The validate-docker-compose CI on this PR was failing on rustdesk's
hbbs/hbbr port mappings (21115-21119) — intentional host-published ports
for the RustDesk relay/rendezvous protocol, which Traefik cannot route.
Adds a '# dokploy: allow-host-ports' top-of-file marker that downgrades
the port-mapping errors to warnings for such protocol templates
(mail/game/streaming/VPN/remote-desktop), and annotates rustdesk.
Other exception templates (poste.io, mailu, oryx, fivem...) can be
annotated case-by-case as the weekly audit (#1049) surfaces them.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* ci: audit every blueprint on a schedule (#1047)
* ci: use RUNNER_TEMP and gate the fail step on the dispatch event
* ci: bound the step summary and publish the full report as an artifact
* ci: treat a missing file as a finding, and never truncate mid-fence
* feat: Add Fluxer template
* fix: populate config.env in template.toml
* fix: syntax in template.toml for config.env
* fix: use multiline string for config.env in template.toml
* fix: format config.env as valid string array in template.toml
* fix: update template.toml format to match standard env array structure
* add: template.toml with optional env vars and http guidance
* fix: change wording to avoid confusion
* fix: add more missing instructions
* fix: more wording changes
* fix: final wording improvements
* fix: comma missing from previous commit
- 79 blueprints declared a bare [[config.mounts]] header (one empty array
element in TOML) -> replaced with the repo idiom 'mounts = []'
- 38 blueprints carried doc-style mount blocks (name/mountPath/description)
that don't match the schema (filePath/content) and are inert in Dokploy's
template processor -> removed; their named volumes already live in each
docker-compose.yml
- penpot: duplicate 'expose' map key made its docker-compose.yml invalid
YAML -> merged into one expose list
After this, validate-template.ts passes for all 502 blueprints. The
remaining validate-docker-compose.ts flags are the intentional host-port
templates (mail/game/streaming protocols: poste.io, mailu, oryx, fivem,
lodestone, etc.) which the validator does not yet model as exceptions.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: drop no-op container_name from three blueprints (#1047)
* fix: drop the empty [[config.mounts]] block from vault
* fix: pin vault and scrutiny images, add the missing version header
* Add PodFetch template
* Use env array syntax in template.toml
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Address review: match version to image tag, expose admin_username variable, dark-mode friendly logo
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* feat: add struxa template
Adds a Dokploy blueprint for Struxa (github.com/struxadotcloud/struxa),
a self-hosted, open-source server management panel. Deploys the
published GHCR images (dashboard, watchkeeper, migrate) plus MySQL
and MinIO sidecars. The web service generates its RS256 JWT keypair
at startup via Node's built-in crypto module, since no Dokploy
template helper covers RSA key generation.
* fix: pin struxa images to latest floating tag
struxa's release workflow pushes a latest floating tag alongside
version tags on every stable release, matching the convention used
by ~44% of existing blueprints (version: "latest" in meta.json).
* fix: generate a 64-char DATABASE_ENCRYPTION_KEY
Dokploy's runtime \${hash:N} helper produces N hex characters, not N
bytes (the templates repo's local preview helpers.ts models it as
byte count, which is inconsistent with the platform). struxa's env
schema requires DATABASE_ENCRYPTION_KEY to be >=64 chars (it's hex
decoded to a 32-byte AES-256 key), so \${hash:32} only produced half
the required length. Confirmed against other blueprints (sim,
chatwoot, outline) which all use \${hash:64} for 64-char secrets.
* fix: address Copilot review comments
- Add explicit \`version: "3.8"\` to docker-compose.yml, matching the
documented template format.
- Pin minio/minio to a specific RELEASE tag (used elsewhere in the
repo: plane, posthog) instead of the floating latest tag.
- Default BETTER_AUTH_URL/APP_URL/CORS_ORIGIN to http://, matching
repo convention for Dokploy-fronted apps (TLS terminates at the
proxy).
* fix: rename web service to struxa
AGENTS.md convention: the primary Docker service name should match
the blueprint folder name. Renamed the web/dashboard service from
"web" to "struxa" in docker-compose.yml and updated
template.toml's config.domains.serviceName to match.
Dagu is a self-contained workflow engine with a Web UI for scheduling and
orchestrating jobs as DAGs defined in declarative YAML.
- Pin ghcr.io/dagucloud/dagu:2.10.7 and expose the Web UI on port 8080
- Set DAGU_HOST=0.0.0.0 so the service is reachable through the proxy
- Enable basic auth with a generated per-deploy admin password
- Persist /var/lib/dagu (DAGs, logs, run history) in a named volume
Claude-Session: https://claude.ai/code/session_01CRNT6sa2q2P9rUTokeoGhQ
n8n running in queue mode (EXECUTIONS_MODE=queue): main instance for the
editor/webhooks, a scalable pool of workers (deploy.replicas driven by the
N8N_WORKER_REPLICAS env var), Redis (Bull) as the queue broker and
PostgreSQL as the database. Pinned to the current stable n8nio/n8n:2.30.4.
Closes#455
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
In production images LOGS_REDIS_TLS/TRACES_REDIS_TLS default to true, so
the logs-ingestion consumer (part of the plugin-server default mode) kept
attempting a TLS handshake against the plaintext Redis, timed out every
~11s and killed the process after 10 errors (restart loop every ~2.5 min).
Constrain the plugins service to the capability groups this template
ships (cdp_workflows, realtime_cohorts, feature_flags) and pin the redis
TLS flags to false as belt-and-braces.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Mauricio SiuandClaude Fable 5
Yusuf GündoğduandGitHub
Khiet Tam NguyenandGitHub
Jiho LeeandGitHub
Finley Crawford-McQuillanandGitHub
Andre Carbajal VargasandGitHub
JavierandGitHub
Stefan ErnstandGitHub
Mauricio SiuandGitHub
Marko KostichandGitHub
MaflyandGitHub
Jakub KrzyżanowskiandGitHub
Zakher MasriandGitHub
Edward BurtonandGitHub
Mauricio SiuandClaude Fable 5
Stephan Fitzpatrick