* fix: remove status-page, no longer in use
* chore: remove unused domain (status-page removed)
* fix(uptimekit): pin dash 5.2.1 and clickhouse 26.8-alpine instead of latest
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(uptimekit): select the bundled ClickHouse as time-series backend
UptimeKit 5.x defaults TIMESERIES_BACKEND to timescale, which needs the
TimescaleDB extension that postgres:18-alpine doesn't ship, so dash
crash-looped. The template already bundles ClickHouse.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Mauricio Siu <siumauricio@icloud.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(senddock): report the floating image tag in template metadata
The compose file tracks ghcr.io/arkhe-systems/senddock:latest, but meta.json still
named 0.8.0 as the version. Nothing derives that field from the image, so the gallery
badge and the softwareVersion in the page metadata froze at 0.8.0 while a fresh
install already pulled 0.8.3, which reads as a template shipping a release with
defects that were fixed since.
Declaring latest matches what the other blueprints do when the image is not pinned to
a fixed tag, and it cannot drift again on the next release.
* fix(senddock): pin image to 0.8.3 and report that version
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Mauricio Siu <siumauricio@icloud.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
0.18.1 fixes GHSA-jwvh-6phv-j9jh, whose affected range this blueprint was
squarely inside: it sets STORAGE_PROVIDER=sqlite, and the advisory covers
every release from 0.8.0 through 0.18.0 on a server store.
The blueprint also seeds two accounts, admin and user. Where those two go
to different people who share a browser profile, that is the shape the
defect needs: the second to sign in received the first one's browser copy
of the workspace, with its saved connection passwords and its query
history. Both passwords come from this template's own generated secrets,
so by default the two logins belong to one deployer and nothing crosses a
privacy boundary; it is handing USER_PASSWORD to someone else that opens
it.
0.18.2 then adds a run of fixes across the PostgreSQL family, the
wire-compatible engines, MySQL, MongoDB, Redis and Oracle.
meta.json also said twenty-six drivers. Databend became a connection type
of its own in 0.18.1, where it had been reached as a relative of the MySQL
type, so the count is twenty-seven. The fifty-four named engines are
unchanged, because Databend only moved from one side of that sum to the
other.
One line is added beside the bump, because testing the upgrade turned up a
lockout the blueprint could not recover from. Since 0.18.0 ADMIN_PASSWORD
seeds the account table only while it is empty, so an operator who edits
it in Dokploy's Environment panel gets 401 on the new password while the
old one, which the panel no longer shows, still works. The app logs the
way out, "set ADMIN_PASSWORD_RESET=true and restart", but the compose
environment list is an allowlist: typing that variable into the same panel
never reached the container, so the advice could not be followed without
editing the blueprint itself. ADMIN_PASSWORD_RESET is now passed through
with an empty default. Measured on 0.18.2 with this file: empty leaves the
container with the variable defined and blank, both accounts sign in
normally and neither reset line appears in the log; with it set to true the
new password returns 200 and the old one 401; with the flag removed again
the new password keeps working. There is no USER equivalent in the
application, which the comment says, so that account is changed from
Studio's own Accounts screen.
Co-authored-by: yusuf-gundogdu <devgundogdu86@gmail.com>
* chore: remove duplicate appwrite-2 template (appwrite already provides this)
* chore: remove duplicate appwrite-2 template
The appwrite template is on 2.x (2.5.0 after #1215), so appwrite-2 is a
duplicate. The original removal was undone by a later merge of main.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Mauricio Siu <47042324+Siumauricio@users.noreply.github.com>
Co-authored-by: Mauricio Siu <siumauricio@icloud.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: update appwrite template to 2.4.0 with MariaDB, node-24/26, console domain
* feat: enable DocumentsDB and VectorsDB by default in appwrite 2.4.0 template
* feat: update appwrite template to 2.4.0 with MariaDB, node-24/26, console domain
* fix(appwrite): repair 2.4.0 template structure and console setup
- Restore [config] table so config.env/config.isolated parse correctly
(the env block had been swallowed into config.mounts[0], leaving the
deployment with no environment variables)
- Add missing mongo-entrypoint.sh mount so the mongodb service can start
- Remove the mariadb [[config.domains]] entry: it exposed the DB on
main_domain and duplicated the appwrite-console route
- Route the dedicated console domain via config.domains and drop the
broken HostRegexp Traefik labels; set _APP_CONSOLE_URL/HOSTNAMES
- Bump appwrite-console image to 1.2.55-self-hosted (2.4.0 console)
- Restore the pinned appwrite-builds volume name
- Drop the removed Appwrite Assistant env/service
* feat(appwrite): apply remaining 2.4.0 hardening (clickhouse logs, browser)
- ClickHouse: add the two 2.4.0 config mounts (clickhouse-config.xml for
system-log retention, clickhouse-init.sh to backfill TTLs on existing
tables) plus CLICKHOUSE_ALWAYS_RUN_INITDB_SCRIPTS=1; the files are
generated via [[config.mounts]] and bind-mounted from ../files/
- Browser: bump appwrite/browser 0.3.4 -> 0.3.6, set ALLOWED_HOSTS=appwrite
and public DNS resolvers to block SSRF to internal services
- Bump appwrite/geo 0.3.1 -> 0.3.2 (matches 2.4.0)
* feat(appwrite): bump template to 2.5.0
Update the Appwrite blueprint to the 2.5.0 release (published
2026-10-13), which only moves images with no new environment
variables:
- appwrite/appwrite 2.4.0 -> 2.5.0 across all services
- appwrite/new console 1.2.55-self-hosted -> 1.2.74-self-hosted
- openruntimes/executor 0.29.0 -> 1.1.2
Brings project passkeys, interval-based function schedules, and
runtime containers that survive executor restarts.
---------
Co-authored-by: Mauricio Siu <47042324+Siumauricio@users.noreply.github.com>
* chore(umami): update to v3.4.0
* fix(umami): generate the database password instead of hardcoding "umami"
---------
Co-authored-by: Mauricio Siu <siumauricio@icloud.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat: add Cachkey template
* fix(cachkey): name the public service after the template, env as array
* fix(cachkey): unique internal API service name, APP_URL note
Single-node Wazuh 4.14.8 (manager, indexer, dashboard) adapted from the
official wazuh-docker single-node setup:
- internal TLS PKI generated on first deploy by wazuh-certs-generator into a
named volume (no host files)
- indexer internal users hashed from generated passwords before the security
index is initialized; no default credentials
- dashboard served over HTTP behind Traefik on the template domain
- agent ports 1514/1515 published on the host (raw TCP, can't go through
Traefik)
Closes#440
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Build from CopilotKit/OpenDots commit 625452e (package.json 0.1.0, upstream has
no tags yet) instead of the moving main branch, and set meta.json version to
0.1.0-625452e instead of "latest".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The template mounted the host's /var/run/tailscale, which does not exist on a
standard Dokploy server, so DockTail could never reach tailscaled. Use the
upstream sidecar setup: a pinned tailscale/tailscale container (userspace
networking, state and socket in named volumes) authenticated with
TAILSCALE_AUTH_KEY, sharing its socket with DockTail.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Resolves the conflicts with canary and removes the top-level version key from
the templates added since this PR was opened.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Port of #1191 (which targets main) onto canary:
- app/ and build-scripts/ dependency bumps from #1191
- signoz, timescaledb, valkey template.toml fixes from #1191
- supabase: kept canary's version (already parses under toml 4 after #1131/#1149)
- appwrite-2 (merged after #1191 was opened): escape the backslash in the
mongo entrypoint (\! -> \\!), which toml 4 rejects as an invalid escape
All 559 blueprints/*/template.toml parse with toml@4.2.0.
Co-authored-by: narcisonunez <narcisonunez@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
create-heyo-docs@0.2.3 writes "@heyo-sh/heyo-docs": "latest", which now resolves
to 3.4.1 and no longer exports heyoDocs, so astro build fails. Scaffold with
create-heyo-docs@3.1.0, pin @heyo-sh/heyo-docs@3.4.1, and set meta version.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
minio/minio images are no longer pullable. Run chrislusf/seaweedfs:4.48
as the 'minio' service with S3 on port 9000 and the same credentials, so
MINIO_ENDPOINT and the k3s ExternalName stay unchanged. Buckets are
created with weed shell in minio-init.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
As offered by the author: the portal depends on a new, unpinned image of
the author's own; the base template uses only official images.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
reloopsh/* images only publish a moving 'latest' tag (fe-dashboard also has
commit tags, the rest don't), so every image is pinned to the digest of the
2026-10-06 build. meta.json version reflects that build date.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Narciso
Alexandru PopaandGitHub
CardonaandGitHub
Yash KumarandGitHub
JOYBOY dyandGitHub
