[MickLesk]

✍️ Description

start-from-init ran in the background with its output thrown away, and the PID to kill was guessed from lsof after 60 seconds; when the process had already ended, kill got no PID and failed with exit 2. init and setup finish on their own, report their errors, and the service only starts once its user exists.

🔗 Related Issue

Fixes #

✅ Prerequisites (x in brackets)

• Self-review completed – Code follows project standards.
• Tested thoroughly – Changes work as expected.
• No security risks – No hardcoded secrets, unnecessary privilege escalations, or permission issues.

Tested on:

---

🤖 AI Assistance (X in brackets)

If you used an AI tool (GitHub Copilot, Claude, ChatGPT, etc.) to write or generate any scripts in this PR, you must confirm compliance below.
Select exactly one option.

• No AI used – Scripts were written without AI assistance.
• AI was used – I confirm the scripts were built using AGENTS.md and .github/agents/pve-script-creator.agent.md as guidance, and the output has been reviewed and corrected to match those guidelines.

---

🛠️ Type of Change (X in brackets)

• 🐞 Bug fix – Resolves an issue without breaking functionality.
• ✨ New feature – Adds new, non-breaking functionality.
• 💥 Breaking change – Alters existing functionality in a way that may require updates.
• 🆕 New script – A fully functional and tested script or script set.
• 🌍 Website update – Changes to script metadata (PocketBase/website data).
• 🔧 Refactoring / Code Cleanup – Improves readability or maintainability without changing functionality.
• 📝 Documentation update – Changes to README, AppName.md, CONTRIBUTING.md, or other docs.

---

💥 Breaking Change Advisory (only if you checked "Breaking change")

[github-actions]

Try this branch

The engine and the scripts resolve independently, so this runs the changed
ct/ and install/ scripts against the production engine:

export COMMUNITY_SCRIPTS_URL=https://raw.githubusercontent.com/community-scripts/ProxmoxVE/fix/zitadel-init-foreground
bash -c "$(curl -fsSL "$COMMUNITY_SCRIPTS_URL/ct/zitadel.sh")"

Both lines are needed. Without COMMUNITY_SCRIPTS_URL the engine falls back to
main, so curling the branch URL on its own gives you the ct/ script from
this PR and the install/ script from main. Frequently the one you meant to test.

The same command works on an Incus host: the engine detects the platform and
loads the matching backend, while the scripts still come from this branch.

Useful while testing

dev_mode=net logs every fetch with status and URL, which is the quickest way
to confirm the branch is really being used. dev_mode=keep stops a failed
build from deleting the container along with the evidence.

export COMMUNITY_SCRIPTS_URL=https://raw.githubusercontent.com/community-scripts/ProxmoxVE/fix/zitadel-init-foreground
dev_mode=net,keep bash -c "$(curl -fsSL "$COMMUNITY_SCRIPTS_URL/ct/zitadel.sh")"