Align the template with the current upstream self-hosted stack
(supabase/postgres 17.6.1.136, studio 2026.08.03, kong 3.9.3),
remove the deprecated analytics/vector services and switch
Studio/pg-meta to the postgres role per upstream guidance.
Closes#1067
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Add Open Design template
Open Design is a local-first, open-source design tool that ships as a
single self-contained container (no external DB or cache). Adds the
blueprint (docker-compose.yml + template.toml + logo) and a meta.json entry.
* Use node-based healthcheck for Open Design template (matches upstream; verified locally)
* Pin Open Design image to 0.16.1 for reproducible deploys
Replace :latest with the immutable released tag ghcr.io/nexu-io/od:0.16.1
in docker-compose.yml and set the matching version in meta.json, per the
repo pinning convention (AGENTS.md). Tag 0.16.1 verified: /api/health
returns 200 and the node-based healthcheck passes.
* Allow both http and https origins for Open Design template
Dokploy's auto-generated domain is served over plain HTTP by default (no
cert), so OD_ALLOWED_ORIGINS=https://${main_domain} alone made the daemon
reject the browser's http origin with 403, breaking the app after the
onboarding shell loaded. List both schemes so the template works on the
default HTTP domain and after a user adds an HTTPS certificate. Verified
against a live deploy: listed origin -> 200, unlisted -> 403; the daemon
supports comma-separated multi-origin per deploy/README.md.
* Disable daemon API auth so the Open Design web UI loads
The daemon token-gates its API when bound to 0.0.0.0 (every container),
and a browser has no way to present that bearer token, so the web UI's
bootstrap calls all returned 401 and the app failed to load. Set
OD_DISABLE_API_AUTH=1 (the daemon's documented escape hatch) so the UI
works on deploy. Add a README noting the instance is then open (front it
with auth/HTTPS if internet-facing) and how to enable AI features.
Verified end to end against a live deploy on a real domain.
---------
Co-authored-by: Abhiigg <abhi@incrediblegoodguys.com>
Co-authored-by: Mauricio Siu <siumauricio@icloud.com>
- Point the image at ghcr.io/arkhe-systems/senddock:latest so fresh
deploys always get the current release without a per-release PR.
- Remove DEPLOYMENT_MODE (self-host is the default now; the cloud flag
became the boolean CLOUD).
- Remove SENDDOCK_LICENSE_KEY (Pro license is activated from the
dashboard in 0.8; the env var is removed in 0.9).
* feat: add 9Router template (#1040)
* fix: pin the headroom sidecar instead of :latest
* fix: use http for BASE_URL per the repo URL convention
* fix: set NEXT_PUBLIC_BASE_URL so the browser hits the deployed domain
* feat(fmd-server): bump to version 0.16.0
* fix: use expose instead of ports
* fix: fmd-server image tag is 0.16.0 (upstream dropped the v prefix)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Mauricio Siu <siumauricio@icloud.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* ci: audit every blueprint on a schedule (#1047)
* ci: use RUNNER_TEMP and gate the fail step on the dispatch event
* ci: bound the step summary and publish the full report as an artifact
* ci: treat a missing file as a finding, and never truncate mid-fence
* feat: Add Fluxer template
* fix: populate config.env in template.toml
* fix: syntax in template.toml for config.env
* fix: use multiline string for config.env in template.toml
* fix: format config.env as valid string array in template.toml
* fix: update template.toml format to match standard env array structure
* add: template.toml with optional env vars and http guidance
* fix: change wording to avoid confusion
* fix: add more missing instructions
* fix: more wording changes
* fix: final wording improvements
* fix: comma missing from previous commit
* fix: drop no-op container_name from three blueprints (#1047)
* fix: drop the empty [[config.mounts]] block from vault
* fix: pin vault and scrutiny images, add the missing version header
* Add PodFetch template
* Use env array syntax in template.toml
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Address review: match version to image tag, expose admin_username variable, dark-mode friendly logo
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* feat: add struxa template
Adds a Dokploy blueprint for Struxa (github.com/struxadotcloud/struxa),
a self-hosted, open-source server management panel. Deploys the
published GHCR images (dashboard, watchkeeper, migrate) plus MySQL
and MinIO sidecars. The web service generates its RS256 JWT keypair
at startup via Node's built-in crypto module, since no Dokploy
template helper covers RSA key generation.
* fix: pin struxa images to latest floating tag
struxa's release workflow pushes a latest floating tag alongside
version tags on every stable release, matching the convention used
by ~44% of existing blueprints (version: "latest" in meta.json).
* fix: generate a 64-char DATABASE_ENCRYPTION_KEY
Dokploy's runtime \${hash:N} helper produces N hex characters, not N
bytes (the templates repo's local preview helpers.ts models it as
byte count, which is inconsistent with the platform). struxa's env
schema requires DATABASE_ENCRYPTION_KEY to be >=64 chars (it's hex
decoded to a 32-byte AES-256 key), so \${hash:32} only produced half
the required length. Confirmed against other blueprints (sim,
chatwoot, outline) which all use \${hash:64} for 64-char secrets.
* fix: address Copilot review comments
- Add explicit \`version: "3.8"\` to docker-compose.yml, matching the
documented template format.
- Pin minio/minio to a specific RELEASE tag (used elsewhere in the
repo: plane, posthog) instead of the floating latest tag.
- Default BETTER_AUTH_URL/APP_URL/CORS_ORIGIN to http://, matching
repo convention for Dokploy-fronted apps (TLS terminates at the
proxy).
* fix: rename web service to struxa
AGENTS.md convention: the primary Docker service name should match
the blueprint folder name. Renamed the web/dashboard service from
"web" to "struxa" in docker-compose.yml and updated
template.toml's config.domains.serviceName to match.
Dagu is a self-contained workflow engine with a Web UI for scheduling and
orchestrating jobs as DAGs defined in declarative YAML.
- Pin ghcr.io/dagucloud/dagu:2.10.7 and expose the Web UI on port 8080
- Set DAGU_HOST=0.0.0.0 so the service is reachable through the proxy
- Enable basic auth with a generated per-deploy admin password
- Persist /var/lib/dagu (DAGs, logs, run history) in a named volume
Claude-Session: https://claude.ai/code/session_01CRNT6sa2q2P9rUTokeoGhQ
n8n running in queue mode (EXECUTIONS_MODE=queue): main instance for the
editor/webhooks, a scalable pool of workers (deploy.replicas driven by the
N8N_WORKER_REPLICAS env var), Redis (Bull) as the queue broker and
PostgreSQL as the database. Pinned to the current stable n8nio/n8n:2.30.4.
Closes#455
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
In production images LOGS_REDIS_TLS/TRACES_REDIS_TLS default to true, so
the logs-ingestion consumer (part of the plugin-server default mode) kept
attempting a TLS handshake against the plaintext Redis, timed out every
~11s and killed the process after 10 errors (restart loop every ~2.5 min).
Constrain the plugins service to the capability groups this template
ships (cdp_workflows, realtime_cohorts, feature_flags) and pin the redis
TLS flags to false as belt-and-braces.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Mauricio SiuandClaude Fable 5
Marios AntonoudiouandGitHub
Juan VargasandGitHub
Jiho LeeandGitHub
Yusuf GündoğduandGitHub
Finley Crawford-McQuillanandGitHub
Andre Carbajal VargasandGitHub
JavierandGitHub
Stefan ErnstandGitHub
Marko KostichandGitHub
MaflyandGitHub
Jakub KrzyżanowskiandGitHub
Zakher MasriandGitHub
Edward BurtonandGitHub
Mauricio SiuandClaude Fable 5
Stephan Fitzpatrick