From d66e5701c597c0b54c22f24d6229f940a8c7b1e8 Mon Sep 17 00:00:00 2001
From: andy-vdg <andy.vdg@gmail.com>
Date: Fri, 23 Oct 2026 16:04:53 +0200
Subject: [PATCH 1/7] agentgateway: add ct/agentgateway.sh

---
 ct/agentgateway.sh | 67 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 ct/agentgateway.sh

diff --git a/ct/agentgateway.sh b/ct/agentgateway.sh
new file mode 100644
index 0000000000..8b392b1fc3
--- /dev/null
+++ b/ct/agentgateway.sh
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/DevScripts/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: andy-vdg
+# License: MIT | https://github.com/community-scripts/DevScripts/raw/main/LICENSE
+# Source: https://agentgateway.dev/
+
+APP="agentgateway"
+var_tags="${var_tags:-ai;proxy;mcp}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-2}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /opt/agentgateway/agentgateway ]]; then
+    msg_error "No agentgateway Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "agentgateway" "agentgateway/agentgateway"; then
+    msg_info "Stopping Service"
+    systemctl stop agentgateway
+    msg_ok "Stopped Service"
+
+    fetch_and_deploy_gh_release "agentgateway" "agentgateway/agentgateway" "singlefile" "latest" "/opt/agentgateway" "agentgateway-linux-$(arch_resolve "amd64" "arm64")"
+
+    msg_info "Verifying agentgateway Checksum"
+    AGW_SUM=$(curl -fsSL "https://github.com/agentgateway/agentgateway/releases/download/v$(cat ~/.agentgateway)/agentgateway-linux-$(arch_resolve "amd64" "arm64").sha256" | awk '{print $1}')
+    if [[ -z "$AGW_SUM" || "$AGW_SUM" != "$(sha256sum /opt/agentgateway/agentgateway | awk '{print $1}')" ]]; then
+      msg_error "agentgateway checksum does not match the release"
+      exit 1
+    fi
+    chmod +x /opt/agentgateway/agentgateway
+    msg_ok "Verified agentgateway Checksum"
+
+    msg_info "Starting Service"
+    systemctl start agentgateway
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:4000/ui${CL}"

From 10ef9ffeac788f6b8d4e8894c8db65e772bd0f6a Mon Sep 17 00:00:00 2001
From: andy-vdg <andy.vdg@gmail.com>
Date: Fri, 23 Oct 2026 16:04:56 +0200
Subject: [PATCH 2/7] agentgateway: add install/agentgateway-install.sh

---
 install/agentgateway-install.sh | 68 +++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 install/agentgateway-install.sh

diff --git a/install/agentgateway-install.sh b/install/agentgateway-install.sh
new file mode 100644
index 0000000000..c7f350f31f
--- /dev/null
+++ b/install/agentgateway-install.sh
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: andy-vdg
+# License: MIT | https://github.com/community-scripts/DevScripts/raw/main/LICENSE
+# Source: https://agentgateway.dev/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+fetch_and_deploy_gh_release "agentgateway" "agentgateway/agentgateway" "singlefile" "latest" "/opt/agentgateway" "agentgateway-linux-$(arch_resolve "amd64" "arm64")"
+
+msg_info "Verifying agentgateway Checksum"
+AGW_SUM=$(curl -fsSL "https://github.com/agentgateway/agentgateway/releases/download/v$(cat ~/.agentgateway)/agentgateway-linux-$(arch_resolve "amd64" "arm64").sha256" | awk '{print $1}')
+if [[ -z "$AGW_SUM" || "$AGW_SUM" != "$(sha256sum /opt/agentgateway/agentgateway | awk '{print $1}')" ]]; then
+  msg_error "agentgateway checksum does not match the release"
+  exit 1
+fi
+chmod +x /opt/agentgateway/agentgateway
+msg_ok "Verified agentgateway Checksum"
+
+msg_info "Configuring agentgateway"
+mkdir -p /etc/agentgateway /opt/agentgateway_data
+cat <<EOF >/etc/agentgateway/config.yaml
+# yaml-language-server: \$schema=https://agentgateway.dev/schema/config
+# The config agentgateway bootstraps on first run: traffic and the UI on port 4000,
+# state in SQLite. The UI has no login until you add policies:
+# https://agentgateway.dev/docs/standalone/latest/documentation/setup/ui/secure-ui/
+config:
+  database:
+    url: sqlite:///opt/agentgateway_data/data.db
+gateways:
+  default:
+    port: 4000
+ui:
+  gateways: default
+EOF
+chmod 600 /etc/agentgateway/config.yaml
+msg_ok "Configured agentgateway"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/agentgateway.service
+[Unit]
+Description=agentgateway
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+ExecStart=/opt/agentgateway/agentgateway -f /etc/agentgateway/config.yaml
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now agentgateway
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

From 0afaf91fd0bb662b83b4bcb25d3afc804d9668ee Mon Sep 17 00:00:00 2001
From: andy-vdg <andy.vdg@gmail.com>
Date: Fri, 23 Oct 2026 16:04:58 +0200
Subject: [PATCH 3/7] agentgateway: add json/agentgateway.json

---
 json/agentgateway.json | 54 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 json/agentgateway.json

diff --git a/json/agentgateway.json b/json/agentgateway.json
new file mode 100644
index 0000000000..5d5dd44959
--- /dev/null
+++ b/json/agentgateway.json
@@ -0,0 +1,54 @@
+{
+  "name": "agentgateway",
+  "slug": "agentgateway",
+  "categories": [
+    20,
+    21
+  ],
+  "date_created": "2026-10-23",
+  "type": "ct",
+  "updateable": true,
+  "privileged": false,
+  "interface_port": 4000,
+  "documentation": "https://agentgateway.dev/docs/",
+  "website": "https://agentgateway.dev/",
+  "repository": "https://github.com/agentgateway/agentgateway",
+  "architectures": [
+    "amd64",
+    "arm64"
+  ],
+  "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/agentgateway.webp",
+  "description": "agentgateway is an open-source proxy for AI agents, from the Linux Foundation. It sits in front of MCP servers, LLM providers and HTTP APIs, and adds authentication, authorization, rate limits and observability, so agents can reach tools without holding the upstream credentials.",
+  "install_methods": [
+    {
+      "type": "default",
+      "script": "ct/agentgateway.sh",
+      "config_path": "/etc/agentgateway/config.yaml",
+      "resources": {
+        "cpu": 1,
+        "ram": 512,
+        "hdd": 2,
+        "os": "Debian",
+        "version": "13"
+      }
+    }
+  ],
+  "default_credentials": {
+    "username": null,
+    "password": null
+  },
+  "notes": [
+    {
+      "text": "Open http://<IP>:4000/ui and the Welcome to Agentgateway wizard guides the first setup.",
+      "type": "info"
+    },
+    {
+      "text": "The UI and gateway on port 4000 have no login until you add policies (ui.policies: basicAuth, OIDC, JWT). See https://agentgateway.dev/docs/standalone/latest/documentation/setup/ui/secure-ui/",
+      "type": "warning"
+    },
+    {
+      "text": "Config: /etc/agentgateway/config.yaml, data: /opt/agentgateway_data. The admin interface stays on 127.0.0.1:15000, as upstream ships it.",
+      "type": "info"
+    }
+  ]
+}

From be2b6f72085f56cc40db2b3ffabf1b8f5c557a84 Mon Sep 17 00:00:00 2001
From: andy-vdg <andy.vdg@gmail.com>
Date: Fri, 23 Oct 2026 16:35:29 +0200
Subject: [PATCH 4/7] agentgateway: restore and restart the previous binary if
 the update download or checksum fails

---
 ct/agentgateway.sh | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/ct/agentgateway.sh b/ct/agentgateway.sh
index 8b392b1fc3..6a24755fc5 100644
--- a/ct/agentgateway.sh
+++ b/ct/agentgateway.sh
@@ -34,20 +34,27 @@ function update_script() {
   fi
 
   if check_for_gh_release "agentgateway" "agentgateway/agentgateway"; then
+    cp -a /opt/agentgateway/agentgateway /opt/agentgateway/agentgateway.bak
+    cp -a ~/.agentgateway ~/.agentgateway.bak
+
     msg_info "Stopping Service"
     systemctl stop agentgateway
     msg_ok "Stopped Service"
 
-    fetch_and_deploy_gh_release "agentgateway" "agentgateway/agentgateway" "singlefile" "latest" "/opt/agentgateway" "agentgateway-linux-$(arch_resolve "amd64" "arm64")"
-
-    msg_info "Verifying agentgateway Checksum"
-    AGW_SUM=$(curl -fsSL "https://github.com/agentgateway/agentgateway/releases/download/v$(cat ~/.agentgateway)/agentgateway-linux-$(arch_resolve "amd64" "arm64").sha256" | awk '{print $1}')
-    if [[ -z "$AGW_SUM" || "$AGW_SUM" != "$(sha256sum /opt/agentgateway/agentgateway | awk '{print $1}')" ]]; then
-      msg_error "agentgateway checksum does not match the release"
+    # Any failure from here on puts the previous binary back and restarts it.
+    if fetch_and_deploy_gh_release "agentgateway" "agentgateway/agentgateway" "singlefile" "latest" "/opt/agentgateway" "agentgateway-linux-$(arch_resolve "amd64" "arm64")" &&
+      AGW_SUM=$(curl -fsSL "https://github.com/agentgateway/agentgateway/releases/download/v$(cat ~/.agentgateway)/agentgateway-linux-$(arch_resolve "amd64" "arm64").sha256" | awk '{print $1}') &&
+      [[ -n "$AGW_SUM" && "$AGW_SUM" == "$(sha256sum /opt/agentgateway/agentgateway | awk '{print $1}')" ]]; then
+      chmod +x /opt/agentgateway/agentgateway
+      rm -f /opt/agentgateway/agentgateway.bak ~/.agentgateway.bak
+      msg_ok "Verified agentgateway Checksum"
+    else
+      mv /opt/agentgateway/agentgateway.bak /opt/agentgateway/agentgateway
+      mv ~/.agentgateway.bak ~/.agentgateway
+      systemctl start agentgateway
+      msg_error "agentgateway update failed (download or checksum); the previous version was restored and restarted"
       exit 1
     fi
-    chmod +x /opt/agentgateway/agentgateway
-    msg_ok "Verified agentgateway Checksum"
 
     msg_info "Starting Service"
     systemctl start agentgateway

From 434624d2a3c25f0dd0fe716d00e77c5fc64f6ab9 Mon Sep 17 00:00:00 2001
From: andy-vdg <andy.vdg@gmail.com>
Date: Fri, 23 Oct 2026 16:44:07 +0200
Subject: [PATCH 5/7] agentgateway: keep the previous binary until the new
 version is running; restore it on any update failure

---
 ct/agentgateway.sh | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/ct/agentgateway.sh b/ct/agentgateway.sh
index 6a24755fc5..ebd4493068 100644
--- a/ct/agentgateway.sh
+++ b/ct/agentgateway.sh
@@ -41,24 +41,23 @@ function update_script() {
     systemctl stop agentgateway
     msg_ok "Stopped Service"
 
-    # Any failure from here on puts the previous binary back and restarts it.
+    # Any failure from here on, including a new version that will not start, puts the
+    # previous binary back and restarts it.
     if fetch_and_deploy_gh_release "agentgateway" "agentgateway/agentgateway" "singlefile" "latest" "/opt/agentgateway" "agentgateway-linux-$(arch_resolve "amd64" "arm64")" &&
       AGW_SUM=$(curl -fsSL "https://github.com/agentgateway/agentgateway/releases/download/v$(cat ~/.agentgateway)/agentgateway-linux-$(arch_resolve "amd64" "arm64").sha256" | awk '{print $1}') &&
-      [[ -n "$AGW_SUM" && "$AGW_SUM" == "$(sha256sum /opt/agentgateway/agentgateway | awk '{print $1}')" ]]; then
-      chmod +x /opt/agentgateway/agentgateway
+      [[ -n "$AGW_SUM" && "$AGW_SUM" == "$(sha256sum /opt/agentgateway/agentgateway | awk '{print $1}')" ]] &&
+      chmod +x /opt/agentgateway/agentgateway &&
+      systemctl start agentgateway && sleep 5 && systemctl is-active -q agentgateway; then
       rm -f /opt/agentgateway/agentgateway.bak ~/.agentgateway.bak
-      msg_ok "Verified agentgateway Checksum"
+      msg_ok "Started agentgateway $(cat ~/.agentgateway)"
     else
+      systemctl stop agentgateway 2>/dev/null
       mv /opt/agentgateway/agentgateway.bak /opt/agentgateway/agentgateway
       mv ~/.agentgateway.bak ~/.agentgateway
       systemctl start agentgateway
-      msg_error "agentgateway update failed (download or checksum); the previous version was restored and restarted"
+      msg_error "agentgateway update failed (download, checksum or start); the previous version was restored and restarted"
       exit 1
     fi
-
-    msg_info "Starting Service"
-    systemctl start agentgateway
-    msg_ok "Started Service"
     msg_ok "Updated successfully!"
   fi
   exit

From d7a396990902e4799676c8f53d64d5b76f17b372 Mon Sep 17 00:00:00 2001
From: andy-vdg <andy.vdg@gmail.com>
Date: Sun, 1 Nov 2026 11:42:16 +0100
Subject: [PATCH 6/7] agentgateway: use create_backup/restore_backup; drop the
 rollback check

Review: remove the comments and the if check, use the shared backup and
restore helpers. The checksum is verified with sha256sum -c, which fails the
update through the error handler.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017tcp6LGbfwMjznKx2UF1Zd
---
 ct/agentgateway.sh              | 35 ++++++++++++++-------------------
 install/agentgateway-install.sh |  5 +----
 2 files changed, 16 insertions(+), 24 deletions(-)

diff --git a/ct/agentgateway.sh b/ct/agentgateway.sh
index ebd4493068..f732b2acc5 100644
--- a/ct/agentgateway.sh
+++ b/ct/agentgateway.sh
@@ -34,30 +34,25 @@ function update_script() {
   fi
 
   if check_for_gh_release "agentgateway" "agentgateway/agentgateway"; then
-    cp -a /opt/agentgateway/agentgateway /opt/agentgateway/agentgateway.bak
-    cp -a ~/.agentgateway ~/.agentgateway.bak
-
     msg_info "Stopping Service"
     systemctl stop agentgateway
     msg_ok "Stopped Service"
 
-    # Any failure from here on, including a new version that will not start, puts the
-    # previous binary back and restarts it.
-    if fetch_and_deploy_gh_release "agentgateway" "agentgateway/agentgateway" "singlefile" "latest" "/opt/agentgateway" "agentgateway-linux-$(arch_resolve "amd64" "arm64")" &&
-      AGW_SUM=$(curl -fsSL "https://github.com/agentgateway/agentgateway/releases/download/v$(cat ~/.agentgateway)/agentgateway-linux-$(arch_resolve "amd64" "arm64").sha256" | awk '{print $1}') &&
-      [[ -n "$AGW_SUM" && "$AGW_SUM" == "$(sha256sum /opt/agentgateway/agentgateway | awk '{print $1}')" ]] &&
-      chmod +x /opt/agentgateway/agentgateway &&
-      systemctl start agentgateway && sleep 5 && systemctl is-active -q agentgateway; then
-      rm -f /opt/agentgateway/agentgateway.bak ~/.agentgateway.bak
-      msg_ok "Started agentgateway $(cat ~/.agentgateway)"
-    else
-      systemctl stop agentgateway 2>/dev/null
-      mv /opt/agentgateway/agentgateway.bak /opt/agentgateway/agentgateway
-      mv ~/.agentgateway.bak ~/.agentgateway
-      systemctl start agentgateway
-      msg_error "agentgateway update failed (download, checksum or start); the previous version was restored and restarted"
-      exit 1
-    fi
+    create_backup /etc/agentgateway /opt/agentgateway_data
+
+    fetch_and_deploy_gh_release "agentgateway" "agentgateway/agentgateway" "singlefile" "latest" "/opt/agentgateway" "agentgateway-linux-$(arch_resolve "amd64" "arm64")"
+
+    restore_backup
+
+    msg_info "Verifying agentgateway Checksum"
+    AGW_SUM=$(curl -fsSL "https://github.com/agentgateway/agentgateway/releases/download/v$(cat ~/.agentgateway)/agentgateway-linux-$(arch_resolve "amd64" "arm64").sha256" | awk '{print $1}')
+    echo "${AGW_SUM}  /opt/agentgateway/agentgateway" | sha256sum -c --status
+    chmod +x /opt/agentgateway/agentgateway
+    msg_ok "Verified agentgateway Checksum"
+
+    msg_info "Starting Service"
+    systemctl start agentgateway
+    msg_ok "Started Service"
     msg_ok "Updated successfully!"
   fi
   exit
diff --git a/install/agentgateway-install.sh b/install/agentgateway-install.sh
index c7f350f31f..10f4b2da1e 100644
--- a/install/agentgateway-install.sh
+++ b/install/agentgateway-install.sh
@@ -17,10 +17,7 @@ fetch_and_deploy_gh_release "agentgateway" "agentgateway/agentgateway" "singlefi
 
 msg_info "Verifying agentgateway Checksum"
 AGW_SUM=$(curl -fsSL "https://github.com/agentgateway/agentgateway/releases/download/v$(cat ~/.agentgateway)/agentgateway-linux-$(arch_resolve "amd64" "arm64").sha256" | awk '{print $1}')
-if [[ -z "$AGW_SUM" || "$AGW_SUM" != "$(sha256sum /opt/agentgateway/agentgateway | awk '{print $1}')" ]]; then
-  msg_error "agentgateway checksum does not match the release"
-  exit 1
-fi
+echo "${AGW_SUM}  /opt/agentgateway/agentgateway" | sha256sum -c --status
 chmod +x /opt/agentgateway/agentgateway
 msg_ok "Verified agentgateway Checksum"
 

From 2e389d036fa439617633c3d2eb6baafdeaa7648d Mon Sep 17 00:00:00 2001
From: andy-vdg <andy.vdg@gmail.com>
Date: Sun, 1 Nov 2026 11:57:11 +0100
Subject: [PATCH 7/7] agentgateway: fail closed when the checksum is missing or
 wrong

Remove the downloaded binary and its version file, so an unverified binary
never starts and the next update reinstalls. The installed check looks for
the config, which the failure path leaves in place.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017tcp6LGbfwMjznKx2UF1Zd
---
 ct/agentgateway.sh              | 6 +++---
 install/agentgateway-install.sh | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/ct/agentgateway.sh b/ct/agentgateway.sh
index f732b2acc5..e4c1ec5ebf 100644
--- a/ct/agentgateway.sh
+++ b/ct/agentgateway.sh
@@ -28,7 +28,7 @@ function update_script() {
   check_container_storage
   check_container_resources
 
-  if [[ ! -f /opt/agentgateway/agentgateway ]]; then
+  if [[ ! -f /etc/agentgateway/config.yaml ]]; then
     msg_error "No agentgateway Installation Found!"
     exit
   fi
@@ -45,8 +45,8 @@ function update_script() {
     restore_backup
 
     msg_info "Verifying agentgateway Checksum"
-    AGW_SUM=$(curl -fsSL "https://github.com/agentgateway/agentgateway/releases/download/v$(cat ~/.agentgateway)/agentgateway-linux-$(arch_resolve "amd64" "arm64").sha256" | awk '{print $1}')
-    echo "${AGW_SUM}  /opt/agentgateway/agentgateway" | sha256sum -c --status
+    AGW_SUM=$(curl -fsSL "https://github.com/agentgateway/agentgateway/releases/download/v$(cat ~/.agentgateway)/agentgateway-linux-$(arch_resolve "amd64" "arm64").sha256" | awk '{print $1}') || AGW_SUM=""
+    echo "${AGW_SUM}  /opt/agentgateway/agentgateway" | sha256sum -c --status || { rm -f /opt/agentgateway/agentgateway ~/.agentgateway; msg_error "agentgateway checksum missing or wrong - removed the downloaded binary"; exit 1; }
     chmod +x /opt/agentgateway/agentgateway
     msg_ok "Verified agentgateway Checksum"
 
diff --git a/install/agentgateway-install.sh b/install/agentgateway-install.sh
index 10f4b2da1e..71da7909d3 100644
--- a/install/agentgateway-install.sh
+++ b/install/agentgateway-install.sh
@@ -16,8 +16,8 @@ update_os
 fetch_and_deploy_gh_release "agentgateway" "agentgateway/agentgateway" "singlefile" "latest" "/opt/agentgateway" "agentgateway-linux-$(arch_resolve "amd64" "arm64")"
 
 msg_info "Verifying agentgateway Checksum"
-AGW_SUM=$(curl -fsSL "https://github.com/agentgateway/agentgateway/releases/download/v$(cat ~/.agentgateway)/agentgateway-linux-$(arch_resolve "amd64" "arm64").sha256" | awk '{print $1}')
-echo "${AGW_SUM}  /opt/agentgateway/agentgateway" | sha256sum -c --status
+AGW_SUM=$(curl -fsSL "https://github.com/agentgateway/agentgateway/releases/download/v$(cat ~/.agentgateway)/agentgateway-linux-$(arch_resolve "amd64" "arm64").sha256" | awk '{print $1}') || AGW_SUM=""
+echo "${AGW_SUM}  /opt/agentgateway/agentgateway" | sha256sum -c --status || { rm -f /opt/agentgateway/agentgateway ~/.agentgateway; msg_error "agentgateway checksum missing or wrong - removed the downloaded binary"; exit 1; }
 chmod +x /opt/agentgateway/agentgateway
 msg_ok "Verified agentgateway Checksum"