For persistence between reboots use `/etc/sysctl.d/`.
+
 ### Migration from the old `linuxserver/letsencrypt` image
 
 Please follow the instructions [on this blog post](https://www.linuxserver.io/blog/2020-08-21-introducing-swag#migrate).
 
+## Read-Only Operation
+
+This image can be run with a read-only container filesystem. For details please [read the docs](https://docs.linuxserver.io/misc/read-only/).
+
+### Caveats
+
+* `/tmp` must be mounted to tmpfs
+* fail2ban will not be available
+
 ## Usage
 
 To help you get started creating a container from this image you can either use docker-compose or the docker cli.
 
+>[!NOTE]
+>Unless a parameter is flagged as 'optional', it is *mandatory* and a value must be provided.
+
 ### docker-compose (recommended, [click here for more info](https://docs.linuxserver.io/general/docker-compose))
 
 ```yaml
@@ -168,21 +186,26 @@ services:
       - PUID=1000
       - PGID=1000
       - TZ=Etc/UTC
-      - URL=yourdomain.url
+      - URL=example.com
       - VALIDATION=http
       - SUBDOMAINS=www, #optional
       - CERTPROVIDER= #optional
+      - CERT_PROFILE= #optional
       - DNSPLUGIN=cloudflare #optional
       - PROPAGATION= #optional
       - EMAIL= #optional
       - ONLY_SUBDOMAINS=false #optional
       - EXTRA_DOMAINS= #optional
       - STAGING=false #optional
+      - DISABLE_F2B= #optional
+      - SWAG_AUTORELOAD= #optional
+      - SWAG_AUTORELOAD_WATCHLIST= #optional
     volumes:
       - /path/to/swag/config:/config
     ports:
       - 443:443
       - 80:80 #optional
+      - 443:443/udp #optional
     restart: unless-stopped
 ```
 
@@ -195,18 +218,23 @@ docker run -d \
   -e PUID=1000 \
   -e PGID=1000 \
   -e TZ=Etc/UTC \
-  -e URL=yourdomain.url \
+  -e URL=example.com \
   -e VALIDATION=http \
   -e SUBDOMAINS=www, `#optional` \
   -e CERTPROVIDER= `#optional` \
+  -e CERT_PROFILE= `#optional` \
   -e DNSPLUGIN=cloudflare `#optional` \
   -e PROPAGATION= `#optional` \
   -e EMAIL= `#optional` \
   -e ONLY_SUBDOMAINS=false `#optional` \
   -e EXTRA_DOMAINS= `#optional` \
   -e STAGING=false `#optional` \
+  -e DISABLE_F2B= `#optional` \
+  -e SWAG_AUTORELOAD= `#optional` \
+  -e SWAG_AUTORELOAD_WATCHLIST= `#optional` \
   -p 443:443 \
   -p 80:80 `#optional` \
+  -p 443:443/udp `#optional` \
   -v /path/to/swag/config:/config \
   --restart unless-stopped \
   lscr.io/linuxserver/swag:latest
@@ -218,22 +246,29 @@ Containers are configured using parameters passed at runtime (such as those abov
 
 | Parameter | Function |
 | :----: | --- |
-| `-p 443` | Https port |
-| `-p 80` | Http port (required for http validation and http -> https redirect) |
+| `-p 443:443` | HTTPS port |
+| `-p 80` | HTTP port (required for HTTP validation and HTTP -> HTTPS redirect) |
+| `-p 443/udp` | QUIC (HTTP/3) port. Must be enabled in the default and proxy confs. |
 | `-e PUID=1000` | for UserID - see below for explanation |
 | `-e PGID=1000` | for GroupID - see below for explanation |
 | `-e TZ=Etc/UTC` | specify a timezone to use, see this [list](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List). |
-| `-e URL=yourdomain.url` | Top url you have control over (`customdomain.com` if you own it, or `customsubdomain.ddnsprovider.com` if dynamic dns). |
+| `-e URL=example.com` | Top url you have control over (e.g. `example.com` if you own it, or `customsubdomain.example.com` if dynamic dns). |
 | `-e VALIDATION=http` | Certbot validation method to use, options are `http` or `dns` (`dns` method also requires `DNSPLUGIN` variable set). |
 | `-e SUBDOMAINS=www,` | Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this *exactly* to `wildcard` (wildcard cert is available via `dns` validation only) |
 | `-e CERTPROVIDER=` | Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt. |
-| `-e DNSPLUGIN=cloudflare` | Required if `VALIDATION` is set to `dns`. Options are `acmedns`, `aliyun`, `azure`, `bunny`, `cloudflare`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `do`, `domeneshop`, `dreamhost`, `duckdns`, `dynu`, `freedns`, `gandi`, `gehirn`, `glesys`, `godaddy`, `google`, `he`, `hetzner`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `namecheap`, `netcup`, `njalla`, `nsone`, `ovh`, `porkbun`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip`, and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`. |
+| `-e CERT_PROFILE=` | Optionally define a cert profile to use for cert generation. This is useful if you want to use a custom cert profile instead of the default one. Currently only supported for Let's Encrypt. See https://letsencrypt.org/docs/profiles/  |
+| `-e DNSPLUGIN=cloudflare` | Required if `VALIDATION` is set to `dns`. Options are `acmedns`, `aliyun`, `azure`, `bunny`, `cloudflare`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `do`, `domeneshop`, `dreamhost`, `duckdns`, `dynu`, `freedns`, `gandi`, `gehirn`, `glesys`, `godaddy`, `google`, `he`, `hetzner`, `hetzner-cloud`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `mijn-host`, `namecheap`, `netcup`, `njalla`, `nsone`, `ovh`, `porkbun`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip`, and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`. |
 | `-e PROPAGATION=` | Optionally override (in seconds) the default propagation time for the dns plugins. |
 | `-e EMAIL=` | Optional e-mail address used for cert expiration notifications (Required for ZeroSSL). |
 | `-e ONLY_SUBDOMAINS=false` | If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true` |
-| `-e EXTRA_DOMAINS=` | Additional fully qualified domain names (comma separated, no spaces) ie. `extradomain.com,subdomain.anotherdomain.org,*.anotherdomain.org` |
+| `-e EXTRA_DOMAINS=` | Additional fully qualified domain names (comma separated, no spaces) ie. `example.net,subdomain.example.net,*.example.org` |
 | `-e STAGING=false` | Set to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes. |
+| `-e DISABLE_F2B=` | Set to `true` to disable the Fail2ban service in the container, if you're already running it elsewhere or using a different IPS. |
+| `-e SWAG_AUTORELOAD=` | Set to `true` to enable automatic reloading of confs on change without stopping/restarting nginx. Your filesystem must support inotify. This functionality was previously offered [via mod](https://github.com/linuxserver/docker-mods/tree/swag-auto-reload). |
+| `-e SWAG_AUTORELOAD_WATCHLIST=` | A [pipe](https://en.wikipedia.org/wiki/Vertical_bar)-separated list of additional folders for auto reload to watch in addition to `/config/nginx` |
 | `-v /config` | Persistent config files |
+| `--read-only=true` | Run container with a read-only filesystem. Please [read the docs](https://docs.linuxserver.io/misc/read-only/). |
+| `--cap-add=NET_ADMIN` | Required for fail2Ban to be able to modify iptables rules. |
 
 ### Portainer notice
 
@@ -391,16 +426,29 @@ docker build \
   -t lscr.io/linuxserver/swag:latest .
 ```
 
-The ARM variants can be built on x86_64 hardware using `multiarch/qemu-user-static`
+The ARM variants can be built on x86_64 hardware and vice versa using `lscr.io/linuxserver/qemu-static`
 
 ```bash
-docker run --rm --privileged multiarch/qemu-user-static:register --reset
+docker run --rm --privileged lscr.io/linuxserver/qemu-static --reset
 ```
 
 Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64`.
 
 ## Versions
 
+* **20.10.26:** - [Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) proxy.conf, authelia-server.conf, authentik-server.conf, tinyauth-server.conf - Update Nginx configuration to replace $http_host with $host$is_request_port$request_port for better compatibility.
+* **09.09.26:** - Use new X-Tinyauth-Location header in Tinyauth locations and remove duplicate auth module headers.
+* **19.07.26:** - Rebase to Alpine 3.24 with PHP 8.5.
+* **10.07.26:** - Add support for Let's Encrypt cert profiles. Run certbot twice daily with a random delay.
+* **19.06.26:** - Add support for mijn.host dns validation.
+* **01.06.26:** - Remove obsolete old cert check logic.
+* **23.01.26:** - Reorder init to fix proxy conf version checks.
+* **21.12.25:** - Add support for hetzner-cloud dns validation.
+* **04.11.25:** - Switch default Gandi credentials from API Key to Token, allow DNS propagation time for Azure DNS plugin.
+* **18.07.25:** - Rebase to Alpine 3.22 with PHP 8.4. Add QUIC support. Drop PHP bindings for mcrypt as it is no longer maintained.
+* **05.05.25:** - Disable Certbot's built in log rotation.
+* **19.01.25:** - Add [Auto Reload](https://github.com/linuxserver/docker-mods/tree/swag-auto-reload) functionality to SWAG.
+* **17.12.24:** - Rebase to Alpine 3.21.
 * **21.10.24:** - Fix naming issue with Dynu plugin. If you are using Dynu, please make sure your credentials are set in /config/dns-conf/dynu.ini and your DNSPLUGIN variable is set to dynu (not dynudns).
 * **30.08.24:** - Fix zerossl cert revocation.
 * **24.07.14:** - Rebase to Alpine 3.20. Remove deprecated Google Domains certbot plugin. Existing users should update their nginx confs to avoid http2 deprecation warnings.

jenkins-vars.yml

@@ -17,12 +17,12 @@ repo_vars:
   - PR_DOCKERHUB_IMAGE = 'lspipepr/swag'
   - DIST_IMAGE = 'alpine'
   - MULTIARCH='true'
-  - CI='true'
+  - CI='false'
   - CI_WEB='false'
   - CI_PORT='80'
   - CI_SSL='false'
   - CI_DELAY='30'
-  - CI_DOCKERENV='TEST_RUN=1'
+  - CI_DOCKERENV=''
   - CI_AUTH=''
   - CI_WEBPATH=''
 sponsor_links:

package_versions.txt

@@ -1,363 +1,375 @@
-NAME                            VERSION                TYPE                    
-Simple Launcher                 1.1.0.14               dotnet  (+5 duplicates)  
-acme                            2.11.0                 python                   
-alpine-baselayout               3.6.5-r0               apk                      
-alpine-baselayout-data          3.6.5-r0               apk                      
-alpine-keys                     2.4-r1                 apk                      
-alpine-release                  3.20.3-r0              apk                      
-aom-libs                        3.9.1-r0               apk                      
-apache2-utils                   2.4.62-r0              apk                      
-apk-tools                       2.14.4-r0              apk                      
-apr                             1.7.5-r0               apk                      
-apr-util                        1.6.3-r1               apk                      
-argon2-libs                     20190702-r5            apk                      
-attrs                           24.2.0                 python                   
-autocommand                     2.2.2                  python                   
-azure-common                    1.1.28                 python                   
-azure-core                      1.31.0                 python                   
-azure-identity                  1.19.0                 python                   
-azure-mgmt-core                 1.4.0                  python                   
-azure-mgmt-dns                  8.2.0                  python                   
-backports-tarfile               1.2.0                  python                   
-bash                            5.2.26-r0              apk                      
-beautifulsoup4                  4.12.3                 python                   
-boto3                           1.35.45                python                   
-botocore                        1.35.45                python                   
-brotli-libs                     1.1.0-r2               apk                      
-bs4                             0.0.2                  python                   
-busybox                         1.36.1-r29             apk                      
-busybox-binsh                   1.36.1-r29             apk                      
-c-ares                          1.28.1-r0              apk                      
-c-client                        2007f-r15              apk                      
-ca-certificates                 20240705-r0            apk                      
-ca-certificates-bundle          20240705-r0            apk                      
-cachetools                      5.5.0                  python                   
-catatonit                       0.2.0-r0               apk                      
-certbot                         2.11.0                 python                   
-certbot-dns-acmedns             0.1.0                  python                   
-certbot-dns-aliyun              2.0.0                  python                   
-certbot-dns-azure               2.5.0                  python                   
-certbot-dns-bunny               0.0.9                  python                   
-certbot-dns-cloudflare          2.11.0                 python                   
-certbot-dns-cpanel              0.4.0                  python                   
-certbot-dns-desec               1.2.1                  python                   
-certbot-dns-digitalocean        2.11.0                 python                   
-certbot-dns-directadmin         1.0.4                  python                   
-certbot-dns-dnsimple            2.11.0                 python                   
-certbot-dns-dnsmadeeasy         2.11.0                 python                   
-certbot-dns-dnspod              0.1.0                  python                   
-certbot-dns-do                  0.31.0                 python                   
-certbot-dns-domeneshop          0.2.9                  python                   
-certbot-dns-dreamhost           1.0                    python                   
-certbot-dns-duckdns             1.3                    python                   
-certbot-dns-dynudns             0.0.6                  python                   
-certbot-dns-freedns             0.2.0                  python                   
-certbot-dns-gehirn              2.11.0                 python                   
-certbot-dns-glesys              2.1.0                  python                   
-certbot-dns-godaddy             2.8.0                  python                   
-certbot-dns-google              2.11.0                 python                   
-certbot-dns-he                  1.0.0                  python                   
-certbot-dns-hetzner             2.0.1                  python                   
-certbot-dns-infomaniak          0.2.2                  python                   
-certbot-dns-inwx                2.2.0                  python                   
-certbot-dns-ionos               2024.10.20             python                   
-certbot-dns-linode              2.11.0                 python                   
-certbot-dns-loopia              1.0.1                  python                   
-certbot-dns-luadns              2.11.0                 python                   
-certbot-dns-namecheap           1.0.0                  python                   
-certbot-dns-netcup              1.4.3                  python                   
-certbot-dns-njalla              1.0.0                  python                   
-certbot-dns-nsone               2.11.0                 python                   
-certbot-dns-ovh                 2.11.0                 python                   
-certbot-dns-porkbun             0.8                    python                   
-certbot-dns-rfc2136             2.11.0                 python                   
-certbot-dns-route53             2.11.0                 python                   
-certbot-dns-sakuracloud         2.11.0                 python                   
-certbot-dns-standalone          1.1                    python                   
-certbot-dns-transip             0.5.2                  python                   
-certbot-dns-vultr               1.1.0                  python                   
-certbot-plugin-gandi            1.5.0                  python                   
-certifi                         2024.8.30              python                   
-cffi                            1.17.1                 python                   
-charset-normalizer              3.4.0                  python                   
-cloudflare                      2.19.4                 python                   
-composer                        2.7.9                  binary                   
-configargparse                  1.7                    python                   
-configobj                       5.0.9                  python                   
-coreutils                       9.5-r1                 apk                      
-coreutils-env                   9.5-r1                 apk                      
-coreutils-fmt                   9.5-r1                 apk                      
-coreutils-sha512sum             9.5-r1                 apk                      
-cryptography                    43.0.3                 python                   
-curl                            8.9.1-r2               apk                      
-distro                          1.9.0                  python                   
-dns-lexicon                     3.18.0                 python                   
-dnslib                          0.9.25                 python                   
-dnspython                       2.7.0                  python                   
-domeneshop                      0.4.4                  python                   
-fail2ban                        1.1.0                  python                   
-fail2ban                        1.1.0-r0               apk                      
-fail2ban-pyc                    1.1.0-r0               apk                      
-filelock                        3.16.1                 python                   
-findutils                       4.9.0-r5               apk                      
-fontconfig                      2.15.0-r1              apk                      
-freetype                        2.13.2-r0              apk                      
-future                          1.0.0                  python                   
-gdbm                            1.23-r1                apk                      
-git                             2.45.2-r0              apk                      
-git-init-template               2.45.2-r0              apk                      
-git-perl                        2.45.2-r0              apk                      
-gmp                             6.3.0-r1               apk                      
-gnupg                           2.4.5-r0               apk                      
-gnupg-dirmngr                   2.4.5-r0               apk                      
-gnupg-gpgconf                   2.4.5-r0               apk                      
-gnupg-keyboxd                   2.4.5-r0               apk                      
-gnupg-utils                     2.4.5-r0               apk                      
-gnupg-wks-client                2.4.5-r0               apk                      
-gnutls                          3.8.5-r0               apk                      
-google-api-core                 2.21.0                 python                   
-google-api-python-client        2.149.0                python                   
-google-auth                     2.35.0                 python                   
-google-auth-httplib2            0.2.0                  python                   
-googleapis-common-protos        1.65.0                 python                   
-gpg                             2.4.5-r0               apk                      
-gpg-agent                       2.4.5-r0               apk                      
-gpg-wks-server                  2.4.5-r0               apk                      
-gpgsm                           2.4.5-r0               apk                      
-gpgv                            2.4.5-r0               apk                      
-httplib2                        0.22.0                 python                   
-icu-data-en                     74.2-r0                apk                      
-icu-libs                        74.2-r0                apk                      
-idna                            3.10                   python                   
-importlib-metadata              8.0.0                  python                   
-importlib-resources             6.4.0                  python                   
-inflect                         7.3.1                  python                   
-iptables                        1.8.10-r3              apk                      
-iptables-legacy                 1.8.10-r3              apk                      
-isodate                         0.7.2                  python                   
-jaraco-collections              5.1.0                  python                   
-jaraco-context                  5.3.0                  python                   
-jaraco-functools                4.0.1                  python                   
-jaraco-text                     3.12.1                 python                   
-jmespath                        1.0.1                  python                   
-josepy                          1.14.0                 python                   
-jq                              1.7.1-r0               apk                      
-jsonlines                       4.0.0                  python                   
-jsonpickle                      3.3.0                  python                   
-libacl                          2.3.2-r0               apk                      
-libassuan                       2.5.7-r0               apk                      
-libattr                         2.5.2-r0               apk                      
-libavif                         1.0.4-r0               apk                      
-libbsd                          0.12.2-r0              apk                      
-libbz2                          1.0.8-r6               apk                      
-libcrypto3                      3.3.2-r1               apk                      
-libcurl                         8.9.1-r2               apk                      
-libdav1d                        1.4.2-r0               apk                      
-libedit                         20240517.3.1-r0        apk                      
-libevent                        2.1.12-r7              apk                      
-libexpat                        2.6.3-r0               apk                      
-libffi                          3.4.6-r0               apk                      
-libgcc                          13.2.1_git20240309-r0  apk                      
-libgcrypt                       1.10.3-r0              apk                      
-libgd                           2.3.3-r9               apk                      
-libgpg-error                    1.49-r0                apk                      
-libice                          1.1.1-r6               apk                      
-libidn2                         2.3.7-r0               apk                      
-libintl                         0.22.5-r0              apk                      
-libip4tc                        1.8.10-r3              apk                      
-libip6tc                        1.8.10-r3              apk                      
-libjpeg-turbo                   3.0.3-r0               apk                      
-libksba                         1.6.6-r0               apk                      
-libldap                         2.6.8-r0               apk                      
-libmaxminddb-libs               1.9.1-r0               apk                      
-libmcrypt                       2.5.8-r10              apk                      
-libmd                           1.1.0-r0               apk                      
-libmemcached-libs               1.1.4-r1               apk                      
-libmnl                          1.0.5-r2               apk                      
-libncursesw                     6.4_p20240420-r1       apk                      
-libnftnl                        1.2.6-r0               apk                      
-libpanelw                       6.4_p20240420-r1       apk                      
-libpng                          1.6.44-r0              apk                      
-libpq                           16.3-r0                apk                      
-libproc2                        4.0.4-r0               apk                      
-libpsl                          0.21.5-r1              apk                      
-libsasl                         2.1.28-r6              apk                      
-libseccomp                      2.5.5-r1               apk                      
-libsharpyuv                     1.3.2-r0               apk                      
-libsm                           1.2.4-r4               apk                      
-libsodium                       1.0.19-r0              apk                      
-libssl3                         3.3.2-r1               apk                      
-libstdc++                       13.2.1_git20240309-r0  apk                      
-libtasn1                        4.19.0-r2              apk                      
-libunistring                    1.2-r0                 apk                      
-libuuid                         2.40.1-r1              apk                      
-libwebp                         1.3.2-r0               apk                      
-libx11                          1.8.9-r1               apk                      
-libxau                          1.0.11-r4              apk                      
-libxcb                          1.16.1-r0              apk                      
-libxdmcp                        1.1.5-r1               apk                      
-libxext                         1.3.6-r2               apk                      
-libxml2                         2.12.7-r0              apk                      
-libxpm                          3.5.17-r0              apk                      
-libxslt                         1.1.39-r1              apk                      
-libxt                           1.3.0-r5               apk                      
-libxtables                      1.8.10-r3              apk                      
-libzip                          1.10.1-r0              apk                      
-linux-pam                       1.6.0-r0               apk                      
-logrotate                       3.21.0-r1              apk                      
-loopialib                       0.2.0                  python                   
-lxml                            5.3.0                  python                   
-lz4-libs                        1.9.4-r5               apk                      
-memcached                       1.6.27-r0              apk                      
-mock                            5.1.0                  python                   
-more-itertools                  10.3.0                 python                   
-mpdecimal                       4.0.0-r0               apk                      
-msal                            1.31.0                 python                   
-msal-extensions                 1.2.0                  python                   
-musl                            1.2.5-r0               apk                      
-musl-utils                      1.2.5-r0               apk                      
-my-test-package                 1.0                    python                   
-nano                            8.0-r0                 apk                      
-ncurses-terminfo-base           6.4_p20240420-r1       apk                      
-netcat-openbsd                  1.226-r0               apk                      
-nettle                          3.9.1-r0               apk                      
-nghttp2-libs                    1.62.1-r0              apk                      
-nginx                           1.26.2-r0              apk                      
-nginx-mod-devel-kit             1.26.2-r0              apk                      
-nginx-mod-http-brotli           1.26.2-r0              apk                      
-nginx-mod-http-dav-ext          1.26.2-r0              apk                      
-nginx-mod-http-echo             1.26.2-r0              apk                      
-nginx-mod-http-fancyindex       1.26.2-r0              apk                      
-nginx-mod-http-geoip2           1.26.2-r0              apk                      
-nginx-mod-http-headers-more     1.26.2-r0              apk                      
-nginx-mod-http-image-filter     1.26.2-r0              apk                      
-nginx-mod-http-perl             1.26.2-r0              apk                      
-nginx-mod-http-redis2           1.26.2-r0              apk                      
-nginx-mod-http-set-misc         1.26.2-r0              apk                      
-nginx-mod-http-upload-progress  1.26.2-r0              apk                      
-nginx-mod-http-xslt-filter      1.26.2-r0              apk                      
-nginx-mod-mail                  1.26.2-r0              apk                      
-nginx-mod-rtmp                  1.26.2-r0              apk                      
-nginx-mod-stream                1.26.2-r0              apk                      
-nginx-mod-stream-geoip2         1.26.2-r0              apk                      
-nginx-vim                       1.26.2-r0              apk                      
-npth                            1.6-r4                 apk                      
-oniguruma                       6.9.9-r0               apk                      
-openssl                         3.3.2-r1               apk                      
-p11-kit                         0.25.3-r0              apk                      
-packaging                       24.1                   python                   
-parsedatetime                   2.6                    python                   
-pcre                            8.45-r3                apk                      
-pcre2                           10.43-r0               apk                      
-perl                            5.38.2-r0              apk                      
-perl-error                      0.17029-r2             apk                      
-perl-git                        2.45.2-r0              apk                      
-php83                           8.3.12-r0              apk                      
-php83-bcmath                    8.3.12-r0              apk                      
-php83-bz2                       8.3.12-r0              apk                      
-php83-common                    8.3.12-r0              apk                      
-php83-ctype                     8.3.12-r0              apk                      
-php83-curl                      8.3.12-r0              apk                      
-php83-dom                       8.3.12-r0              apk                      
-php83-exif                      8.3.12-r0              apk                      
-php83-fileinfo                  8.3.12-r0              apk                      
-php83-fpm                       8.3.12-r0              apk                      
-php83-ftp                       8.3.12-r0              apk                      
-php83-gd                        8.3.12-r0              apk                      
-php83-gmp                       8.3.12-r0              apk                      
-php83-iconv                     8.3.12-r0              apk                      
-php83-imap                      8.3.12-r0              apk                      
-php83-intl                      8.3.12-r0              apk                      
-php83-ldap                      8.3.12-r0              apk                      
-php83-mbstring                  8.3.12-r0              apk                      
-php83-mysqli                    8.3.12-r0              apk                      
-php83-mysqlnd                   8.3.12-r0              apk                      
-php83-opcache                   8.3.12-r0              apk                      
-php83-openssl                   8.3.12-r0              apk                      
-php83-pdo                       8.3.12-r0              apk                      
-php83-pdo_mysql                 8.3.12-r0              apk                      
-php83-pdo_odbc                  8.3.12-r0              apk                      
-php83-pdo_pgsql                 8.3.12-r0              apk                      
-php83-pdo_sqlite                8.3.12-r0              apk                      
-php83-pear                      8.3.12-r0              apk                      
-php83-pecl-apcu                 5.1.23-r0              apk                      
-php83-pecl-igbinary             3.2.15-r0              apk                      
-php83-pecl-mcrypt               1.0.7-r0               apk                      
-php83-pecl-memcached            3.3.0-r0               apk                      
-php83-pecl-msgpack              2.2.0-r2               apk                      
-php83-pecl-redis                6.1.0-r0               apk                      
-php83-pgsql                     8.3.12-r0              apk                      
-php83-phar                      8.3.12-r0              apk                      
-php83-posix                     8.3.12-r0              apk                      
-php83-session                   8.3.12-r0              apk                      
-php83-simplexml                 8.3.12-r0              apk                      
-php83-soap                      8.3.12-r0              apk                      
-php83-sockets                   8.3.12-r0              apk                      
-php83-sodium                    8.3.12-r0              apk                      
-php83-sqlite3                   8.3.12-r0              apk                      
-php83-tokenizer                 8.3.12-r0              apk                      
-php83-xml                       8.3.12-r0              apk                      
-php83-xmlreader                 8.3.12-r0              apk                      
-php83-xmlwriter                 8.3.12-r0              apk                      
-php83-xsl                       8.3.12-r0              apk                      
-php83-zip                       8.3.12-r0              apk                      
-pinentry                        1.3.0-r0               apk                      
-pip                             24.2                   python                   
-pkb-client                      1.2                    python                   
-platformdirs                    4.2.2                  python                   
-popt                            1.19-r3                apk                      
-portalocker                     2.10.1                 python                   
-procps-ng                       4.0.4-r0               apk                      
-proto-plus                      1.24.0                 python                   
-protobuf                        5.28.2                 python                   
-pyacmedns                       0.4                    python                   
-pyasn1                          0.6.1                  python                   
-pyasn1-modules                  0.4.1                  python                   
-pyc                             3.12.7-r0              apk                      
-pycparser                       2.22                   python                   
-pyjwt                           2.9.0                  python                   
-pynamecheap                     0.0.3                  python                   
-pyopenssl                       24.2.1                 python                   
-pyotp                           2.9.0                  python                   
-pyparsing                       3.2.0                  python                   
-pyrfc3339                       1.1                    python                   
-python-dateutil                 2.9.0.post0            python                   
-python-digitalocean             1.17.0                 python                   
-python-transip                  0.6.0                  python                   
-python3                         3.12.7-r0              apk                      
-python3-pyc                     3.12.7-r0              apk                      
-python3-pycache-pyc0            3.12.7-r0              apk                      
-pytz                            2024.2                 python                   
-pyyaml                          6.0.2                  python                   
-readline                        8.2.10-r0              apk                      
-requests                        2.32.3                 python                   
-requests-file                   2.1.0                  python                   
-requests-mock                   1.12.1                 python                   
-rsa                             4.9                    python                   
-s3transfer                      0.10.3                 python                   
-scanelf                         1.3.7-r2               apk                      
-setuptools                      75.2.0                 python                   
-shadow                          4.15.1-r0              apk                      
-six                             1.16.0                 python                   
-skalibs                         2.14.1.1-r0            apk                      
-soupsieve                       2.6                    python                   
-sqlite-libs                     3.45.3-r1              apk                      
-ssl_client                      1.36.1-r29             apk                      
-tiff                            4.6.0t-r0              apk                      
-tldextract                      5.1.2                  python                   
-tomli                           2.0.1                  python                   
-typeguard                       4.3.0                  python                   
-typing-extensions               4.12.2                 python  (+1 duplicate)   
-tzdata                          2024b-r0               apk                      
-unixodbc                        2.3.12-r0              apk                      
-uritemplate                     4.1.1                  python                   
-urllib3                         2.2.3                  python                   
-utmps-libs                      0.1.2.2-r1             apk                      
-wheel                           0.43.0                 python                   
-wheel                           0.44.0                 python                   
-whois                           5.5.23-r0              apk                      
-xz-libs                         5.6.2-r0               apk                      
-zipp                            3.19.2                 python                   
-zlib                            1.3.1-r1               apk                      
-zope-interface                  7.1.0                  python                   
-zstd-libs                       1.5.6-r0               apk                      
+NAME                            VERSION           TYPE                    
+Simple Launcher                 1.1.0.14          binary  (+5 duplicates)  
+acl-libs                        2.3.2-r1          apk                      
+acme                            5.8.0             python                   
+alpine-baselayout               3.7.2-r1          apk                      
+alpine-baselayout-data          3.7.2-r1          apk                      
+alpine-keys                     2.6-r0            apk                      
+alpine-release                  3.24.2-r0         apk                      
+annotated-types                 0.8.0             python                   
+anyio                           4.15.1            python                   
+aom-libs                        3.14.1-r0         apk                      
+apache2-utils                   2.4.69-r0         apk                      
+apk-tools                       3.0.8-r0          apk                      
+apr                             1.7.6-r0          apk                      
+apr-util                        1.6.4-r0          apk                      
+argon2-libs                     20190702-r5       apk                      
+autocommand                     2.2.2             python                   
+azure-common                    1.1.28            python                   
+azure-core                      1.41.0            python                   
+azure-identity                  1.26.0            python                   
+azure-mgmt-core                 1.6.0             python                   
+azure-mgmt-dns                  9.0.0             python                   
+backports-tarfile               1.2.0             python                   
+bash                            5.3.9-r1          apk                      
+beautifulsoup4                  4.15.0            python                   
+boto3                           1.43.115          python                   
+botocore                        1.43.115          python                   
+brotli-libs                     1.2.0-r1          apk                      
+bs4                             0.0.2             python                   
+busybox                         1.37.0-r31        apk                      
+busybox-binsh                   1.37.0-r31        apk                      
+c-ares                          1.34.8-r0         apk                      
+ca-certificates                 20260909-r0       apk                      
+ca-certificates-bundle          20260909-r0       apk                      
+catatonit                       0.2.1-r0          apk                      
+certbot                         5.8.0             python                   
+certbot-dns-acmedns             0.1.0             python                   
+certbot-dns-aliyun              2.0.0             python                   
+certbot-dns-azure               1.5.0             python                   
+certbot-dns-bunny               3.0.0             python                   
+certbot-dns-cloudflare          5.8.0             python                   
+certbot-dns-cpanel              0.4.0             python                   
+certbot-dns-desec               1.3.2             python                   
+certbot-dns-digitalocean        5.8.0             python                   
+certbot-dns-directadmin         1.0.15            python                   
+certbot-dns-dnsimple            5.8.0             python                   
+certbot-dns-dnsmadeeasy         5.8.0             python                   
+certbot-dns-dnspod              0.1.0             python                   
+certbot-dns-do                  0.31.0            python                   
+certbot-dns-domeneshop          0.2.9             python                   
+certbot-dns-dreamhost           1.0               python                   
+certbot-dns-duckdns             1.9.0             python                   
+certbot-dns-dynudns             0.0.6             python                   
+certbot-dns-freedns             0.2.0             python                   
+certbot-dns-gehirn              5.8.0             python                   
+certbot-dns-glesys              2.1.0             python                   
+certbot-dns-godaddy             2.8.0             python                   
+certbot-dns-google              5.8.0             python                   
+certbot-dns-he                  1.0.0             python                   
+certbot-dns-hetzner             4.0.0             python                   
+certbot-dns-hetzner-cloud       1.1.0             python                   
+certbot-dns-infomaniak          0.3.3             python                   
+certbot-dns-inwx                3.0.3             python                   
+certbot-dns-ionos               2024.11.9         python                   
+certbot-dns-linode              5.8.0             python                   
+certbot-dns-loopia              1.0.1             python                   
+certbot-dns-luadns              5.8.0             python                   
+certbot-dns-mijn-host           0.0.10            python                   
+certbot-dns-namecheap           1.0.0             python                   
+certbot-dns-netcup              2.1.0             python                   
+certbot-dns-njalla              2.0.2             python                   
+certbot-dns-nsone               5.8.0             python                   
+certbot-dns-ovh                 5.8.0             python                   
+certbot-dns-porkbun             0.11.0            python                   
+certbot-dns-rfc2136             5.8.0             python                   
+certbot-dns-route53             5.8.0             python                   
+certbot-dns-sakuracloud         5.8.0             python                   
+certbot-dns-standalone          1.2.1             python                   
+certbot-dns-transip             0.5.2             python                   
+certbot-dns-vultr               1.1.0             python                   
+certbot-plugin-gandi            1.5.0             python                   
+certifi                         2026.10.19        python                   
+cffi                            2.1.1             python                   
+charset-normalizer              3.5.2             python                   
+cli                             UNKNOWN           binary                   
+cli-32                          UNKNOWN           binary                   
+cli-64                          UNKNOWN           binary                   
+cli-arm64                       UNKNOWN           binary                   
+cloudflare                      5.9.0             python                   
+composer                        2.10.3            binary                   
+configargparse                  1.8.0             python                   
+configobj                       5.0.9             python                   
+coreutils                       9.11-r0           apk                      
+coreutils-env                   9.11-r0           apk                      
+coreutils-fmt                   9.11-r0           apk                      
+coreutils-sha512sum             9.11-r0           apk                      
+cryptography                    50.0.2            python                   
+curl                            8.22.0-r0         apk                      
+distro                          1.9.0             python                   
+dns-lexicon                     3.25.2            python                   
+dnslib                          0.9.26            python                   
+dnspython                       2.9.0             python                   
+domeneshop                      0.4.4             python                   
+fail2ban                        1.1.0             python                   
+fail2ban                        1.1.0-r3          apk                      
+fail2ban-pyc                    1.1.0-r3          apk                      
+filelock                        4.2.4             python                   
+findutils                       4.10.0-r1         apk                      
+fontconfig                      2.17.1-r1         apk                      
+freetype                        2.14.3-r0         apk                      
+future                          1.0.0             python                   
+gdbm                            1.26-r0           apk                      
+git                             2.54.0-r0         apk                      
+git-init-template               2.54.0-r0         apk                      
+git-perl                        2.54.0-r0         apk                      
+gmp                             6.3.0-r4          apk                      
+gnupg                           2.4.9-r1          apk                      
+gnupg-dirmngr                   2.4.9-r1          apk                      
+gnupg-gpgconf                   2.4.9-r1          apk                      
+gnupg-keyboxd                   2.4.9-r1          apk                      
+gnupg-utils                     2.4.9-r1          apk                      
+gnupg-wks-client                2.4.9-r1          apk                      
+gnutls                          3.8.13-r0         apk                      
+google-api-core                 2.42.0            python                   
+google-api-python-client        2.201.0           python                   
+google-auth                     2.62.0            python                   
+google-auth-httplib2            0.4.4             python                   
+googleapis-common-protos        1.75.5            python                   
+gpg                             2.4.9-r1          apk                      
+gpg-agent                       2.4.9-r1          apk                      
+gpg-wks-server                  2.4.9-r1          apk                      
+gpgsm                           2.4.9-r1          apk                      
+gpgv                            2.4.9-r1          apk                      
+gui                             UNKNOWN           binary                   
+gui-32                          UNKNOWN           binary                   
+gui-64                          UNKNOWN           binary                   
+gui-arm64                       UNKNOWN           binary                   
+h11                             0.16.0            python                   
+hcloud                          2.27.0            python                   
+httpcore                        1.0.9             python                   
+httplib2                        0.32.0            python                   
+httpx                           0.28.1            python                   
+icu-data-en                     78.1-r0           apk                      
+icu-libs                        78.1-r0           apk                      
+idna                            3.20              python                   
+importlib-metadata              8.7.1             python                   
+inotify-tools                   4.23.9.0-r0       apk                      
+inotify-tools-libs              4.23.9.0-r0       apk                      
+inwx-domrobot                   3.2.0             python                   
+iptables                        1.8.13-r0         apk                      
+iptables-legacy                 1.8.13-r0         apk                      
+isodate                         0.7.2             python                   
+jaraco-context                  6.1.0             python                   
+jaraco-functools                4.4.0             python                   
+jaraco-text                     4.0.0             python                   
+jinja2                          3.1.6             python                   
+jmespath                        1.1.0             python                   
+josepy                          2.2.0             python                   
+jq                              1.8.2-r0          apk                      
+jsonpickle                      4.1.4             python                   
+libapk                          3.0.8-r0          apk                      
+libassuan                       3.0.2-r0          apk                      
+libattr                         2.5.2-r2          apk                      
+libavif                         1.4.1-r0          apk                      
+libbsd                          0.12.2-r0         apk                      
+libbz2                          1.0.8-r6          apk                      
+libcrypto3                      3.5.9-r0          apk                      
+libcurl                         8.22.0-r0         apk                      
+libdav1d                        1.5.3-r0          apk                      
+libedit                         20260508.3.1-r1   apk                      
+libevent                        2.1.13-r0         apk                      
+libexpat                        2.8.5-r0          apk                      
+libffi                          3.5.2-r1          apk                      
+libgcc                          15.2.0-r5         apk                      
+libgcrypt                       1.12.2-r0         apk                      
+libgd                           2.3.3-r10         apk                      
+libgpg-error                    1.61-r0           apk                      
+libice                          1.1.2-r0          apk                      
+libidn2                         2.3.8-r0          apk                      
+libintl                         1.0-r0            apk                      
+libip4tc                        1.8.13-r0         apk                      
+libip6tc                        1.8.13-r0         apk                      
+libjpeg-turbo                   3.1.3-r0          apk                      
+libksba                         1.7.0-r0          apk                      
+libldap                         2.6.15-r0         apk                      
+libmaxminddb-libs               1.13.3-r0         apk                      
+libmd                           1.2.0-r0          apk                      
+libmemcached-libs               1.1.4-r1          apk                      
+libmnl                          1.0.5-r2          apk                      
+libncursesw                     6.6_p20260516-r0  apk                      
+libnftnl                        1.3.1-r0          apk                      
+libpanelw                       6.6_p20260516-r0  apk                      
+libpng                          1.6.59-r0         apk                      
+libpq                           18.6-r0           apk                      
+libproc2                        4.0.6-r0          apk                      
+libpsl                          0.21.5-r3         apk                      
+libsasl                         2.1.28-r9         apk                      
+libseccomp                      2.6.1-r0          apk                      
+libsharpyuv                     1.6.0-r0          apk                      
+libsm                           1.2.6-r0          apk                      
+libsodium                       1.0.22-r0         apk                      
+libssl3                         3.5.9-r0          apk                      
+libstdc++                       15.2.0-r5         apk                      
+libtasn1                        4.21.0-r0         apk                      
+libunistring                    1.4.2-r0          apk                      
+libuuid                         2.42.3-r1         apk                      
+libwebp                         1.6.0-r0          apk                      
+libx11                          1.8.14-r0         apk                      
+libxau                          1.0.12-r0         apk                      
+libxcb                          1.17.0-r2         apk                      
+libxdmcp                        1.1.5-r1          apk                      
+libxext                         1.3.7-r0          apk                      
+libxml2                         2.13.9-r2         apk                      
+libxpm                          3.5.20-r0         apk                      
+libxslt                         1.1.43-r3         apk                      
+libxt                           1.3.1-r0          apk                      
+libxtables                      1.8.13-r0         apk                      
+libyuv                          0.0.1928-r0       apk                      
+libzip                          1.11.4-r2         apk                      
+linux-pam                       1.7.1-r2          apk                      
+logrotate                       3.22.0-r0         apk                      
+loopialib                       0.2.0             python                   
+lxml                            6.1.3             python                   
+lz4-libs                        1.10.0-r1         apk                      
+markupsafe                      3.0.4             python                   
+memcached                       1.6.42-r0         apk                      
+mock                            5.2.0             python                   
+more-itertools                  10.8.0            python                   
+mpdecimal                       4.0.1-r0          apk                      
+msal                            1.39.0            python                   
+msal-extensions                 1.3.1             python                   
+musl                            1.2.6-r2          apk                      
+musl-utils                      1.2.6-r2          apk                      
+nano                            9.2-r0            apk                      
+ncurses-terminfo-base           6.6_p20260516-r0  apk                      
+netcat-openbsd                  1.234.1-r0        apk                      
+nettle                          3.10.2-r0         apk                      
+nghttp2-libs                    1.70.0-r0         apk                      
+nginx                           1.30.4-r1         apk                      
+nginx-mod-devel-kit             1.30.4-r1         apk                      
+nginx-mod-http-brotli           1.30.4-r1         apk                      
+nginx-mod-http-dav-ext          1.30.4-r1         apk                      
+nginx-mod-http-echo             1.30.4-r1         apk                      
+nginx-mod-http-fancyindex       1.30.4-r1         apk                      
+nginx-mod-http-geoip2           1.30.4-r1         apk                      
+nginx-mod-http-headers-more     1.30.4-r1         apk                      
+nginx-mod-http-image-filter     1.30.4-r1         apk                      
+nginx-mod-http-perl             1.30.4-r1         apk                      
+nginx-mod-http-redis2           1.30.4-r1         apk                      
+nginx-mod-http-set-misc         1.30.4-r1         apk                      
+nginx-mod-http-upload-progress  1.30.4-r1         apk                      
+nginx-mod-http-xslt-filter      1.30.4-r1         apk                      
+nginx-mod-mail                  1.30.4-r1         apk                      
+nginx-mod-rtmp                  1.30.4-r1         apk                      
+nginx-mod-stream                1.30.4-r1         apk                      
+nginx-mod-stream-geoip2         1.30.4-r1         apk                      
+nginx-vim                       1.30.4-r1         apk                      
+npth                            1.8-r0            apk                      
+oniguruma                       6.9.10-r0         apk                      
+openssl                         3.5.9-r0          apk                      
+opentelemetry-api               1.45.1            python                   
+p11-kit                         0.26.2-r0         apk                      
+packaging                       26.3              python  (+1 duplicate)   
+parsedatetime                   2.6               python                   
+pcre2                           10.49-r0          apk                      
+perl                            5.42.2-r1         apk                      
+perl-error                      0.17030-r0        apk                      
+perl-git                        2.54.0-r0         apk                      
+php85                           8.5.11-r0         apk                      
+php85-bcmath                    8.5.11-r0         apk                      
+php85-bz2                       8.5.11-r0         apk                      
+php85-common                    8.5.11-r0         apk                      
+php85-ctype                     8.5.11-r0         apk                      
+php85-curl                      8.5.11-r0         apk                      
+php85-dom                       8.5.11-r0         apk                      
+php85-exif                      8.5.11-r0         apk                      
+php85-fileinfo                  8.5.11-r0         apk                      
+php85-fpm                       8.5.11-r0         apk                      
+php85-ftp                       8.5.11-r0         apk                      
+php85-gd                        8.5.11-r0         apk                      
+php85-gmp                       8.5.11-r0         apk                      
+php85-iconv                     8.5.11-r0         apk                      
+php85-intl                      8.5.11-r0         apk                      
+php85-ldap                      8.5.11-r0         apk                      
+php85-mbstring                  8.5.11-r0         apk                      
+php85-mysqli                    8.5.11-r0         apk                      
+php85-mysqlnd                   8.5.11-r0         apk                      
+php85-openssl                   8.5.11-r0         apk                      
+php85-pdo                       8.5.11-r0         apk                      
+php85-pdo_mysql                 8.5.11-r0         apk                      
+php85-pdo_odbc                  8.5.11-r0         apk                      
+php85-pdo_pgsql                 8.5.11-r0         apk                      
+php85-pdo_sqlite                8.5.11-r0         apk                      
+php85-pear                      8.5.11-r0         apk                      
+php85-pecl-apcu                 5.1.28-r0         apk                      
+php85-pecl-igbinary             3.2.17_rc1-r0     apk                      
+php85-pecl-memcached            3.4.0-r0          apk                      
+php85-pecl-msgpack              3.0.1-r0          apk                      
+php85-pecl-redis                6.3.0-r0          apk                      
+php85-pgsql                     8.5.11-r0         apk                      
+php85-phar                      8.5.11-r0         apk                      
+php85-posix                     8.5.11-r0         apk                      
+php85-session                   8.5.11-r0         apk                      
+php85-simplexml                 8.5.11-r0         apk                      
+php85-soap                      8.5.11-r0         apk                      
+php85-sockets                   8.5.11-r0         apk                      
+php85-sodium                    8.5.11-r0         apk                      
+php85-sqlite3                   8.5.11-r0         apk                      
+php85-tokenizer                 8.5.11-r0         apk                      
+php85-xml                       8.5.11-r0         apk                      
+php85-xmlreader                 8.5.11-r0         apk                      
+php85-xmlwriter                 8.5.11-r0         apk                      
+php85-xsl                       8.5.11-r0         apk                      
+php85-zip                       8.5.11-r0         apk                      
+pinentry                        1.3.2-r0          apk                      
+pip                             26.2.1            python                   
+pkb-client                      2.3.1             python                   
+platformdirs                    4.4.0             python                   
+popt                            1.19-r4           apk                      
+procps-ng                       4.0.6-r0          apk                      
+proto-plus                      1.29.0            python                   
+protobuf                        7.36.2            python                   
+pyacmedns                       0.4               python                   
+pyasn1                          0.6.4             python                   
+pyasn1-modules                  0.4.2             python                   
+pyc                             3.14.8-r0         apk                      
+pycparser                       3.11              python                   
+pydantic                        2.14.1            python                   
+pydantic-core                   2.50.1            python                   
+pyjwt                           2.15.1            python                   
+pynamecheap                     0.0.3             python                   
+pyopenssl                       26.4.0            python                   
+pyotp                           2.10.0            python                   
+pyparsing                       3.3.3             python                   
+pyrfc3339                       2.1.1             python                   
+python-dateutil                 2.9.0.post0       python                   
+python-digitalocean             1.17.0            python                   
+python-transip                  0.6.0             python                   
+python3                         3.14.8-r0         apk                      
+python3-pyc                     3.14.8-r0         apk                      
+python3-pycache-pyc0            3.14.8-r0         apk                      
+pyyaml                          6.0.3             python                   
+readline                        8.3.3-r1          apk                      
+requests                        2.34.2            python                   
+requests-file                   3.0.1             python                   
+requests-mock                   1.12.1            python                   
+requests-unixsocket             0.4.1             python                   
+s3transfer                      0.19.3            python                   
+scanelf                         1.3.9-r1          apk                      
+setuptools                      84.2.0            python                   
+shadow                          4.18.0-r1         apk                      
+six                             1.17.0            python                   
+skalibs-libs                    2.15.0.0-r0       apk                      
+sniffio                         1.3.1             python                   
+soupsieve                       3.0.3             python                   
+sqlite-libs                     3.53.4-r0         apk                      
+ssl_client                      1.37.0-r31        apk                      
+tiff                            4.7.2-r0          apk                      
+tldextract                      5.4.0             python                   
+tomli                           2.4.0             python                   
+typing-extensions               4.16.0            python                   
+typing-inspection               0.4.4             python                   
+tzdata                          2026e-r0          apk                      
+unixodbc                        2.3.14-r1         apk                      
+uritemplate                     4.2.0             python                   
+urllib3                         2.8.0             python                   
+utmps-libs                      0.1.3.3-r0        apk                      
+wheel                           0.46.3            python                   
+wheel                           0.48.0            python                   
+whois                           5.6.6-r0          apk                      
+xz-libs                         5.8.4-r0          apk                      
+zipp                            3.23.0            python                   
+zlib                            1.3.2-r1          apk                      
+zope-interface                  8.7               python                   
+zstd-libs                       1.5.7-r2          apk                      

readme-vars.yml

@@ -6,44 +6,50 @@ project_url: "https://linuxserver.io"
 project_logo: "https://github.com/linuxserver/docker-templates/raw/master/linuxserver.io/img/swag.gif"
 project_blurb: "SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx webserver and reverse proxy with php support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention."
 project_lsio_github_repo_url: "https://github.com/linuxserver/docker-{{ project_name }}"
-
+project_categories: "Reverse Proxy"
 # supported architectures
 available_architectures:
-  - { arch: "{{ arch_x86_64 }}", tag: "amd64-latest"}
-  - { arch: "{{ arch_arm64 }}", tag: "arm64v8-latest"}
-
+  - {arch: "{{ arch_x86_64 }}", tag: "amd64-latest"}
+  - {arch: "{{ arch_arm64 }}", tag: "arm64v8-latest"}
 # container parameters
 common_param_env_vars_enabled: true
 param_container_name: "{{ project_name }}"
 param_usage_include_env: true
 param_env_vars:
-  - { env_var: "URL", env_value: "yourdomain.url", desc: "Top url you have control over (`customdomain.com` if you own it, or `customsubdomain.ddnsprovider.com` if dynamic dns)." }
-  - { env_var: "VALIDATION", env_value: "http", desc: "Certbot validation method to use, options are `http` or `dns` (`dns` method also requires `DNSPLUGIN` variable set).", env_options: ["http", "dns"] }
+  - {env_var: "URL", env_value: "example.com", desc: "Top url you have control over (e.g. `example.com` if you own it, or `customsubdomain.example.com` if dynamic dns)."}
+  - {env_var: "VALIDATION", env_value: "http", desc: "Certbot validation method to use, options are `http` or `dns` (`dns` method also requires `DNSPLUGIN` variable set).", env_options: ["http", "dns"]}
 param_usage_include_vols: true
 param_volumes:
-  - { vol_path: "/config", vol_host_path: "/path/to/{{ project_name }}/config", desc: "Persistent config files" }
+  - {vol_path: "/config", vol_host_path: "/path/to/{{ project_name }}/config", desc: "Persistent config files"}
 param_usage_include_ports: true
 param_ports:
-  - { external_port: "443", internal_port: "443", port_desc: "Https port" }
+  - {external_port: "443", internal_port: "443", port_desc: "HTTPS port"}
 cap_add_param: true
 cap_add_param_vars:
-  - { cap_add_var: "NET_ADMIN" }
-
+  - {cap_add_var: "NET_ADMIN", desc: "Required for fail2Ban to be able to modify iptables rules."}
 # optional container parameters
 opt_param_usage_include_env: true
 opt_param_env_vars:
-  - { env_var: "SUBDOMAINS", env_value: "www,", desc: "Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this *exactly* to `wildcard` (wildcard cert is available via `dns` validation only)" }
-  - { env_var: "CERTPROVIDER", env_value: "", desc: "Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt." }
-  - { env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `acmedns`, `aliyun`, `azure`, `bunny`, `cloudflare`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `do`, `domeneshop`, `dreamhost`, `duckdns`, `dynu`, `freedns`, `gandi`, `gehirn`, `glesys`, `godaddy`, `google`, `he`, `hetzner`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `namecheap`, `netcup`, `njalla`, `nsone`, `ovh`, `porkbun`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip`, and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`." }
-  - { env_var: "PROPAGATION", env_value: "", desc: "Optionally override (in seconds) the default propagation time for the dns plugins." }
-  - { env_var: "EMAIL", env_value: "", desc: "Optional e-mail address used for cert expiration notifications (Required for ZeroSSL)." }
-  - { env_var: "ONLY_SUBDOMAINS", env_value: "false", desc: "If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true`" }
-  - { env_var: "EXTRA_DOMAINS", env_value: "", desc: "Additional fully qualified domain names (comma separated, no spaces) ie. `extradomain.com,subdomain.anotherdomain.org,*.anotherdomain.org`" }
-  - { env_var: "STAGING", env_value: "false", desc: "Set to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes." }
+  - {env_var: "SUBDOMAINS", env_value: "www,", desc: "Subdomains you'd like the cert to cover (comma separated, no spaces) ie. `www,ftp,cloud`. For a wildcard cert, set this *exactly* to `wildcard` (wildcard cert is available via `dns` validation only)"}
+  - {env_var: "CERTPROVIDER", env_value: "", desc: "Optionally define the cert provider. Set to `zerossl` for ZeroSSL certs (requires existing [ZeroSSL account](https://app.zerossl.com/signup) and the e-mail address entered in `EMAIL` env var). Otherwise defaults to Let's Encrypt."}
+  - {env_var: "CERT_PROFILE", env_value: "", desc: "Optionally define a cert profile to use for cert generation. This is useful if you want to use a custom cert profile instead of the default one. Currently only supported for Let's Encrypt. See https://letsencrypt.org/docs/profiles/ "}
+  - {env_var: "DNSPLUGIN", env_value: "cloudflare", desc: "Required if `VALIDATION` is set to `dns`. Options are `acmedns`, `aliyun`, `azure`, `bunny`, `cloudflare`, `cpanel`, `desec`, `digitalocean`, `directadmin`, `dnsimple`, `dnsmadeeasy`, `dnspod`, `do`, `domeneshop`, `dreamhost`, `duckdns`, `dynu`, `freedns`, `gandi`, `gehirn`, `glesys`, `godaddy`, `google`, `he`, `hetzner`, `hetzner-cloud`, `infomaniak`, `inwx`, `ionos`, `linode`, `loopia`, `luadns`, `mijn-host`, `namecheap`, `netcup`, `njalla`, `nsone`, `ovh`, `porkbun`, `rfc2136`, `route53`, `sakuracloud`, `standalone`, `transip`, and `vultr`. Also need to enter the credentials into the corresponding ini (or json for some plugins) file under `/config/dns-conf`."}
+  - {env_var: "PROPAGATION", env_value: "", desc: "Optionally override (in seconds) the default propagation time for the dns plugins."}
+  - {env_var: "EMAIL", env_value: "", desc: "Optional e-mail address used for cert expiration notifications (Required for ZeroSSL)."}
+  - {env_var: "ONLY_SUBDOMAINS", env_value: "false", desc: "If you wish to get certs only for certain subdomains, but not the main domain (main domain may be hosted on another machine and cannot be validated), set this to `true`"}
+  - {env_var: "EXTRA_DOMAINS", env_value: "", desc: "Additional fully qualified domain names (comma separated, no spaces) ie. `example.net,subdomain.example.net,*.example.org`"}
+  - {env_var: "STAGING", env_value: "false", desc: "Set to `true` to retrieve certs in staging mode. Rate limits will be much higher, but the resulting cert will not pass the browser's security test. Only to be used for testing purposes."}
+  - {env_var: "DISABLE_F2B", env_value: "", desc: "Set to `true` to disable the Fail2ban service in the container, if you're already running it elsewhere or using a different IPS."}
+  - {env_var: "SWAG_AUTORELOAD", env_value: "", desc: "Set to `true` to enable automatic reloading of confs on change without stopping/restarting nginx. Your filesystem must support inotify. This functionality was previously offered [via mod](https://github.com/linuxserver/docker-mods/tree/swag-auto-reload)."}
+  - {env_var: "SWAG_AUTORELOAD_WATCHLIST", env_value: "", desc: "A [pipe](https://en.wikipedia.org/wiki/Vertical_bar)-separated list of additional folders for auto reload to watch in addition to `/config/nginx`"}
 opt_param_usage_include_ports: true
 opt_param_ports:
-  - { external_port: "80", internal_port: "80", port_desc: "Http port (required for http validation and http -> https redirect)" }
-
+  - {external_port: "80", internal_port: "80", port_desc: "HTTP port (required for HTTP validation and HTTP -> HTTPS redirect)"}
+  - {external_port: "443", internal_port: "443/udp", port_desc: "QUIC (HTTP/3) port. Must be enabled in the default and proxy confs."}
+readonly_supported: true
+readonly_message: |
+  * `/tmp` must be mounted to tmpfs
+  * fail2ban will not be available
 # application setup block
 app_setup_block_enabled: true
 app_setup_block: |
@@ -59,8 +65,8 @@ app_setup_block: |
       1. Certs that only cover your main subdomain (ie. `yoursubdomain.duckdns.org`, leave the `SUBDOMAINS` variable empty)
       2. Certs that cover sub-subdomains of your main subdomain (ie. `*.yoursubdomain.duckdns.org`, set the `SUBDOMAINS` variable to `wildcard`)
   * `--cap-add=NET_ADMIN` is required for fail2ban to modify iptables
-  * After setup, navigate to `https://yourdomain.url` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default.conf`).
-  * Certs are checked nightly and if expiration is within 30 days, renewal is attempted. If your cert is about to expire in less than 30 days, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing. It is recommended to input your e-mail in docker parameters so you receive expiration notices from Let's Encrypt in those circumstances.
+  * After setup, navigate to `https://example.com` to access the default homepage (http access through port 80 is disabled by default, you can enable it by editing the default site config at `/config/nginx/site-confs/default.conf`).
+  * Certs are checked twice daily using ACME Renewal Information (ARI) to determine the optimal renewal window. If your cert is about to expire, check the logs under `/config/log/letsencrypt` to see why the renewals have been failing.
 
   ### Certbot Plugins
 
@@ -88,7 +94,7 @@ app_setup_block: |
   ### Site config and reverse proxy
 
   * The default site config resides at `/config/nginx/site-confs/default.conf`. Feel free to modify this file, and you can add other conf files to this directory. However, if you delete the `default` file, a new default will be created on container start.
-  * Preset reverse proxy config files are added for popular apps. See the `README.md` file under `/config/nginx/proxy_confs` for instructions on how to enable them. The preset confs reside in and get imported from [this repo](https://github.com/linuxserver/reverse-proxy-confs).
+  * Preset reverse proxy config files are added for popular apps. See the `README.md` file under `/config/nginx/proxy-confs` for instructions on how to enable them. The preset confs reside in and get imported from [this repo](https://github.com/linuxserver/reverse-proxy-confs).
   * If you wish to hide your site from search engine crawlers, you may find it useful to add this configuration line to your site config, within the server block, above the line where ssl.conf is included
   `add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";`
   This will *ask* Google et al not to index and list your site. Be careful with this, as you will eventually be de-listed if you leave this line in on a site you wish to be present on search engines
@@ -118,7 +124,7 @@ app_setup_block: |
   * You can check which jails are active via `docker exec -it swag fail2ban-client status`
   * You can check the status of a specific jail via `docker exec -it swag fail2ban-client status <jail name>`
   * You can unban an IP via `docker exec -it swag fail2ban-client set <jail name> unbanip <IP>`
-  * A list of commands can be found here: <https://www.fail2ban.org/wiki/index.php/Commands>
+  * A list of commands for fail2ban-client can be found [here](https://manpages.ubuntu.com/manpages/noble/man1/fail2ban-client.1.html)
 
   ### Updating configs
 
@@ -134,97 +140,184 @@ app_setup_block: |
   * Proxy sample files WILL be updated, however your renamed (enabled) proxy files will not.
   * You can check the new sample and adjust your active config as needed.
 
+  ### QUIC support
+
+  This image supports QUIC (also known as HTTP/3) but it must be explicitly enabled in each proxy conf, and the default conf, because if the listener is enabled and you don't expose 443/UDP, it can break connections with some browsers.
+
+  To enable QUIC, expose 443/UDP to your clients, then uncomment both QUIC listeners in all of your active proxy confs, as well as the default conf, and restart the container.
+
+  You should also uncomment the `Alt-Svc` header in your `ssl.conf` so that browsers are aware that you offer QUIC connectivity.
+
+  It is [recommended](https://quic-go.net/docs/quic/optimizations/#udp-buffer-sizes) to increase the UDP send/recieve buffer **on the host** by setting the `net.core.rmem_max` and `net.core.wmem_max` sysctls. Suggested values are 4-16Mb (4194304-16777216 bytes). For persistence between reboots use `/etc/sysctl.d/`.
+
   ### Migration from the old `linuxserver/letsencrypt` image
 
   Please follow the instructions [on this blog post](https://www.linuxserver.io/blog/2020-08-21-introducing-swag#migrate).
-
+# init diagram
+init_diagram: |
+  "swag:latest": {
+    docker-mods
+    base {
+      fix-attr +\nlegacy cont-init
+    }
+    docker-mods -> base
+    legacy-services
+    custom services
+    init-services -> legacy-services
+    init-services -> custom services
+    custom services -> legacy-services
+    legacy-services -> ci-service-check
+    init-migrations -> init-adduser
+    init-swag-config -> init-certbot-config
+    init-nginx-end -> init-config
+    init-os-end -> init-config
+    init-config -> init-config-end
+    init-crontab-config -> init-config-end
+    init-outdated-config -> init-config-end
+    init-config -> init-crontab-config
+    init-mods-end -> init-custom-files
+    init-adduser -> init-device-perms
+    base -> init-envfile
+    init-require-url -> init-fail2ban-config
+    init-os-end -> init-folders
+    init-php -> init-keygen
+    base -> init-migrations
+    init-config-end -> init-mods
+    init-mods-package-install -> init-mods-end
+    init-mods -> init-mods-package-install
+    init-samples -> init-nginx
+    init-version-checks -> init-nginx-end
+    init-adduser -> init-os-end
+    init-device-perms -> init-os-end
+    init-envfile -> init-os-end
+    init-renew -> init-outdated-config
+    init-keygen -> init-permissions
+    init-certbot-config -> init-permissions-config
+    init-nginx -> init-php
+    init-permissions-config -> init-renew
+    init-config -> init-require-url
+    init-folders -> init-samples
+    init-custom-files -> init-services
+    init-fail2ban-config -> init-swag-config
+    init-permissions -> init-swag-folders
+    init-swag-folders -> init-swag-samples
+    init-permissions -> init-version-checks
+    init-swag-samples -> init-version-checks
+    init-services -> svc-cron
+    svc-cron -> legacy-services
+    init-services -> svc-fail2ban
+    svc-fail2ban -> legacy-services
+    init-services -> svc-nginx
+    svc-nginx -> legacy-services
+    init-services -> svc-php-fpm
+    svc-php-fpm -> legacy-services
+    init-services -> svc-swag-auto-reload
+    svc-swag-auto-reload -> legacy-services
+  }
+  Base Images: {
+    "baseimage-alpine-nginx:3.24" <- "baseimage-alpine:3.24"
+  }
+  "swag:latest" <- Base Images
 # changelog
 changelogs:
-  - { date: "21.10.24:", desc: "Fix naming issue with Dynu plugin. If you are using Dynu, please make sure your credentials are set in /config/dns-conf/dynu.ini and your DNSPLUGIN variable is set to dynu (not dynudns)." }
-  - { date: "30.08.24:", desc: "Fix zerossl cert revocation." }
-  - { date: "24.07.14:", desc: "Rebase to Alpine 3.20. Remove deprecated Google Domains certbot plugin. Existing users should update their nginx confs to avoid http2 deprecation warnings."}
-  - { date: "01.07.24:", desc: "Fall back to iptables-legacy if iptables doesn't work." }
-  - { date: "23.03.24:", desc: "Fix perms on the generated `priv-fullchain-bundle.pem`." }
-  - { date: "14.03.24:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) authelia-location.conf, authelia-server.conf - Update Authelia conf samples with support for 4.38." }
-  - { date: "11.03.24:", desc: "Restore support for DynuDNS using `certbot-dns-dynudns`." }
-  - { date: "06.03.24:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) site-confs/default.conf - Cleanup default site conf." }
-  - { date: "04.03.24:", desc: "Remove `stream.conf` inside the container to allow users to include their own block in `nginx.conf`." }
-  - { date: "23.01.24:", desc: "Rebase to Alpine 3.19 with php 8.3, add root periodic crontabs for logrotate." }
-  - { date: "01.01.24:", desc: "Add GleSYS DNS plugin." }
-  - { date: "11.12.23:", desc: "Deprecate certbot-dns-dynu to resolve dependency conflicts with other plugins." }
-  - { date: "30.11.23:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) site-confs/default.conf - Fix index.php being downloaded on 404." }
-  - { date: "23.11.23:", desc: "Run certbot as root to allow fix http validation." }
-  - { date: "01.10.23:", desc: "Fix \"unrecognized arguments\" issue in DirectAdmin DNS plugin." }
-  - { date: "28.08.23:", desc: "Add Namecheap DNS plugin." }
-  - { date: "12.08.23:", desc: "Add FreeDNS plugin. Detect certbot DNS authenticators using CLI." }
-  - { date: "07.08.23:", desc: "Add Bunny DNS Configuration." }
-  - { date: "27.07.23:", desc: "Added support for dreamhost validation." }
-  - { date: "25.05.23:", desc: "Rebase to Alpine 3.18, deprecate armhf." }
-  - { date: "27.04.23:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) authelia-location.conf, authelia-server.conf, authentik-location.conf, authentik-server.conf - Simplify auth configs and fix Set-Cookie header bug." }
-  - { date: "13.04.23:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, authelia-location.conf, authentik-location.conf, and site-confs/default.conf - Move ssl.conf include to default.conf. Remove Authorization headers in authelia. Sort proxy_set_header in authelia and authentik." }
-  - { date: "25.03.23:", desc: "Fix renewal post hook." }
-  - { date: "10.03.23:", desc: "Cleanup unused csr and keys folders. See [certbot 2.3.0 release notes](https://github.com/certbot/certbot/releases/tag/v2.3.0)." }
-  - { date: "09.03.23:", desc: "Add Google Domains DNS support, `google-domains`." }
-  - { date: "02.03.23:", desc: "Set permissions on crontabs during init." }
-  - { date: "09.02.23:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) proxy.conf, authelia-location.conf and authelia-server.conf - Add Authentik configs, update Authelia configs." }
-  - { date: "06.02.23:", desc: "Add porkbun support back in." }
-  - { date: "21.01.23:", desc: "Unpin certbot version (allow certbot 2.x). !!BREAKING CHANGE!! We are temporarily removing the certbot porkbun plugin until a new version is released that is compatible with certbot 2.x." }
-  - { date: "20.01.23:", desc: "Rebase to alpine 3.17 with php8.1." }
-  - { date: "16.01.23:", desc: "Remove nchan module because it keeps causing crashes." }
-  - { date: "08.12.22:", desc: "Revamp certbot init."}
-  - { date: "03.12.22:", desc: "Remove defunct cloudxns plugin."}
-  - { date: "22.11.22:", desc: "Pin acme to the same version as certbot."}
-  - { date: "22.11.22:", desc: "Pin certbot to 1.32.0 until plugin compatibility improves."}
-  - { date: "05.11.22:", desc: "Update acmedns plugin handling."}
-  - { date: "06.10.22:", desc: "Switch to certbot-dns-duckdns. Update cpanel and gandi dns plugin handling. Minor adjustments to init logic." }
-  - { date: "05.10.22:", desc: "Use certbot file hooks instead of command line hooks" }
-  - { date: "04.10.22:", desc: "Add godaddy and porkbun dns plugins." }
-  - { date: "03.10.22:", desc: "Add default_server back to default site conf's https listen." }
-  - { date: "22.09.22:", desc: "Added support for DO DNS validation." }
-  - { date: "22.09.22:", desc: "Added certbot-dns-acmedns for DNS01 validation." }
-  - { date: "20.08.22:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf - Rebasing to alpine 3.15 with php8. Restructure nginx configs ([see changes announcement](https://info.linuxserver.io/issues/2022-08-20-nginx-base))." }
-  - { date: "10.08.22:", desc: "Added support for Dynu DNS validation." }
-  - { date: "18.05.22:", desc: "Added support for Azure DNS validation." }
-  - { date: "09.04.22:", desc: "Added certbot-dns-loopia for DNS01 validation." }
-  - { date: "05.04.22:", desc: "Added support for standalone DNS validation." }
-  - { date: "28.03.22:", desc: "created a logfile for fail2ban nginx-unauthorized in /etc/cont-init.d/50-config" }
-  - { date: "09.01.22:", desc: "Added a fail2ban jail for nginx unauthorized" }
-  - { date: "21.12.21:", desc: "Fixed issue with iptables not working as expected" }
-  - { date: "30.11.21:", desc: "Move maxmind to a [new mod](https://github.com/linuxserver/docker-mods/tree/swag-maxmind)" }
-  - { date: "22.11.21:", desc: "Added support for Infomaniak DNS for certificate generation." }
-  - { date: "20.11.21:", desc: "Added support for dnspod validation." }
-  - { date: "15.11.21:", desc: "Added support for deSEC DNS for wildcard certificate generation." }
-  - { date: "26.10.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) proxy.conf - Mitigate <https://httpoxy.org/> vulnerabilities. Ref: <https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx#Defeating-the-Attack-using-NGINX-and-NGINX-Plus>" }
-  - { date: "23.10.21:", desc: "Fix Hurricane Electric (HE) DNS validation." }
-  - { date: "12.10.21:", desc: "Fix deprecated LE root cert check to fix failures when using `STAGING=true`, and failures in revoking." }
-  - { date: "06.10.21:", desc: "Added support for Hurricane Electric (HE) DNS validation. Added lxml build deps." }
-  - { date: "01.10.21:", desc: "Check if the cert uses the old LE root cert, revoke and regenerate if necessary. [Here's more info](https://twitter.com/letsencrypt/status/1443621997288767491) on LE root cert expiration" }
-  - { date: "19.09.21:", desc: "Add an optional header to opt out of Google FLoC in `ssl.conf`." }
-  - { date: "17.09.21:", desc: "Mark `SUBDOMAINS` var as optional." }
-  - { date: "01.08.21:", desc: "Add support for ionos dns validation." }
-  - { date: "15.07.21:", desc: "Fix libmaxminddb issue due to upstream change." }
-  - { date: "07.07.21:", desc: "Rebase to alpine 3.14." }
-  - { date: "24.06.21:", desc: "Update default nginx conf folder." }
-  - { date: "28.05.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) authelia-server.conf - Use `resolver.conf` and patch for `CVE-2021-32637`." }
-  - { date: "20.05.21:", desc: "Modify resolver.conf generation to detect and ignore ipv6." }
-  - { date: "14.05.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, ssl.conf, proxy.conf, and the default site-conf - Rework nginx.conf to be inline with alpine upstream and relocate lines from other files. Use linuxserver.io wheel index for pip packages. Switch to using [ffdhe4096](https://ssl-config.mozilla.org/ffdhe4096.txt) for `dhparams.pem` per [RFC7919](https://datatracker.ietf.org/doc/html/rfc7919). Added `worker_processes.conf`, which sets the number of nginx workers, and `resolver.conf`, which sets the dns resolver. Both conf files are auto-generated only on first start and can be user modified later." }
-  - { date: "21.04.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) authelia-server.conf and authelia-location.conf - Add remote name/email headers and pass http method." }
-  - { date: "12.04.21:", desc: "Add php7-gmp and php7-pecl-mailparse." }
-  - { date: "12.04.21:", desc: "Add support for vultr dns validation." }
-  - { date: "14.03.21:", desc: "Add support for directadmin dns validation." }
-  - { date: "12.02.21:", desc: "Clean up rust/cargo cache, which ballooned the image size in the last couple of builds." }
-  - { date: "10.02.21:", desc: "Fix aliyun, domeneshop, inwx and transip dns confs for existing users." }
-  - { date: "09.02.21:", desc: "Rebasing to alpine 3.13. Add nginx mods brotli and dav-ext. Remove nginx mods lua and lua-upstream (due to regression over the last couple of years)." }
-  - { date: "26.01.21:", desc: "Add support for hetzner dns validation." }
-  - { date: "20.01.21:", desc: "Add check for ZeroSSL EAB retrieval." }
-  - { date: "08.01.21:", desc: "Add support for getting certs from [ZeroSSL](https://zerossl.com/) via optional `CERTPROVIDER` env var. Update aliyun, domeneshop, inwx and transip dns plugins with the new plugin names. Hide `donoteditthisfile.conf` because users were editing it despite its name. Suppress harmless error when no proxy confs are enabled." }
-  - { date: "03.01.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) /config/nginx/site-confs/default.conf - Add helper pages to aid troubleshooting" }
-  - { date: "10.12.20:", desc: "Add support for njalla dns validation" }
-  - { date: "09.12.20:", desc: "Check for template/conf updates and notify in the log. Add support for gehirn and sakuracloud dns validation." }
-  - { date: "01.11.20:", desc: "Add support for netcup dns validation" }
-  - { date: "29.10.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) ssl.conf - Add frame-ancestors to Content-Security-Policy." }
-  - { date: "04.10.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, proxy.conf, and ssl.conf - Minor cleanups and reordering." }
-  - { date: "20.09.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf - Added geoip2 configs. Added MAXMINDDB_LICENSE_KEY variable to readme."}
-  - { date: "08.09.20:", desc: "Add php7-xsl." }
-  - { date: "01.09.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, proxy.conf, and various proxy samples - Global websockets across all configs." }
-  - { date: "03.08.20:", desc: "Initial release." }
+  - {date: "20.10.26:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) proxy.conf, authelia-server.conf, authentik-server.conf, tinyauth-server.conf - Update Nginx configuration to replace $http_host with $host$is_request_port$request_port for better compatibility."}
+  - {date: "09.09.26:", desc: "Use new X-Tinyauth-Location header in Tinyauth locations and remove duplicate auth module headers."}
+  - {date: "19.07.26:", desc: "Rebase to Alpine 3.24 with PHP 8.5."}
+  - {date: "10.07.26:", desc: "Add support for Let's Encrypt cert profiles. Run certbot twice daily with a random delay."}
+  - {date: "19.06.26:", desc: "Add support for mijn.host dns validation."}
+  - {date: "01.06.26:", desc: "Remove obsolete old cert check logic."}
+  - {date: "23.01.26:", desc: "Reorder init to fix proxy conf version checks."}
+  - {date: "21.12.25:", desc: "Add support for hetzner-cloud dns validation."}
+  - {date: "04.11.25:", desc: "Switch default Gandi credentials from API Key to Token, allow DNS propagation time for Azure DNS plugin."}
+  - {date: "18.07.25:", desc: "Rebase to Alpine 3.22 with PHP 8.4. Add QUIC support. Drop PHP bindings for mcrypt as it is no longer maintained."}
+  - {date: "05.05.25:", desc: "Disable Certbot's built in log rotation."}
+  - {date: "19.01.25:", desc: "Add [Auto Reload](https://github.com/linuxserver/docker-mods/tree/swag-auto-reload) functionality to SWAG."}
+  - {date: "17.12.24:", desc: "Rebase to Alpine 3.21."}
+  - {date: "21.10.24:", desc: "Fix naming issue with Dynu plugin. If you are using Dynu, please make sure your credentials are set in /config/dns-conf/dynu.ini and your DNSPLUGIN variable is set to dynu (not dynudns)."}
+  - {date: "30.08.24:", desc: "Fix zerossl cert revocation."}
+  - {date: "24.07.14:", desc: "Rebase to Alpine 3.20. Remove deprecated Google Domains certbot plugin. Existing users should update their nginx confs to avoid http2 deprecation warnings."}
+  - {date: "01.07.24:", desc: "Fall back to iptables-legacy if iptables doesn't work."}
+  - {date: "23.03.24:", desc: "Fix perms on the generated `priv-fullchain-bundle.pem`."}
+  - {date: "14.03.24:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) authelia-location.conf, authelia-server.conf - Update Authelia conf samples with support for 4.38."}
+  - {date: "11.03.24:", desc: "Restore support for DynuDNS using `certbot-dns-dynudns`."}
+  - {date: "06.03.24:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) site-confs/default.conf - Cleanup default site conf."}
+  - {date: "04.03.24:", desc: "Remove `stream.conf` inside the container to allow users to include their own block in `nginx.conf`."}
+  - {date: "23.01.24:", desc: "Rebase to Alpine 3.19 with php 8.3, add root periodic crontabs for logrotate."}
+  - {date: "01.01.24:", desc: "Add GleSYS DNS plugin."}
+  - {date: "11.12.23:", desc: "Deprecate certbot-dns-dynu to resolve dependency conflicts with other plugins."}
+  - {date: "30.11.23:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) site-confs/default.conf - Fix index.php being downloaded on 404."}
+  - {date: "23.11.23:", desc: "Run certbot as root to allow fix http validation."}
+  - {date: "01.10.23:", desc: "Fix \"unrecognized arguments\" issue in DirectAdmin DNS plugin."}
+  - {date: "28.08.23:", desc: "Add Namecheap DNS plugin."}
+  - {date: "12.08.23:", desc: "Add FreeDNS plugin. Detect certbot DNS authenticators using CLI."}
+  - {date: "07.08.23:", desc: "Add Bunny DNS Configuration."}
+  - {date: "27.07.23:", desc: "Added support for dreamhost validation."}
+  - {date: "25.05.23:", desc: "Rebase to Alpine 3.18, deprecate armhf."}
+  - {date: "27.04.23:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) authelia-location.conf, authelia-server.conf, authentik-location.conf, authentik-server.conf - Simplify auth configs and fix Set-Cookie header bug."}
+  - {date: "13.04.23:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, authelia-location.conf, authentik-location.conf, and site-confs/default.conf - Move ssl.conf include to default.conf. Remove Authorization headers in authelia. Sort proxy_set_header in authelia and authentik."}
+  - {date: "25.03.23:", desc: "Fix renewal post hook."}
+  - {date: "10.03.23:", desc: "Cleanup unused csr and keys folders. See [certbot 2.3.0 release notes](https://github.com/certbot/certbot/releases/tag/v2.3.0)."}
+  - {date: "09.03.23:", desc: "Add Google Domains DNS support, `google-domains`."}
+  - {date: "02.03.23:", desc: "Set permissions on crontabs during init."}
+  - {date: "09.02.23:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) proxy.conf, authelia-location.conf and authelia-server.conf - Add Authentik configs, update Authelia configs."}
+  - {date: "06.02.23:", desc: "Add porkbun support back in."}
+  - {date: "21.01.23:", desc: "Unpin certbot version (allow certbot 2.x). !!BREAKING CHANGE!! We are temporarily removing the certbot porkbun plugin until a new version is released that is compatible with certbot 2.x."}
+  - {date: "20.01.23:", desc: "Rebase to alpine 3.17 with php8.1."}
+  - {date: "16.01.23:", desc: "Remove nchan module because it keeps causing crashes."}
+  - {date: "08.12.22:", desc: "Revamp certbot init."}
+  - {date: "03.12.22:", desc: "Remove defunct cloudxns plugin."}
+  - {date: "22.11.22:", desc: "Pin acme to the same version as certbot."}
+  - {date: "22.11.22:", desc: "Pin certbot to 1.32.0 until plugin compatibility improves."}
+  - {date: "05.11.22:", desc: "Update acmedns plugin handling."}
+  - {date: "06.10.22:", desc: "Switch to certbot-dns-duckdns. Update cpanel and gandi dns plugin handling. Minor adjustments to init logic."}
+  - {date: "05.10.22:", desc: "Use certbot file hooks instead of command line hooks"}
+  - {date: "04.10.22:", desc: "Add godaddy and porkbun dns plugins."}
+  - {date: "03.10.22:", desc: "Add default_server back to default site conf's https listen."}
+  - {date: "22.09.22:", desc: "Added support for DO DNS validation."}
+  - {date: "22.09.22:", desc: "Added certbot-dns-acmedns for DNS01 validation."}
+  - {date: "20.08.22:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf - Rebasing to alpine 3.15 with php8. Restructure nginx configs ([see changes announcement](https://info.linuxserver.io/issues/2022-08-20-nginx-base))."}
+  - {date: "10.08.22:", desc: "Added support for Dynu DNS validation."}
+  - {date: "18.05.22:", desc: "Added support for Azure DNS validation."}
+  - {date: "09.04.22:", desc: "Added certbot-dns-loopia for DNS01 validation."}
+  - {date: "05.04.22:", desc: "Added support for standalone DNS validation."}
+  - {date: "28.03.22:", desc: "created a logfile for fail2ban nginx-unauthorized in /etc/cont-init.d/50-config"}
+  - {date: "09.01.22:", desc: "Added a fail2ban jail for nginx unauthorized"}
+  - {date: "21.12.21:", desc: "Fixed issue with iptables not working as expected"}
+  - {date: "30.11.21:", desc: "Move maxmind to a [new mod](https://github.com/linuxserver/docker-mods/tree/swag-maxmind)"}
+  - {date: "22.11.21:", desc: "Added support for Infomaniak DNS for certificate generation."}
+  - {date: "20.11.21:", desc: "Added support for dnspod validation."}
+  - {date: "15.11.21:", desc: "Added support for deSEC DNS for wildcard certificate generation."}
+  - {date: "26.10.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) proxy.conf - Mitigate <https://httpoxy.org/> vulnerabilities. Ref: <https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx#Defeating-the-Attack-using-NGINX-and-NGINX-Plus>"}
+  - {date: "23.10.21:", desc: "Fix Hurricane Electric (HE) DNS validation."}
+  - {date: "12.10.21:", desc: "Fix deprecated LE root cert check to fix failures when using `STAGING=true`, and failures in revoking."}
+  - {date: "06.10.21:", desc: "Added support for Hurricane Electric (HE) DNS validation. Added lxml build deps."}
+  - {date: "01.10.21:", desc: "Check if the cert uses the old LE root cert, revoke and regenerate if necessary. [Here's more info](https://twitter.com/letsencrypt/status/1443621997288767491) on LE root cert expiration"}
+  - {date: "19.09.21:", desc: "Add an optional header to opt out of Google FLoC in `ssl.conf`."}
+  - {date: "17.09.21:", desc: "Mark `SUBDOMAINS` var as optional."}
+  - {date: "01.08.21:", desc: "Add support for ionos dns validation."}
+  - {date: "15.07.21:", desc: "Fix libmaxminddb issue due to upstream change."}
+  - {date: "07.07.21:", desc: "Rebase to alpine 3.14."}
+  - {date: "24.06.21:", desc: "Update default nginx conf folder."}
+  - {date: "28.05.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) authelia-server.conf - Use `resolver.conf` and patch for `CVE-2021-32637`."}
+  - {date: "20.05.21:", desc: "Modify resolver.conf generation to detect and ignore ipv6."}
+  - {date: "14.05.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, ssl.conf, proxy.conf, and the default site-conf - Rework nginx.conf to be inline with alpine upstream and relocate lines from other files. Use linuxserver.io wheel index for pip packages. Switch to using [ffdhe4096](https://ssl-config.mozilla.org/ffdhe4096.txt) for `dhparams.pem` per [RFC7919](https://datatracker.ietf.org/doc/html/rfc7919). Added `worker_processes.conf`, which sets the number of nginx workers, and `resolver.conf`, which sets the dns resolver. Both conf files are auto-generated only on first start and can be user modified later."}
+  - {date: "21.04.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) authelia-server.conf and authelia-location.conf - Add remote name/email headers and pass http method."}
+  - {date: "12.04.21:", desc: "Add php7-gmp and php7-pecl-mailparse."}
+  - {date: "12.04.21:", desc: "Add support for vultr dns validation."}
+  - {date: "14.03.21:", desc: "Add support for directadmin dns validation."}
+  - {date: "12.02.21:", desc: "Clean up rust/cargo cache, which ballooned the image size in the last couple of builds."}
+  - {date: "10.02.21:", desc: "Fix aliyun, domeneshop, inwx and transip dns confs for existing users."}
+  - {date: "09.02.21:", desc: "Rebasing to alpine 3.13. Add nginx mods brotli and dav-ext. Remove nginx mods lua and lua-upstream (due to regression over the last couple of years)."}
+  - {date: "26.01.21:", desc: "Add support for hetzner dns validation."}
+  - {date: "20.01.21:", desc: "Add check for ZeroSSL EAB retrieval."}
+  - {date: "08.01.21:", desc: "Add support for getting certs from [ZeroSSL](https://zerossl.com/) via optional `CERTPROVIDER` env var. Update aliyun, domeneshop, inwx and transip dns plugins with the new plugin names. Hide `donoteditthisfile.conf` because users were editing it despite its name. Suppress harmless error when no proxy confs are enabled."}
+  - {date: "03.01.21:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) /config/nginx/site-confs/default.conf - Add helper pages to aid troubleshooting"}
+  - {date: "10.12.20:", desc: "Add support for njalla dns validation"}
+  - {date: "09.12.20:", desc: "Check for template/conf updates and notify in the log. Add support for gehirn and sakuracloud dns validation."}
+  - {date: "01.11.20:", desc: "Add support for netcup dns validation"}
+  - {date: "29.10.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) ssl.conf - Add frame-ancestors to Content-Security-Policy."}
+  - {date: "04.10.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, proxy.conf, and ssl.conf - Minor cleanups and reordering."}
+  - {date: "20.09.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf - Added geoip2 configs. Added MAXMINDDB_LICENSE_KEY variable to readme."}
+  - {date: "08.09.20:", desc: "Add php7-xsl."}
+  - {date: "01.09.20:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) nginx.conf, proxy.conf, and various proxy samples - Global websockets across all configs."}
+  - {date: "03.08.20:", desc: "Initial release."}

root/app/le-renew.sh

@@ -6,4 +6,4 @@ echo
 echo "<------------------------------------------------->"
 echo "cronjob running on $(date)"
 echo "Running certbot renew"
-certbot renew --non-interactive
+certbot renew --non-interactive --config-dir /config/etc/letsencrypt --logs-dir /config/log/letsencrypt --work-dir /tmp/letsencrypt --config /config/etc/letsencrypt/cli.ini

root/defaults/dns-conf/gandi.ini

@@ -1,7 +1,6 @@
 # Instructions: https://github.com/obynio/certbot-plugin-gandi#usage
-# Replace with your value
-# live dns v5 api key
-dns_gandi_api_key=APIKEY
+# Replace with your Gandi Live DNS v5 Personal Access Token
+dns_gandi_token=TOKEN
 
 # optional organization id, remove it if not used
 #dns_gandi_sharing_id=SHARINGID

root/defaults/dns-conf/hetzner-cloud.ini

@@ -0,0 +1,2 @@
+# Hetzner Cloud API Token
+dns_hetzner_cloud_api_token = your_api_token_here

root/defaults/dns-conf/mijn-host.ini

@@ -0,0 +1,3 @@
+# Instructions: https://github.com/mijnhost/certbot-dns-mijn-host
+# Replace with your API key from your mijn.host account.
+dns_mijn_host_api_key = yourapikeygoeshere

root/defaults/dns-conf/ovh.ini

@@ -1,4 +1,4 @@
-# Instructions: https://github.com/certbot/certbot/blob/master/certbot-dns-ovh/certbot_dns_ovh/__init__.py#L20
+# Instructions: https://github.com/certbot/certbot/blob/main/certbot-dns-ovh/src/certbot_dns_ovh/__init__.py#L24
 # Replace with your values
 dns_ovh_endpoint = ovh-eu
 dns_ovh_application_key = MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw

root/defaults/nginx/authelia-location.conf.sample

@@ -1,13 +1,8 @@
-## Version 2024/03/14 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authelia-location.conf.sample
+## Version 2025/03/25 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authelia-location.conf.sample
 # Make sure that your authelia container is in the same user defined bridge network and is named authelia
 # Rename /config/nginx/proxy-confs/authelia.subdomain.conf.sample to /config/nginx/proxy-confs/authelia.subdomain.conf
-# For authelia 4.37 and below, make sure that the authelia configuration.yml has 'path: "authelia"' defined
-# For authelia 4.38 and above, make sure that the authelia configuration.yml has 'address: "tcp://:9091/authelia"' defined
 
 ## Send a subrequest to Authelia to verify if the user is authenticated and has permission to access the resource
-## For authelia 4.37 and below, use the following line
-# auth_request /authelia/api/verify;
-## For authelia 4.38 and above, use the following line
 auth_request /authelia/api/authz/auth-request;
 
 ## If the subreqest returns 200 pass to the backend, if the subrequest returns 401 redirect to the portal

root/defaults/nginx/authelia-server.conf.sample

@@ -1,44 +1,15 @@
-## Version 2024/03/16 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authelia-server.conf.sample
+## Version 2026/10/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authelia-server.conf.sample
 # Make sure that your authelia container is in the same user defined bridge network and is named authelia
 # Rename /config/nginx/proxy-confs/authelia.subdomain.conf.sample to /config/nginx/proxy-confs/authelia.subdomain.conf
-# For authelia 4.37 and below, make sure that the authelia configuration.yml has 'path: "authelia"' defined
-# For authelia 4.38 and above, make sure that the authelia configuration.yml has 'address: "tcp://:9091/authelia"' defined
 
-# location for authelia subfolder requests
-location ^~ /authelia {
-    auth_request off; # requests to this subfolder must be accessible without authentication
-
-    include /config/nginx/proxy.conf;
-    include /config/nginx/resolver.conf;
-    set $upstream_authelia authelia;
-    proxy_pass http://$upstream_authelia:9091;
-}
-
-# location for authelia 4.37 and below auth requests
-location = /authelia/api/verify {
-    internal;
-
-    include /config/nginx/proxy.conf;
-    include /config/nginx/resolver.conf;
-    set $upstream_authelia authelia;
-    proxy_pass http://$upstream_authelia:9091;
-
-    ## Include the Set-Cookie header if present
-    auth_request_set $set_cookie $upstream_http_set_cookie;
-    add_header Set-Cookie $set_cookie;
-
-    proxy_pass_request_body off;
-    proxy_set_header Content-Length "";
-}
-
-# location for authelia 4.38 and above auth requests
+# location for authelia auth requests
 location = /authelia/api/authz/auth-request {
     internal;
 
     include /config/nginx/proxy.conf;
     include /config/nginx/resolver.conf;
     set $upstream_authelia authelia;
-    proxy_pass http://$upstream_authelia:9091;
+    proxy_pass http://$upstream_authelia:9091/api/authz/auth-request;
 
     ## Include the Set-Cookie header if present
     auth_request_set $set_cookie $upstream_http_set_cookie;
@@ -57,16 +28,11 @@ location @authelia_proxy_signin {
     add_header Set-Cookie $set_cookie;
 
     ## Set the $target_url variable based on the original request
-    set_escape_uri $target_url $scheme://$http_host$request_uri;
+    set_escape_uri $target_url $scheme://$host$is_request_port$request_port$request_uri;
 
     ## Translate the Location response header from the auth subrequest into a variable
     auth_request_set $signin_url $upstream_http_location;
 
-    if ($signin_url = '') {
-        ## Set the $signin_url variable
-        set $signin_url https://$http_host/authelia/?rd=$target_url;
-    }
-
     ## Redirect to login
     return 302 $signin_url;
 }

root/defaults/nginx/authentik-server.conf.sample

@@ -1,4 +1,4 @@
-## Version 2023/04/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authentik-server.conf.sample
+## Version 2026/10/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authentik-server.conf.sample
 # Make sure that your authentik container is in the same user defined bridge network and is named authentik-server
 # Rename /config/nginx/proxy-confs/authentik.subdomain.conf.sample to /config/nginx/proxy-confs/authentik.subdomain.conf
 
@@ -19,7 +19,7 @@ location = /outpost.goauthentik.io/auth/nginx {
     include /config/nginx/proxy.conf;
     include /config/nginx/resolver.conf;
     set $upstream_authentik authentik-server;
-    proxy_pass http://$upstream_authentik:9000;
+    proxy_pass http://$upstream_authentik:9000/outpost.goauthentik.io/auth/nginx;
 
     ## Include the Set-Cookie header if present
     auth_request_set $set_cookie $upstream_http_set_cookie;
@@ -38,10 +38,10 @@ location @goauthentik_proxy_signin {
     add_header Set-Cookie $set_cookie;
 
     ## Set the $target_url variable based on the original request
-    set_escape_uri $target_url $scheme://$http_host$request_uri;
+    set_escape_uri $target_url $scheme://$host$is_request_port$request_port$request_uri;
 
     ## Set the $signin_url variable
-    set $signin_url https://$http_host/outpost.goauthentik.io/start?rd=$target_url;
+    set $signin_url https://$host$is_request_port$request_port/outpost.goauthentik.io/start?rd=$target_url;
 
     ## Redirect to login
     return 302 $signin_url;

root/defaults/nginx/proxy.conf.sample

@@ -1,4 +1,4 @@
-## Version 2023/02/09 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/proxy.conf.sample
+## Version 2026/10/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/proxy.conf.sample
 
 # Timeout if the real server is dead
 proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
@@ -21,17 +21,17 @@ proxy_no_cache $cookie_session;
 # Proxy Header Settings
 proxy_set_header Connection $connection_upgrade;
 proxy_set_header Early-Data $ssl_early_data;
-proxy_set_header Host $host;
+proxy_set_header Host $host; # NOTE: only use $host here, port is handled separately
 proxy_set_header Proxy "";
 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-proxy_set_header X-Forwarded-Host $host;
+proxy_set_header X-Forwarded-Host $host; # NOTE: only use $host here, port is handled separately
 proxy_set_header X-Forwarded-Method $request_method;
-proxy_set_header X-Forwarded-Port $server_port;
+proxy_set_header X-Forwarded-Port $request_port;
 proxy_set_header X-Forwarded-Proto $scheme;
-proxy_set_header X-Forwarded-Server $host;
+proxy_set_header X-Forwarded-Server $host; # NOTE: only use $host here, port is handled separately
 proxy_set_header X-Forwarded-Ssl on;
 proxy_set_header X-Forwarded-Uri $request_uri;
 proxy_set_header X-Original-Method $request_method;
-proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+proxy_set_header X-Original-URL $scheme://$host$is_request_port$request_port$request_uri;
 proxy_set_header X-Real-IP $remote_addr;

root/defaults/nginx/site-confs/default.conf.sample

@@ -1,4 +1,4 @@
-## Version 2024/07/16 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/site-confs/default.conf.sample
+## Version 2026/10/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/site-confs/default.conf.sample
 
 # redirect all traffic to https
 server {
@@ -7,13 +7,20 @@ server {
 
     location / {
         return 301 https://$host$request_uri;
+
+        # NOTE FOR USERS: If your external HTTP and HTTPS ports are asymmetrical
+        # (e.g., External 8443 maps to Nginx 443),
+        # replace the return above this one and hardcode your external HTTPS port:
+        # return 301 https://$host:8443$request_uri;
     }
 }
 
 # main server block
 server {
     listen 443 ssl default_server;
+#    listen 443 quic reuseport default_server;
     listen [::]:443 ssl default_server;
+#    listen [::]:443 quic reuseport default_server;
 
     server_name _;
 
@@ -34,6 +41,9 @@ server {
     # enable for Authentik (requires authentik-location.conf in the location block)
     #include /config/nginx/authentik-server.conf;
 
+    # enable for Tinyauth (requires tinyauth-location.conf in the location block)
+    #include /config/nginx/tinyauth-server.conf;
+
     location / {
         # enable for basic auth
         #auth_basic "Restricted";
@@ -48,6 +58,9 @@ server {
         # enable for Authentik (requires authentik-server.conf in the server block)
         #include /config/nginx/authentik-location.conf;
 
+        # enable for Tinyauth (requires tinyauth-server.conf in the server block)
+        #include /config/nginx/tinyauth-location.conf;
+
         try_files $uri $uri/ /index.html /index.htm /index.php$is_args$args;
     }
 
@@ -80,5 +93,3 @@ server {
 
 # enable subdomain method reverse proxy confs
 include /config/nginx/proxy-confs/*.subdomain.conf;
-# enable proxy cache for auth
-proxy_cache_path cache/ keys_zone=auth_cache:10m;

root/defaults/nginx/tinyauth-location.conf.sample

@@ -0,0 +1,22 @@
+## Version 2026/07/19 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-location.conf.sample
+# Make sure that your tinyauth container is in the same user defined bridge network and is named tinyauth
+# Rename /config/nginx/proxy-confs/tinyauth.subdomain.conf.sample to /config/nginx/proxy-confs/tinyauth.subdomain.conf
+
+## Send a subrequest to tinyauth to verify if the user is authenticated and has permission to access the resource
+auth_request /tinyauth;
+auth_request_set $redirection_url $upstream_http_x_tinyauth_location;
+error_page 401 403 =302 $redirection_url;
+
+## Translate the user information response headers from the auth subrequest into variables
+auth_request_set $email $upstream_http_remote_email;
+auth_request_set $groups $upstream_http_remote_groups;
+auth_request_set $name $upstream_http_remote_name;
+auth_request_set $user $upstream_http_remote_user;
+
+## Inject the user information into the request made to the actual upstream
+proxy_set_header Remote-Email $email;
+proxy_set_header Remote-Groups $groups;
+proxy_set_header Remote-Name $name;
+proxy_set_header Remote-User $user;
+
+## Can be extended with more custom headers https://tinyauth.app/docs/reference/headers#nginxnginx-proxy-manager

root/defaults/nginx/tinyauth-server.conf.sample

@@ -0,0 +1,22 @@
+## Version 2026/10/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-server.conf.sample
+# Make sure that your tinyauth container is in the same user defined bridge network and is named tinyauth
+# Rename /config/nginx/proxy-confs/tinyauth.subdomain.conf.sample to /config/nginx/proxy-confs/tinyauth.subdomain.conf
+
+# location for tinyauth auth requests
+location /tinyauth {
+    internal;
+
+    include /config/nginx/resolver.conf;
+    set $upstream_tinyauth tinyauth;
+    proxy_pass http://$upstream_tinyauth:3000/api/auth/nginx;
+
+    # Don't send the body to the auth server
+    proxy_pass_request_body off;
+    proxy_set_header Content-Length "";
+
+    # Headers needed for authentication
+    proxy_set_header X-Original-URL $scheme://$host$is_request_port$request_port$request_uri;
+    proxy_set_header X-Original-Method $request_method;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Real-IP $remote_addr;
+}

root/etc/crontabs/root

@@ -5,4 +5,4 @@
 0       3       *       *       6       run-parts /etc/periodic/weekly
 0       5       1       *       *       run-parts /etc/periodic/monthly
 
-8       2       *       *       *       /app/le-renew.sh >> /config/log/letsencrypt/letsencrypt.log 2>&1
+0       */12    *       *       *       sleep $((60 + $RANDOM % 230)); /app/le-renew.sh >> /config/log/letsencrypt/renewal.log 2>&1

root/etc/s6-overlay/s6-rc.d/init-certbot-config/run

@@ -12,12 +12,13 @@ EXTRA_DOMAINS=${EXTRA_DOMAINS}\\n\
 ONLY_SUBDOMAINS=${ONLY_SUBDOMAINS}\\n\
 VALIDATION=${VALIDATION}\\n\
 CERTPROVIDER=${CERTPROVIDER}\\n\
+CERT_PROFILE=${CERT_PROFILE}\\n\
 DNSPLUGIN=${DNSPLUGIN}\\n\
 EMAIL=${EMAIL}\\n\
 STAGING=${STAGING}\\n"
 
 # Sanitize variables
-SANED_VARS=(DNSPLUGIN EMAIL EXTRA_DOMAINS ONLY_SUBDOMAINS STAGING SUBDOMAINS URL VALIDATION CERTPROVIDER)
+SANED_VARS=(DNSPLUGIN EMAIL EXTRA_DOMAINS ONLY_SUBDOMAINS STAGING SUBDOMAINS URL VALIDATION CERTPROVIDER CERT_PROFILE)
 for i in "${SANED_VARS[@]}"; do
     export echo "${i}"="${!i//\"/}"
     export echo "${i}"="$(echo "${!i}" | tr '[:upper:]' '[:lower:]')"
@@ -38,12 +39,6 @@ if [[ "${VALIDATION}" = "dns" ]] && ! echo "${CERTBOT_DNS_AUTHENTICATORS}" | gre
     sleep infinity
 fi
 
-# set owner of certbot's CONFIG_DIR, WORK_DIR, and LOGS_DIR to abc
-lsiown -R abc:abc \
-    /etc/letsencrypt \
-    /var/lib/letsencrypt \
-    /var/log/letsencrypt
-
 # set_ini_value logic:
 # - if the name is not found in the file, append the name=value to the end of the file
 # - if the name is found in the file, replace the value
@@ -62,12 +57,17 @@ touch /config/etc/letsencrypt/cli.ini
 lsiown abc:abc /config/etc/letsencrypt/cli.ini
 grep -qF 'agree-tos' /config/etc/letsencrypt/cli.ini || echo 'agree-tos=true' >>/config/etc/letsencrypt/cli.ini
 
+# Check for broken dns credentials value in cli.ini and remove
+sed -i '/dns--credentials/d' /config/etc/letsencrypt/cli.ini
+
+# Disable Certbot's built in log rotation
+set_ini_value "max-log-backups" "0" /config/etc/letsencrypt/cli.ini
+
 # copy dns default configs
 cp -n /defaults/dns-conf/* /config/dns-conf/ 2> >(grep -v 'cp: not replacing')
 lsiown -R abc:abc /config/dns-conf
 
 # copy default renewal hooks
-chmod -R +x /defaults/etc/letsencrypt/renewal-hooks
 cp -nR /defaults/etc/letsencrypt/renewal-hooks/* /config/etc/letsencrypt/renewal-hooks/ 2> >(grep -v 'cp: not replacing')
 lsiown -R abc:abc /config/etc/letsencrypt/renewal-hooks
 
@@ -81,7 +81,7 @@ if [[ -f "/config/donoteditthisfile.conf" ]]; then
     mv /config/donoteditthisfile.conf /config/.donoteditthisfile.conf
 fi
 if [[ ! -f "/config/.donoteditthisfile.conf" ]]; then
-    echo -e "ORIGURL=\"${URL}\" ORIGSUBDOMAINS=\"${SUBDOMAINS}\" ORIGONLY_SUBDOMAINS=\"${ONLY_SUBDOMAINS}\" ORIGEXTRA_DOMAINS=\"${EXTRA_DOMAINS}\" ORIGVALIDATION=\"${VALIDATION}\" ORIGDNSPLUGIN=\"${DNSPLUGIN}\" ORIGPROPAGATION=\"${PROPAGATION}\" ORIGSTAGING=\"${STAGING}\" ORIGCERTPROVIDER=\"${CERTPROVIDER}\" ORIGEMAIL=\"${EMAIL}\"" >/config/.donoteditthisfile.conf
+    echo -e "ORIGURL=\"${URL}\" ORIGSUBDOMAINS=\"${SUBDOMAINS}\" ORIGONLY_SUBDOMAINS=\"${ONLY_SUBDOMAINS}\" ORIGEXTRA_DOMAINS=\"${EXTRA_DOMAINS}\" ORIGVALIDATION=\"${VALIDATION}\" ORIGDNSPLUGIN=\"${DNSPLUGIN}\" ORIGPROPAGATION=\"${PROPAGATION}\" ORIGSTAGING=\"${STAGING}\" ORIGCERTPROVIDER=\"${CERTPROVIDER}\" ORIGEMAIL=\"${EMAIL}\" ORIGCERT_PROFILE=\"${CERT_PROFILE}\"" >/config/.donoteditthisfile.conf
     echo "Created .donoteditthisfile.conf"
 fi
 
@@ -175,8 +175,8 @@ else
 fi
 
 # cleanup unused csr and keys folders
-rm -rf /etc/letsencrypt/csr
-rm -rf /etc/letsencrypt/keys
+rm -rf /config/etc/letsencrypt/csr
+rm -rf /config/etc/letsencrypt/keys
 
 # checking for changes in cert variables, revoking certs if necessary
 if [[ ! "${URL}" = "${ORIGURL}" ]] ||
@@ -187,7 +187,8 @@ if [[ ! "${URL}" = "${ORIGURL}" ]] ||
     [[ ! "${DNSPLUGIN}" = "${ORIGDNSPLUGIN}" ]] ||
     [[ ! "${PROPAGATION}" = "${ORIGPROPAGATION}" ]] ||
     [[ ! "${STAGING}" = "${ORIGSTAGING}" ]] ||
-    [[ ! "${CERTPROVIDER}" = "${ORIGCERTPROVIDER}" ]]; then
+    [[ ! "${CERTPROVIDER}" = "${ORIGCERTPROVIDER}" ]] ||
+    [[ ! "${CERT_PROFILE}" = "${ORIGCERT_PROFILE}" ]]; then
     echo "Different validation parameters entered than what was used before. Revoking and deleting existing certificate, and an updated one will be created"
     if [[ "${ORIGCERTPROVIDER}" = "zerossl" ]]; then
         REV_ACMESERVER=("https://acme.zerossl.com/v2/DV90")
@@ -197,27 +198,15 @@ if [[ ! "${URL}" = "${ORIGURL}" ]] ||
         REV_ACMESERVER=("https://acme-v02.api.letsencrypt.org/directory")
     fi
     if [[ -f /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem ]]; then
-        certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem --key-path /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/privkey.pem --server "${REV_ACMESERVER[@]}" || true
+        certbot revoke --config-dir /config/etc/letsencrypt --logs-dir /config/log/letsencrypt --work-dir /tmp/letsencrypt --config /config/etc/letsencrypt/cli.ini --non-interactive --cert-path /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem --key-path /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/privkey.pem --server "${REV_ACMESERVER[@]}" || true
     else
-        certbot revoke --non-interactive --cert-name "${ORIGDOMAIN}" --server "${REV_ACMESERVER[@]}" || true
+        certbot revoke --config-dir /config/etc/letsencrypt --logs-dir /config/log/letsencrypt --work-dir /tmp/letsencrypt --config /config/etc/letsencrypt/cli.ini --non-interactive --cert-name "${ORIGDOMAIN}" --server "${REV_ACMESERVER[@]}" || true
     fi
     rm -rf /config/etc/letsencrypt/{accounts,archive,live,renewal}
 fi
 
 # saving new variables
-echo -e "ORIGURL=\"${URL}\" ORIGSUBDOMAINS=\"${SUBDOMAINS}\" ORIGONLY_SUBDOMAINS=\"${ONLY_SUBDOMAINS}\" ORIGEXTRA_DOMAINS=\"${EXTRA_DOMAINS}\" ORIGVALIDATION=\"${VALIDATION}\" ORIGDNSPLUGIN=\"${DNSPLUGIN}\" ORIGPROPAGATION=\"${PROPAGATION}\" ORIGSTAGING=\"${STAGING}\" ORIGCERTPROVIDER=\"${CERTPROVIDER}\" ORIGEMAIL=\"${EMAIL}\"" >/config/.donoteditthisfile.conf
-
-# Check if the cert is using the old LE root cert, revoke and regen if necessary
-if [[ -f "/config/keys/letsencrypt/chain.pem" ]] && { [[ "${CERTPROVIDER}" == "letsencrypt" ]] || [[ "${CERTPROVIDER}" == "" ]]; } && [[ "${STAGING}" != "true" ]] && ! openssl x509 -in /config/keys/letsencrypt/chain.pem -noout -issuer | grep -q "ISRG Root X"; then
-    echo "The cert seems to be using the old LE root cert, which is no longer valid. Deleting and revoking."
-    REV_ACMESERVER=("https://acme-v02.api.letsencrypt.org/directory")
-    if [[ -f /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem ]]; then
-        certbot revoke --non-interactive --cert-path /config/etc/letsencrypt/live/"${ORIGDOMAIN}"/fullchain.pem --server "${REV_ACMESERVER[@]}" || true
-    else
-        certbot revoke --non-interactive --cert-name "${ORIGDOMAIN}" --server "${REV_ACMESERVER[@]}" || true
-    fi
-    rm -rf /config/etc/letsencrypt/{accounts,archive,live,renewal}
-fi
+echo -e "ORIGURL=\"${URL}\" ORIGSUBDOMAINS=\"${SUBDOMAINS}\" ORIGONLY_SUBDOMAINS=\"${ONLY_SUBDOMAINS}\" ORIGEXTRA_DOMAINS=\"${EXTRA_DOMAINS}\" ORIGVALIDATION=\"${VALIDATION}\" ORIGDNSPLUGIN=\"${DNSPLUGIN}\" ORIGPROPAGATION=\"${PROPAGATION}\" ORIGSTAGING=\"${STAGING}\" ORIGCERTPROVIDER=\"${CERTPROVIDER}\" ORIGEMAIL=\"${EMAIL}\" ORIGCERT_PROFILE=\"${CERT_PROFILE}\"" >/config/.donoteditthisfile.conf
 
 # if zerossl is selected or staging is set to true, use the relevant server
 if [[ "${CERTPROVIDER}" = "zerossl" ]] && [[ "${STAGING}" = "true" ]]; then
@@ -240,6 +229,21 @@ fi
 
 set_ini_value "server" "${ACMESERVER}" /config/etc/letsencrypt/cli.ini
 
+# set certificate profile (e.g. "shortlived" for 6-day certs, "classic" for 90-day)
+# Profiles are a Let's Encrypt ACME feature; ZeroSSL ignores it.
+if [[ -n "${CERT_PROFILE}" ]]; then
+    if [[ "${CERTPROVIDER}" = "zerossl" ]]; then
+        echo "ZeroSSL does not support ACME profiles, ignoring CERT_PROFILE variable"
+        sed -i "/^preferred-profile\b/d" /config/etc/letsencrypt/cli.ini
+    else
+        echo "Requesting certificate with profile: ${CERT_PROFILE}"
+        set_ini_value "preferred-profile" "${CERT_PROFILE}" /config/etc/letsencrypt/cli.ini
+    fi
+else
+    # remove if previously set so going back to default works
+    sed -i "/^preferred-profile\b/d" /config/etc/letsencrypt/cli.ini
+fi
+
 # figuring out domain only vs domain & subdomains vs subdomains only
 DOMAINS_ARRAY=()
 if [[ -z "${SUBDOMAINS}" ]] || [[ "${ONLY_SUBDOMAINS}" != true ]]; then
@@ -304,7 +308,7 @@ if [[ "${VALIDATION}" = "dns" ]]; then
         sed -i "/^dns-${DNSPLUGIN}-credentials\b/d" /config/etc/letsencrypt/cli.ini
     fi
     # plugins that don't support setting propagation
-    if [[ "${DNSPLUGIN}" =~ ^(azure|gandi|route53|standalone)$ ]]; then
+    if [[ "${DNSPLUGIN}" =~ ^(gandi|route53|standalone)$ ]]; then
         if [[ -n "${PROPAGATION}" ]]; then echo "${DNSPLUGIN} dns plugin does not support setting propagation time"; fi
         sed -i "/^dns-${DNSPLUGIN}-propagation-seconds\b/d" /config/etc/letsencrypt/cli.ini
     fi
@@ -347,7 +351,7 @@ if [[ ! -f "/config/keys/letsencrypt/fullchain.pem" ]]; then
         set_ini_value "eab-hmac-key" "${ZEROSSL_EAB_HMAC_KEY}" /config/etc/letsencrypt/cli.ini
     fi
     echo "Generating new certificate"
-    certbot certonly --non-interactive --renew-by-default
+    certbot certonly --config-dir /config/etc/letsencrypt --logs-dir /config/log/letsencrypt --work-dir /tmp/letsencrypt --config /config/etc/letsencrypt/cli.ini --non-interactive --renew-by-default
     if [[ ! -d /config/keys/letsencrypt ]]; then
         if [[ "${VALIDATION}" = "dns" ]]; then
             echo "ERROR: Cert does not exist! Please see the validation error above. Make sure you entered correct credentials into the ${DNSCREDENTIALFILE} file."

root/etc/s6-overlay/s6-rc.d/init-fail2ban-config/run

@@ -1,38 +1,40 @@
 #!/usr/bin/with-contenv bash
 # shellcheck shell=bash
 
-if ! iptables -L &> /dev/null; then
-  ln -sf /sbin/xtables-legacy-multi /sbin/iptables
-  ln -sf /sbin/xtables-legacy-multi /sbin/iptables-save
-  ln -sf /sbin/xtables-legacy-multi /sbin/iptables-restore
-  ln -sf /sbin/xtables-legacy-multi /sbin/ip6tables
-  ln -sf /sbin/xtables-legacy-multi /sbin/ip6tables-save
-  ln -sf /sbin/xtables-legacy-multi /sbin/ip6tables-restore
-fi
+if [[ -z ${LSIO_READ_ONLY_FS} ]] && [[ -z ${LSIO_NON_ROOT_USER} ]] && [[ "${DISABLE_F2B,,}" != "true" ]]; then
+    if ! iptables -L &> /dev/null; then
+        ln -sf /usr/sbin/xtables-legacy-multi /usr/sbin/iptables
+        ln -sf /usr/sbin/xtables-legacy-multi /usr/sbin/iptables-save
+        ln -sf /usr/sbin/xtables-legacy-multi /usr/sbin/iptables-restore
+        ln -sf /usr/sbin/xtables-legacy-multi /usr/sbin/ip6tables
+        ln -sf /usr/sbin/xtables-legacy-multi /usr/sbin/ip6tables-save
+        ln -sf /usr/sbin/xtables-legacy-multi /usr/sbin/ip6tables-restore
+    fi
 
-# copy/update the fail2ban config defaults to/in /config
-cp -R /defaults/fail2ban/filter.d /config/fail2ban/
-cp -R /defaults/fail2ban/action.d /config/fail2ban/
-# if jail.local is missing in /config, copy default
-if [[ ! -f /config/fail2ban/jail.local ]]; then
-    cp /defaults/fail2ban/jail.local /config/fail2ban/jail.local
-fi
-# Replace fail2ban config with user config
-if [[ -d /etc/fail2ban/filter.d ]]; then
-    rm -rf /etc/fail2ban/filter.d
-fi
-if [[ -d /etc/fail2ban/action.d ]]; then
-    rm -rf /etc/fail2ban/action.d
-fi
-cp -R /config/fail2ban/filter.d /etc/fail2ban/
-cp -R /config/fail2ban/action.d /etc/fail2ban/
-cp /defaults/fail2ban/fail2ban.local /etc/fail2ban/
-cp /config/fail2ban/jail.local /etc/fail2ban/jail.local
+    # copy/update the fail2ban config defaults to/in /config
+    cp -R /defaults/fail2ban/filter.d /config/fail2ban/
+    cp -R /defaults/fail2ban/action.d /config/fail2ban/
+    # if jail.local is missing in /config, copy default
+    if [[ ! -f /config/fail2ban/jail.local ]]; then
+        cp /defaults/fail2ban/jail.local /config/fail2ban/jail.local
+    fi
+    # Replace fail2ban config with user config
+    if [[ -d /etc/fail2ban/filter.d ]]; then
+        rm -rf /etc/fail2ban/filter.d
+    fi
+    if [[ -d /etc/fail2ban/action.d ]]; then
+        rm -rf /etc/fail2ban/action.d
+    fi
+    cp -R /config/fail2ban/filter.d /etc/fail2ban/
+    cp -R /config/fail2ban/action.d /etc/fail2ban/
+    cp /defaults/fail2ban/fail2ban.local /etc/fail2ban/
+    cp /config/fail2ban/jail.local /etc/fail2ban/jail.local
 
-# logfiles needed by fail2ban
-if [[ ! -f /config/log/nginx/error.log ]]; then
-    touch /config/log/nginx/error.log
-fi
-if [[ ! -f /config/log/nginx/access.log ]]; then
-    touch /config/log/nginx/access.log
+    # logfiles needed by fail2ban
+    if [[ ! -f /config/log/nginx/error.log ]]; then
+        touch /config/log/nginx/error.log
+    fi
+    if [[ ! -f /config/log/nginx/access.log ]]; then
+        touch /config/log/nginx/access.log
+    fi
 fi

root/etc/s6-overlay/s6-rc.d/init-folders-config/up

@@ -1 +0,0 @@
-/etc/s6-overlay/s6-rc.d/init-folders-config/run

root/etc/s6-overlay/s6-rc.d/init-nginx-config/up

@@ -1 +0,0 @@
-/etc/s6-overlay/s6-rc.d/init-nginx-config/run

root/etc/s6-overlay/s6-rc.d/init-outdated-config/run

@@ -11,3 +11,9 @@ if [[ -f /config/nginx/ldap.conf ]]; then
         Ensure your configs are updated and remove /config/nginx/ldap.conf
         If you do not use this config, simply remove it."
 fi
+if grep -qrle ' /etc/letsencrypt' /config/nginx; then
+    echo "    The following nginx confs are using certificates from the obsolete location
+    /etc/letsencrypt and should be updated to point to /config/etc/letsencrypt
+        "
+    echo -n "    " && grep -rle ' /etc/letsencrypt' /config/nginx
+fi

root/etc/s6-overlay/s6-rc.d/init-permissions-config/run

@@ -2,8 +2,7 @@
 # shellcheck shell=bash
 
 # permissions
+find /config/log ! -path '/config/log/logrotate.status' -exec chmod +r {} \+
+
 lsiown -R abc:abc \
     /config
-chmod -R 0644 /etc/logrotate.d
-chmod -R +r /config/log
-chmod +x /app/le-renew.sh

root/etc/s6-overlay/s6-rc.d/init-renew/run

@@ -3,7 +3,7 @@
 
 # Check if the cert is expired or expires within a day, if so, renew
 if openssl x509 -in /config/keys/letsencrypt/fullchain.pem -noout -checkend 86400 >/dev/null; then
-    echo "The cert does not expire within the next day. Letting the cron script handle the renewal attempts overnight (2:08am)."
+    echo "The cert does not expire within the next day. Letting the cron script handle the renewal attempts."
 else
     echo "The cert is either expired or it expires within the next day. Attempting to renew. This could take up to 10 minutes."
     /app/le-renew.sh

root/etc/s6-overlay/s6-rc.d/init-samples-config/up

@@ -1 +0,0 @@
-/etc/s6-overlay/s6-rc.d/init-samples-config/run

root/etc/s6-overlay/s6-rc.d/init-swag-config/run

@@ -22,6 +22,14 @@ if [[ ! -f /config/nginx/authentik-server.conf ]]; then
     cp /defaults/nginx/authentik-server.conf.sample /config/nginx/authentik-server.conf
 fi
 
+# copy tinyauth config files if they don't exist
+if [[ ! -f /config/nginx/tinyauth-location.conf ]]; then
+    cp /defaults/nginx/tinyauth-location.conf.sample /config/nginx/tinyauth-location.conf
+fi
+if [[ ! -f /config/nginx/tinyauth-server.conf ]]; then
+    cp /defaults/nginx/tinyauth-server.conf.sample /config/nginx/tinyauth-server.conf
+fi
+
 # copy old ldap config file to new location
 if [[ -f /config/nginx/ldap.conf ]] && [[ ! -f /config/nginx/ldap-server.conf ]]; then
     cp /config/nginx/ldap.conf /config/nginx/ldap-server.conf

root/etc/s6-overlay/s6-rc.d/init-swag-config/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/init-swag-config/run

root/etc/s6-overlay/s6-rc.d/init-swag-folders/run

@@ -7,6 +7,6 @@ mkdir -p \
     /config/etc/letsencrypt/renewal-hooks \
     /config/log/{fail2ban,letsencrypt,nginx} \
     /config/nginx/proxy-confs \
-    /run/fail2ban
-rm -rf /etc/letsencrypt
-ln -s /config/etc/letsencrypt /etc/letsencrypt
+    /run/fail2ban \
+    /tmp/letsencrypt
+

root/etc/s6-overlay/s6-rc.d/init-swag-folders/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/init-swag-folders/run

root/etc/s6-overlay/s6-rc.d/init-swag-samples/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/init-swag-samples/run

root/etc/s6-overlay/s6-rc.d/init-test-run/run

@@ -1,7 +0,0 @@
-#!/usr/bin/with-contenv bash
-# shellcheck shell=bash
-
-# Echo init finish for test runs
-if [[ -n "${TEST_RUN}" ]]; then
-    echo '[services.d] done.'
-fi

root/etc/s6-overlay/s6-rc.d/init-test-run/type

@@ -1 +0,0 @@
-oneshot

root/etc/s6-overlay/s6-rc.d/init-test-run/up

@@ -1 +0,0 @@
-/etc/s6-overlay/s6-rc.d/init-test-run/run

root/etc/s6-overlay/s6-rc.d/svc-fail2ban/run

@@ -1,5 +1,9 @@
 #!/usr/bin/with-contenv bash
 # shellcheck shell=bash
 
-exec \
-    fail2ban-client -x -f start
+if [[ -z ${LSIO_READ_ONLY_FS} ]] && [[ -z ${LSIO_NON_ROOT_USER} ]] && [[ "${DISABLE_F2B,,}" != "true" ]]; then
+    exec \
+        fail2ban-client -x -f start
+else
+    sleep infinity
+fi

root/etc/s6-overlay/s6-rc.d/svc-swag-auto-reload/run

@@ -0,0 +1,41 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+if [[ ${SWAG_AUTORELOAD,,} == "true" ]]; then
+    if [[ -f "/etc/s6-overlay/s6-rc.d/svc-mod-swag-auto-reload/run" ]]; then
+        echo "ERROR: Legacy SWAG Auto Reload Mod detected, to use the built-in Auto Reload functionality please remove it from your container config."
+        sleep infinity
+    else
+        echo "Auto-reload: Watching the following folders for changes to .conf files:"
+        echo "/config/nginx"
+        ACTIVE_WATCH=("/config/nginx")
+        for i in $(echo "${SWAG_AUTORELOAD_WATCHLIST}" | tr "|" " "); do
+            if [ -f "${i}" ] || [ -d "${i}" ]; then
+                echo "${i}"
+                ACTIVE_WATCH+=("${i}")
+            fi
+            done
+
+            function wait_for_changes {
+            inotifywait -rq \
+                --event modify,move,create,delete \
+                --includei '\.conf$' \
+                "${ACTIVE_WATCH[@]}"
+            }
+
+            while wait_for_changes; do
+            NGINX_CONF=()
+            if ! grep -q "/config/nginx/nginx.conf" /etc/nginx/nginx.conf; then
+                NGINX_CONF=("-c" "/config/nginx/nginx.conf")
+            fi
+            if /usr/sbin/nginx "${NGINX_CONF[@]}" -t; then
+                echo "Changes to nginx config detected and the changes are valid, reloading nginx"
+                /usr/sbin/nginx "${NGINX_CONF[@]}" -s reload
+            else
+                echo "Changes to nginx config detected but the changes are not valid, skipping nginx reload. Please fix your config."
+            fi
+        done
+    fi
+else
+    sleep infinity
+fi

root/etc/s6-overlay/s6-rc.d/svc-swag-auto-reload/type

@@ -0,0 +1 @@
+longrun

root/migrations/02-swag-old-certbot-paths

@@ -0,0 +1,7 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+# Migrate existing renewal confs with old paths from /etc/letsencrypt to /config/etc/letsencrypt
+if ls /config/etc/letsencrypt/renewal/*.conf >/dev/null 2>&1; then
+    sed -i 's| /etc/letsencrypt| /config/etc/letsencrypt|' /config/etc/letsencrypt/renewal/*.conf
+fi