From 5ff4612b79b5b49dc7049896ee4fdbab2c2b1cd3 Mon Sep 17 00:00:00 2001
From: okxlin <61420215+okxlin@users.noreply.github.com>
Date: Wed, 22 Jul 2026 22:37:19 +0800
Subject: [PATCH] fix(apps): honor custom lifecycle paths

---
 apps/altus-linuxserver/5.8.1/scripts/init.sh  | 47 +++++++++++++++----
 .../5.8.1/scripts/upgrade.sh                  |  7 +--
 apps/altus-linuxserver/latest/scripts/init.sh | 47 +++++++++++++++----
 .../latest/scripts/upgrade.sh                 |  7 +--
 apps/librechat/latest/scripts/init.sh         | 41 ++++++++++++++--
 apps/librechat/latest/scripts/upgrade.sh      | 41 ++++++++++++++--
 .../winegui-linuxserver/4.1.0/scripts/init.sh | 47 +++++++++++++++----
 .../4.1.0/scripts/upgrade.sh                  |  7 +--
 .../latest/scripts/init.sh                    | 47 +++++++++++++++----
 .../latest/scripts/upgrade.sh                 |  7 +--
 .../yaak-linuxserver/2026.5.0/scripts/init.sh | 47 +++++++++++++++----
 .../2026.5.0/scripts/upgrade.sh               |  7 +--
 apps/yaak-linuxserver/latest/scripts/init.sh  | 47 +++++++++++++++----
 .../latest/scripts/upgrade.sh                 |  7 +--
 14 files changed, 334 insertions(+), 72 deletions(-)

diff --git a/apps/altus-linuxserver/5.8.1/scripts/init.sh b/apps/altus-linuxserver/5.8.1/scripts/init.sh
index e5658f096..4c8b2a9df 100755
--- a/apps/altus-linuxserver/5.8.1/scripts/init.sh
+++ b/apps/altus-linuxserver/5.8.1/scripts/init.sh
@@ -1,13 +1,44 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-paths=(
-  "${CONFIG_PATH:-./data/config}"
-)
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
 
-mkdir -p "${paths[@]}"
-for path in "${paths[@]}"; do
-  case "$path" in
-    ./*|../*) chown -R 1000:1000 "$path" 2>/dev/null || true ;;
+read_env_value() {
+  local key="$1"
+  [[ -f "$ENV_FILE" ]] || return 0
+  local value
+  value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
+  case "$value" in
+    \"*\") value="${value#\"}"; value="${value%\"}" ;;
+    \'*\') value="${value#\'}"; value="${value%\'}" ;;
   esac
-done
+  printf '%s\n' "$value"
+}
+
+configured_value() {
+  local key="$1"
+  local default_value="$2"
+  local value
+  value="${!key:-}"
+  if [[ -z "$value" ]]; then
+    value="$(read_env_value "$key")"
+  fi
+  printf '%s\n' "${value:-$default_value}"
+}
+
+resolve_app_path() {
+  local raw="$1"
+  if [[ "$raw" = /* ]]; then
+    printf '%s\n' "$raw"
+  else
+    printf '%s\n' "$ROOT_DIR/${raw#./}"
+  fi
+}
+
+config_path_value="$(configured_value CONFIG_PATH ./data/config)"
+config_path="$(resolve_app_path "$config_path_value")"
+mkdir -p -- "$config_path"
+case "$config_path_value" in
+  ./*|../*) chown -R 1000:1000 -- "$config_path" 2>/dev/null || true ;;
+esac
diff --git a/apps/altus-linuxserver/5.8.1/scripts/upgrade.sh b/apps/altus-linuxserver/5.8.1/scripts/upgrade.sh
index 84e9da3a5..60f834b43 100755
--- a/apps/altus-linuxserver/5.8.1/scripts/upgrade.sh
+++ b/apps/altus-linuxserver/5.8.1/scripts/upgrade.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-ENV_FILE="${ENV_FILE:-./.env}"
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
 
 generate_secret() {
   if [[ -r /dev/urandom ]]; then
@@ -32,8 +33,8 @@ ensure_env_default() {
     current="$(sed -n -E "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
     current="${current%\"}"
     current="${current#\"}"
-    current="${current%'}"
-    current="${current#'}"
+    current="${current%\'}"
+    current="${current#\'}"
     if [[ "$fill_empty" == "true" && -z "$current" ]]; then
       sed -i -E "s|^${key}=.*|${key}=${value}|" "$ENV_FILE"
       echo "Updated empty $key"
diff --git a/apps/altus-linuxserver/latest/scripts/init.sh b/apps/altus-linuxserver/latest/scripts/init.sh
index e5658f096..4c8b2a9df 100755
--- a/apps/altus-linuxserver/latest/scripts/init.sh
+++ b/apps/altus-linuxserver/latest/scripts/init.sh
@@ -1,13 +1,44 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-paths=(
-  "${CONFIG_PATH:-./data/config}"
-)
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
 
-mkdir -p "${paths[@]}"
-for path in "${paths[@]}"; do
-  case "$path" in
-    ./*|../*) chown -R 1000:1000 "$path" 2>/dev/null || true ;;
+read_env_value() {
+  local key="$1"
+  [[ -f "$ENV_FILE" ]] || return 0
+  local value
+  value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
+  case "$value" in
+    \"*\") value="${value#\"}"; value="${value%\"}" ;;
+    \'*\') value="${value#\'}"; value="${value%\'}" ;;
   esac
-done
+  printf '%s\n' "$value"
+}
+
+configured_value() {
+  local key="$1"
+  local default_value="$2"
+  local value
+  value="${!key:-}"
+  if [[ -z "$value" ]]; then
+    value="$(read_env_value "$key")"
+  fi
+  printf '%s\n' "${value:-$default_value}"
+}
+
+resolve_app_path() {
+  local raw="$1"
+  if [[ "$raw" = /* ]]; then
+    printf '%s\n' "$raw"
+  else
+    printf '%s\n' "$ROOT_DIR/${raw#./}"
+  fi
+}
+
+config_path_value="$(configured_value CONFIG_PATH ./data/config)"
+config_path="$(resolve_app_path "$config_path_value")"
+mkdir -p -- "$config_path"
+case "$config_path_value" in
+  ./*|../*) chown -R 1000:1000 -- "$config_path" 2>/dev/null || true ;;
+esac
diff --git a/apps/altus-linuxserver/latest/scripts/upgrade.sh b/apps/altus-linuxserver/latest/scripts/upgrade.sh
index 84e9da3a5..60f834b43 100755
--- a/apps/altus-linuxserver/latest/scripts/upgrade.sh
+++ b/apps/altus-linuxserver/latest/scripts/upgrade.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-ENV_FILE="${ENV_FILE:-./.env}"
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
 
 generate_secret() {
   if [[ -r /dev/urandom ]]; then
@@ -32,8 +33,8 @@ ensure_env_default() {
     current="$(sed -n -E "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
     current="${current%\"}"
     current="${current#\"}"
-    current="${current%'}"
-    current="${current#'}"
+    current="${current%\'}"
+    current="${current#\'}"
     if [[ "$fill_empty" == "true" && -z "$current" ]]; then
       sed -i -E "s|^${key}=.*|${key}=${value}|" "$ENV_FILE"
       echo "Updated empty $key"
diff --git a/apps/librechat/latest/scripts/init.sh b/apps/librechat/latest/scripts/init.sh
index baabc1233..06f6bfa9d 100755
--- a/apps/librechat/latest/scripts/init.sh
+++ b/apps/librechat/latest/scripts/init.sh
@@ -1,8 +1,43 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-DATA_DIR="${APP_DATA_DIR:-./data}"
-mkdir -p \
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
+
+read_env_value() {
+  local key="$1"
+  [[ -f "$ENV_FILE" ]] || return 0
+  local value
+  value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
+  case "$value" in
+    \"*\") value="${value#\"}"; value="${value%\"}" ;;
+    \'*\') value="${value#\'}"; value="${value%\'}" ;;
+  esac
+  printf '%s\n' "$value"
+}
+
+configured_value() {
+  local key="$1"
+  local default_value="$2"
+  local value
+  value="${!key:-}"
+  if [[ -z "$value" ]]; then
+    value="$(read_env_value "$key")"
+  fi
+  printf '%s\n' "${value:-$default_value}"
+}
+
+resolve_app_path() {
+  local raw="$1"
+  if [[ "$raw" = /* ]]; then
+    printf '%s\n' "$raw"
+  else
+    printf '%s\n' "$ROOT_DIR/${raw#./}"
+  fi
+}
+
+DATA_DIR="$(resolve_app_path "$(configured_value APP_DATA_DIR ./data)")"
+mkdir -p -- \
   "${DATA_DIR}/images" \
   "${DATA_DIR}/uploads" \
   "${DATA_DIR}/logs" \
@@ -11,7 +46,7 @@ mkdir -p \
   "${DATA_DIR}/meilisearch" \
   "${DATA_DIR}/pgvector"
 
-chown -R 1000:1000 \
+chown -R 1000:1000 -- \
   "${DATA_DIR}/images" \
   "${DATA_DIR}/uploads" \
   "${DATA_DIR}/logs" \
diff --git a/apps/librechat/latest/scripts/upgrade.sh b/apps/librechat/latest/scripts/upgrade.sh
index baabc1233..06f6bfa9d 100755
--- a/apps/librechat/latest/scripts/upgrade.sh
+++ b/apps/librechat/latest/scripts/upgrade.sh
@@ -1,8 +1,43 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-DATA_DIR="${APP_DATA_DIR:-./data}"
-mkdir -p \
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
+
+read_env_value() {
+  local key="$1"
+  [[ -f "$ENV_FILE" ]] || return 0
+  local value
+  value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
+  case "$value" in
+    \"*\") value="${value#\"}"; value="${value%\"}" ;;
+    \'*\') value="${value#\'}"; value="${value%\'}" ;;
+  esac
+  printf '%s\n' "$value"
+}
+
+configured_value() {
+  local key="$1"
+  local default_value="$2"
+  local value
+  value="${!key:-}"
+  if [[ -z "$value" ]]; then
+    value="$(read_env_value "$key")"
+  fi
+  printf '%s\n' "${value:-$default_value}"
+}
+
+resolve_app_path() {
+  local raw="$1"
+  if [[ "$raw" = /* ]]; then
+    printf '%s\n' "$raw"
+  else
+    printf '%s\n' "$ROOT_DIR/${raw#./}"
+  fi
+}
+
+DATA_DIR="$(resolve_app_path "$(configured_value APP_DATA_DIR ./data)")"
+mkdir -p -- \
   "${DATA_DIR}/images" \
   "${DATA_DIR}/uploads" \
   "${DATA_DIR}/logs" \
@@ -11,7 +46,7 @@ mkdir -p \
   "${DATA_DIR}/meilisearch" \
   "${DATA_DIR}/pgvector"
 
-chown -R 1000:1000 \
+chown -R 1000:1000 -- \
   "${DATA_DIR}/images" \
   "${DATA_DIR}/uploads" \
   "${DATA_DIR}/logs" \
diff --git a/apps/winegui-linuxserver/4.1.0/scripts/init.sh b/apps/winegui-linuxserver/4.1.0/scripts/init.sh
index e5658f096..4c8b2a9df 100755
--- a/apps/winegui-linuxserver/4.1.0/scripts/init.sh
+++ b/apps/winegui-linuxserver/4.1.0/scripts/init.sh
@@ -1,13 +1,44 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-paths=(
-  "${CONFIG_PATH:-./data/config}"
-)
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
 
-mkdir -p "${paths[@]}"
-for path in "${paths[@]}"; do
-  case "$path" in
-    ./*|../*) chown -R 1000:1000 "$path" 2>/dev/null || true ;;
+read_env_value() {
+  local key="$1"
+  [[ -f "$ENV_FILE" ]] || return 0
+  local value
+  value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
+  case "$value" in
+    \"*\") value="${value#\"}"; value="${value%\"}" ;;
+    \'*\') value="${value#\'}"; value="${value%\'}" ;;
   esac
-done
+  printf '%s\n' "$value"
+}
+
+configured_value() {
+  local key="$1"
+  local default_value="$2"
+  local value
+  value="${!key:-}"
+  if [[ -z "$value" ]]; then
+    value="$(read_env_value "$key")"
+  fi
+  printf '%s\n' "${value:-$default_value}"
+}
+
+resolve_app_path() {
+  local raw="$1"
+  if [[ "$raw" = /* ]]; then
+    printf '%s\n' "$raw"
+  else
+    printf '%s\n' "$ROOT_DIR/${raw#./}"
+  fi
+}
+
+config_path_value="$(configured_value CONFIG_PATH ./data/config)"
+config_path="$(resolve_app_path "$config_path_value")"
+mkdir -p -- "$config_path"
+case "$config_path_value" in
+  ./*|../*) chown -R 1000:1000 -- "$config_path" 2>/dev/null || true ;;
+esac
diff --git a/apps/winegui-linuxserver/4.1.0/scripts/upgrade.sh b/apps/winegui-linuxserver/4.1.0/scripts/upgrade.sh
index 84e9da3a5..60f834b43 100755
--- a/apps/winegui-linuxserver/4.1.0/scripts/upgrade.sh
+++ b/apps/winegui-linuxserver/4.1.0/scripts/upgrade.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-ENV_FILE="${ENV_FILE:-./.env}"
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
 
 generate_secret() {
   if [[ -r /dev/urandom ]]; then
@@ -32,8 +33,8 @@ ensure_env_default() {
     current="$(sed -n -E "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
     current="${current%\"}"
     current="${current#\"}"
-    current="${current%'}"
-    current="${current#'}"
+    current="${current%\'}"
+    current="${current#\'}"
     if [[ "$fill_empty" == "true" && -z "$current" ]]; then
       sed -i -E "s|^${key}=.*|${key}=${value}|" "$ENV_FILE"
       echo "Updated empty $key"
diff --git a/apps/winegui-linuxserver/latest/scripts/init.sh b/apps/winegui-linuxserver/latest/scripts/init.sh
index e5658f096..4c8b2a9df 100755
--- a/apps/winegui-linuxserver/latest/scripts/init.sh
+++ b/apps/winegui-linuxserver/latest/scripts/init.sh
@@ -1,13 +1,44 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-paths=(
-  "${CONFIG_PATH:-./data/config}"
-)
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
 
-mkdir -p "${paths[@]}"
-for path in "${paths[@]}"; do
-  case "$path" in
-    ./*|../*) chown -R 1000:1000 "$path" 2>/dev/null || true ;;
+read_env_value() {
+  local key="$1"
+  [[ -f "$ENV_FILE" ]] || return 0
+  local value
+  value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
+  case "$value" in
+    \"*\") value="${value#\"}"; value="${value%\"}" ;;
+    \'*\') value="${value#\'}"; value="${value%\'}" ;;
   esac
-done
+  printf '%s\n' "$value"
+}
+
+configured_value() {
+  local key="$1"
+  local default_value="$2"
+  local value
+  value="${!key:-}"
+  if [[ -z "$value" ]]; then
+    value="$(read_env_value "$key")"
+  fi
+  printf '%s\n' "${value:-$default_value}"
+}
+
+resolve_app_path() {
+  local raw="$1"
+  if [[ "$raw" = /* ]]; then
+    printf '%s\n' "$raw"
+  else
+    printf '%s\n' "$ROOT_DIR/${raw#./}"
+  fi
+}
+
+config_path_value="$(configured_value CONFIG_PATH ./data/config)"
+config_path="$(resolve_app_path "$config_path_value")"
+mkdir -p -- "$config_path"
+case "$config_path_value" in
+  ./*|../*) chown -R 1000:1000 -- "$config_path" 2>/dev/null || true ;;
+esac
diff --git a/apps/winegui-linuxserver/latest/scripts/upgrade.sh b/apps/winegui-linuxserver/latest/scripts/upgrade.sh
index 84e9da3a5..60f834b43 100755
--- a/apps/winegui-linuxserver/latest/scripts/upgrade.sh
+++ b/apps/winegui-linuxserver/latest/scripts/upgrade.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-ENV_FILE="${ENV_FILE:-./.env}"
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
 
 generate_secret() {
   if [[ -r /dev/urandom ]]; then
@@ -32,8 +33,8 @@ ensure_env_default() {
     current="$(sed -n -E "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
     current="${current%\"}"
     current="${current#\"}"
-    current="${current%'}"
-    current="${current#'}"
+    current="${current%\'}"
+    current="${current#\'}"
     if [[ "$fill_empty" == "true" && -z "$current" ]]; then
       sed -i -E "s|^${key}=.*|${key}=${value}|" "$ENV_FILE"
       echo "Updated empty $key"
diff --git a/apps/yaak-linuxserver/2026.5.0/scripts/init.sh b/apps/yaak-linuxserver/2026.5.0/scripts/init.sh
index e5658f096..4c8b2a9df 100755
--- a/apps/yaak-linuxserver/2026.5.0/scripts/init.sh
+++ b/apps/yaak-linuxserver/2026.5.0/scripts/init.sh
@@ -1,13 +1,44 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-paths=(
-  "${CONFIG_PATH:-./data/config}"
-)
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
 
-mkdir -p "${paths[@]}"
-for path in "${paths[@]}"; do
-  case "$path" in
-    ./*|../*) chown -R 1000:1000 "$path" 2>/dev/null || true ;;
+read_env_value() {
+  local key="$1"
+  [[ -f "$ENV_FILE" ]] || return 0
+  local value
+  value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
+  case "$value" in
+    \"*\") value="${value#\"}"; value="${value%\"}" ;;
+    \'*\') value="${value#\'}"; value="${value%\'}" ;;
   esac
-done
+  printf '%s\n' "$value"
+}
+
+configured_value() {
+  local key="$1"
+  local default_value="$2"
+  local value
+  value="${!key:-}"
+  if [[ -z "$value" ]]; then
+    value="$(read_env_value "$key")"
+  fi
+  printf '%s\n' "${value:-$default_value}"
+}
+
+resolve_app_path() {
+  local raw="$1"
+  if [[ "$raw" = /* ]]; then
+    printf '%s\n' "$raw"
+  else
+    printf '%s\n' "$ROOT_DIR/${raw#./}"
+  fi
+}
+
+config_path_value="$(configured_value CONFIG_PATH ./data/config)"
+config_path="$(resolve_app_path "$config_path_value")"
+mkdir -p -- "$config_path"
+case "$config_path_value" in
+  ./*|../*) chown -R 1000:1000 -- "$config_path" 2>/dev/null || true ;;
+esac
diff --git a/apps/yaak-linuxserver/2026.5.0/scripts/upgrade.sh b/apps/yaak-linuxserver/2026.5.0/scripts/upgrade.sh
index 84e9da3a5..60f834b43 100755
--- a/apps/yaak-linuxserver/2026.5.0/scripts/upgrade.sh
+++ b/apps/yaak-linuxserver/2026.5.0/scripts/upgrade.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-ENV_FILE="${ENV_FILE:-./.env}"
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
 
 generate_secret() {
   if [[ -r /dev/urandom ]]; then
@@ -32,8 +33,8 @@ ensure_env_default() {
     current="$(sed -n -E "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
     current="${current%\"}"
     current="${current#\"}"
-    current="${current%'}"
-    current="${current#'}"
+    current="${current%\'}"
+    current="${current#\'}"
     if [[ "$fill_empty" == "true" && -z "$current" ]]; then
       sed -i -E "s|^${key}=.*|${key}=${value}|" "$ENV_FILE"
       echo "Updated empty $key"
diff --git a/apps/yaak-linuxserver/latest/scripts/init.sh b/apps/yaak-linuxserver/latest/scripts/init.sh
index e5658f096..4c8b2a9df 100755
--- a/apps/yaak-linuxserver/latest/scripts/init.sh
+++ b/apps/yaak-linuxserver/latest/scripts/init.sh
@@ -1,13 +1,44 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-paths=(
-  "${CONFIG_PATH:-./data/config}"
-)
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
 
-mkdir -p "${paths[@]}"
-for path in "${paths[@]}"; do
-  case "$path" in
-    ./*|../*) chown -R 1000:1000 "$path" 2>/dev/null || true ;;
+read_env_value() {
+  local key="$1"
+  [[ -f "$ENV_FILE" ]] || return 0
+  local value
+  value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
+  case "$value" in
+    \"*\") value="${value#\"}"; value="${value%\"}" ;;
+    \'*\') value="${value#\'}"; value="${value%\'}" ;;
   esac
-done
+  printf '%s\n' "$value"
+}
+
+configured_value() {
+  local key="$1"
+  local default_value="$2"
+  local value
+  value="${!key:-}"
+  if [[ -z "$value" ]]; then
+    value="$(read_env_value "$key")"
+  fi
+  printf '%s\n' "${value:-$default_value}"
+}
+
+resolve_app_path() {
+  local raw="$1"
+  if [[ "$raw" = /* ]]; then
+    printf '%s\n' "$raw"
+  else
+    printf '%s\n' "$ROOT_DIR/${raw#./}"
+  fi
+}
+
+config_path_value="$(configured_value CONFIG_PATH ./data/config)"
+config_path="$(resolve_app_path "$config_path_value")"
+mkdir -p -- "$config_path"
+case "$config_path_value" in
+  ./*|../*) chown -R 1000:1000 -- "$config_path" 2>/dev/null || true ;;
+esac
diff --git a/apps/yaak-linuxserver/latest/scripts/upgrade.sh b/apps/yaak-linuxserver/latest/scripts/upgrade.sh
index 84e9da3a5..60f834b43 100755
--- a/apps/yaak-linuxserver/latest/scripts/upgrade.sh
+++ b/apps/yaak-linuxserver/latest/scripts/upgrade.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-ENV_FILE="${ENV_FILE:-./.env}"
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
 
 generate_secret() {
   if [[ -r /dev/urandom ]]; then
@@ -32,8 +33,8 @@ ensure_env_default() {
     current="$(sed -n -E "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
     current="${current%\"}"
     current="${current#\"}"
-    current="${current%'}"
-    current="${current#'}"
+    current="${current%\'}"
+    current="${current#\'}"
     if [[ "$fill_empty" == "true" && -z "$current" ]]; then
       sed -i -E "s|^${key}=.*|${key}=${value}|" "$ENV_FILE"
       echo "Updated empty $key"