feat: add Cloudflare Mesh LXC script

ct/cloudflare-mesh.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/DevScripts/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: aashishvanand
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-mesh/
+
+APP="Cloudflare-Mesh"
+var_tags="${var_tags:-network;cloudflare;vpn}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}" # pkg.cloudflareclient.com publishes cloudflare-warp for arm64
+var_unprivileged="${var_unprivileged:-1}"
+var_tun="${var_tun:-yes}"
+export var_mesh_token="${var_mesh_token:-}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -f /usr/bin/warp-cli ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  msg_info "Updating Cloudflare One Client"
+  apt_update_safe
+  $STD apt install -y --only-upgrade cloudflare-warp
+  msg_ok "Updated Cloudflare One Client"
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Check the node status inside the container with:${CL}"
+echo -e "${GATEWAY}${BGN}warp-cli status${CL}"

install/cloudflare-mesh-install.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: aashishvanand
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-mesh/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Cloudflare One Client"
+setup_deb822_repo \
+  "cloudflare-warp" \
+  "https://pkg.cloudflareclient.com/pubkey.gpg" \
+  "https://pkg.cloudflareclient.com" \
+  "$(get_os_info codename)" \
+  "main"
+$STD apt install -y cloudflare-warp
+msg_ok "Installed Cloudflare One Client"
+
+msg_info "Enabling IP Forwarding"
+cat <<SYSCTL >/etc/sysctl.d/99-zzz-cloudflare-warp-connector.conf
+net.ipv4.ip_forward = 1
+net.ipv6.conf.all.forwarding = 1
+net.ipv6.conf.all.accept_ra = 2
+SYSCTL
+$STD sysctl -p /etc/sysctl.d/99-zzz-cloudflare-warp-connector.conf
+msg_ok "Enabled IP Forwarding"
+
+if [[ -z "${var_mesh_token:-}" ]]; then
+  read -r -s -p "${TAB3}Mesh node token from Networking > Mesh > Add node (Enter to skip): " var_mesh_token
+  echo
+fi
+if [[ -n "${var_mesh_token:-}" ]]; then
+  msg_info "Connecting Mesh Node"
+  for _ in {1..30}; do
+    [[ -S /run/cloudflare-warp/warp_service ]] && break
+    sleep 1
+  done
+  $STD warp-cli --accept-tos connector new "$var_mesh_token"
+  $STD warp-cli --accept-tos connect
+  msg_ok "Connected Mesh Node"
+else
+  msg_warn "No token provided. Run 'warp-cli --accept-tos connector new <TOKEN> && warp-cli --accept-tos connect' to enroll."
+fi
+
+motd_ssh
+customize
+cleanup_lxc

json/cloudflare-mesh.json

@@ -0,0 +1,58 @@
+{
+  "name": "Cloudflare Mesh",
+  "slug": "cloudflare-mesh",
+  "categories": [4],
+  "date_created": "2026-10-14",
+  "type": "ct",
+  "updateable": true,
+  "privileged": false,
+  "interface_port": null,
+  "documentation": "https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-mesh/",
+  "website": "https://www.cloudflare.com/",
+  "repository": null,
+  "architectures": ["amd64", "arm64"],
+  "platforms": ["pve"],
+  "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/cloudflare.webp",
+  "description": "Cloudflare Mesh (formerly WARP Connector) runs the Cloudflare One Client headless as a Mesh node. It gives the container a private Mesh IP and can advertise LAN subnets, providing bidirectional TCP, UDP and ICMP connectivity between sites and enrolled devices through Cloudflare.",
+  "install_methods": [
+    {
+      "type": "default",
+      "script": "ct/cloudflare-mesh.sh",
+      "config_path": "/var/lib/cloudflare-warp",
+      "resources": {
+        "cpu": 2,
+        "ram": 1024,
+        "hdd": 4,
+        "os": "Debian",
+        "version": "13"
+      }
+    }
+  ],
+  "default_credentials": {
+    "username": null,
+    "password": null
+  },
+  "app_vars": [
+    {
+      "name": "var_mesh_token",
+      "label": "Mesh node token",
+      "type": "password",
+      "secret": true,
+      "help": "From Zero Trust > Networking > Mesh > Add node > Linux. Leave empty to enroll later with warp-cli."
+    }
+  ],
+  "notes": [
+    {
+      "text": "The Mesh node device profile must use MASQUE and route only 100.96.0.0/12 (Include mode). The dashboard wizard sets this up for new accounts.",
+      "type": "warning"
+    },
+    {
+      "text": "Do not run this in the same container or host as cloudflared: the Mesh node captures outbound traffic and can break cloudflared's connections.",
+      "type": "warning"
+    },
+    {
+      "text": "To reach a LAN subnet through this node, add a CIDR route to the node in the dashboard and point the LAN's return route for 100.96.0.0/12 at this container's IP.",
+      "type": "info"
+    }
+  ]
+}