fix(orbit): give storage its own generated domain

"storage-${domain}" pushes the first DNS label of Dokploy's generated
sslip.io hosts past 63 characters, so the storage domain never resolves
and browser uploads can't reach it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/audit-all-blueprints.yml

@@ -0,0 +1,163 @@
+name: Audit All Blueprints
+
+# The per-PR validators only look at blueprints a PR touches, which is the right
+# call for CI cost but means a template is checked when it lands and then never
+# again. When a rule is added or tightened, every existing blueprint that breaks
+# it stays broken with nothing surfacing it (see #1047).
+#
+# This job runs the same validators over ALL blueprints on a schedule, so drift
+# is reported instead of accumulating. It never runs on pull_request, so it
+# cannot block a contributor for a pre-existing problem they did not introduce.
+
+on:
+  schedule:
+    # Mondays, 04:00 UTC
+    - cron: "0 4 * * 1"
+  workflow_dispatch:
+    inputs:
+      fail_on_findings:
+        description: "Exit non-zero when findings exist (default: report only)"
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.16.0
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 8
+
+      - name: Install dependencies
+        run: cd build-scripts && pnpm install
+
+      - name: Validate per-template metadata
+        run: node build-scripts/generate-meta.js --check
+
+      - name: Audit every blueprint
+        id: audit
+        run: |
+          # $RUNNER_TEMP is per-job; also cleared explicitly so a re-run or a
+          # partially-executed earlier step can never leak into the summary.
+          WORK="${RUNNER_TEMP:-/tmp}"
+          OUT="$WORK/validator-out.txt"
+          REPORT="$WORK/audit-report.md"
+          SUMMARY="$WORK/audit-summary.md"
+          rm -f "$OUT" "$REPORT" "$SUMMARY"
+
+          COMPOSE_FAILED=""
+          TOML_FAILED=""
+
+          for dir in blueprints/*/; do
+            id="$(basename "$dir")"
+
+            # Run unconditionally: a blueprint with no docker-compose.yml or no
+            # template.toml is itself a finding, and the validators already
+            # report a missing file clearly. Skipping them would hide exactly
+            # the blueprints most likely to be broken.
+            if ! (cd build-scripts && pnpm exec tsx validate-docker-compose.ts \
+                   --file "../$dir/docker-compose.yml") > "$OUT" 2>&1; then
+              COMPOSE_FAILED="$COMPOSE_FAILED $id"
+              {
+                echo "### \`$id\` — docker-compose.yml"
+                echo '```'
+                grep '❌' "$OUT" || cat "$OUT"
+                echo '```'
+              } >> "$REPORT"
+            fi
+
+            if ! (cd build-scripts && pnpm exec tsx validate-template.ts \
+                   --dir "../$dir") > "$OUT" 2>&1; then
+              TOML_FAILED="$TOML_FAILED $id"
+              {
+                echo "### \`$id\` — template.toml"
+                echo '```'
+                grep '❌' "$OUT" || cat "$OUT"
+                echo '```'
+              } >> "$REPORT"
+            fi
+          done
+
+          COMPOSE_COUNT=$(echo $COMPOSE_FAILED | wc -w | tr -d ' ')
+          TOML_COUNT=$(echo $TOML_FAILED | wc -w | tr -d ' ')
+          TOTAL=$(ls -d blueprints/*/ | wc -l | tr -d ' ')
+
+          {
+            echo "## Blueprint audit"
+            echo ""
+            echo "| check | failing | of |"
+            echo "| --- | --- | --- |"
+            echo "| \`validate-docker-compose.ts\` | $COMPOSE_COUNT | $TOTAL |"
+            echo "| \`validate-template.ts\` | $TOML_COUNT | $TOTAL |"
+            echo ""
+          } > "$SUMMARY"
+
+          if [ -f "$REPORT" ]; then
+            cat "$REPORT" >> "$SUMMARY"
+          else
+            echo "No findings." >> "$SUMMARY"
+          fi
+
+          # The step summary caps at ~1MB and truncates silently past it, which
+          # would hide findings exactly as the backlog grows. Bound what we
+          # append and point at the artifact for the rest.
+          SUMMARY_LIMIT=$((512 * 1024))
+          SUMMARY_BYTES=$(wc -c < "$SUMMARY" | tr -d ' ')
+
+          if [ "$SUMMARY_BYTES" -gt "$SUMMARY_LIMIT" ]; then
+            # Emit the header table only, never a byte-sliced prefix: cutting
+            # mid-``` leaves an unclosed code fence, which swallows the notice
+            # below it and makes the truncation invisible in the rendered summary.
+            {
+              head -n 7 "$SUMMARY"
+              echo ""
+              echo "_Report omitted: $SUMMARY_BYTES bytes exceeds the $SUMMARY_LIMIT byte budget for a job summary._"
+              echo "_Download the \`blueprint-audit\` artifact for the complete output._"
+            } >> "$GITHUB_STEP_SUMMARY"
+          else
+            cat "$SUMMARY" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+          # Always published, so the full report survives regardless of size.
+          cp "$SUMMARY" "$WORK/blueprint-audit.md"
+          echo "report_path=$WORK/blueprint-audit.md" >> "$GITHUB_OUTPUT"
+
+          echo "compose_failed=$COMPOSE_COUNT" >> "$GITHUB_OUTPUT"
+          echo "toml_failed=$TOML_COUNT" >> "$GITHUB_OUTPUT"
+
+          if [ "$COMPOSE_COUNT" != "0" ] || [ "$TOML_COUNT" != "0" ]; then
+            echo "::warning::$COMPOSE_COUNT compose and $TOML_COUNT template.toml findings across $TOTAL blueprints"
+          fi
+
+      - name: Upload the full report
+        if: always() && steps.audit.outputs.report_path != ''
+        uses: actions/upload-artifact@v4
+        with:
+          name: blueprint-audit
+          path: ${{ steps.audit.outputs.report_path }}
+          retention-days: 30
+
+      - name: Fail if requested
+        # `inputs` is only populated for workflow_dispatch; on a schedule run it
+        # is not available, so gate on the event first and read the value through
+        # github.event.inputs, which is an empty string when absent.
+        if: >-
+          github.event_name == 'workflow_dispatch' &&
+          github.event.inputs.fail_on_findings == 'true' &&
+          (steps.audit.outputs.compose_failed != '0' || steps.audit.outputs.toml_failed != '0')
+        run: |
+          echo "❌ Findings present and fail_on_findings was requested."
+          exit 1

README.md

@@ -183,7 +183,7 @@ services:
       - 3000:3000
 
     # Instead use this way:
-    ports:
+    expose:
       - 3000
 ```
 

app/src/components/Search.tsx

@@ -109,20 +109,22 @@ const Search = () => {
             </div>
           </div>
 
-          <Input
-            type="text"
-            placeholder="Search templates..."
-            value={searchQuery}
-            onChange={handleSearchChange}
-            className="w-full p-6"
-          />
-          {searchQuery.length > 0 ? (
-            <div className="cursor-pointer" onClick={handleClearSearch}>
-              <XIcon className="absolute end-3 translate-y-3.5 top-1/2 h-5 w-5 text-gray-400" />
-            </div>
-          ) : (
-            <SearchIcon className="absolute end-3 translate-y-2 top-1/2 lg:size-5 size-4 text-gray-400" />
-          )}
+          <div className="relative">
+            <Input
+              type="text"
+              placeholder="Search templates..."
+              value={searchQuery}
+              onChange={handleSearchChange}
+              className="w-full"
+            />
+            {searchQuery.length > 0 ? (
+              <div className="cursor-pointer" onClick={handleClearSearch}>
+                <XIcon className="absolute end-3 top-1/2 -translate-y-1/2 h-5 w-5 text-gray-400" />
+              </div>
+            ) : (
+              <SearchIcon className="absolute end-3 top-1/2 -translate-y-1/2 lg:size-5 size-4 text-gray-400" />
+            )}
+          </div>
         </div>
 
         <div className="flex flex-row gap-2 justify-between">
@@ -154,7 +156,7 @@ const Search = () => {
                 <ChevronsUpDown className="ml-2 h-4 w-4 shrink-0 opacity-50" />
               </Button>
             </PopoverTrigger>
-            <PopoverContent className="w-[200px] p-0">
+            <PopoverContent className="w-50 p-0">
               <Command shouldFilter={false}>
                 <CommandInput
                   placeholder="Search tags...."

app/src/components/TemplateDialog.tsx

@@ -14,6 +14,7 @@ import { Tabs, TabsContent, TabsList, TabsTrigger } from "./ui/tabs";
 import { Label } from "./ui/label";
 import { Clipboard } from "lucide-react";
 import { Input } from "./ui/input";
+import Markdown from "./ui/markdown";
 
 interface Template {
   id: string;
@@ -32,6 +33,7 @@ interface Template {
 interface TemplateFiles {
   dockerCompose: string | null;
   config: string | null;
+  instructions: string | null;
 }
 
 interface TemplateDialogProps {
@@ -169,8 +171,23 @@ const TemplateDialog: React.FC<TemplateDialogProps> = ({
                     </div>
                   </div>
                 )}
-                <Tabs defaultValue="docker-compose" className="w-full">
+                <Tabs
+                  defaultValue={
+                    templateFiles?.instructions
+                      ? "instructions"
+                      : "docker-compose"
+                  }
+                  className="w-full"
+                >
                   <TabsList className="w-full justify-start">
+                    {templateFiles?.instructions && (
+                      <TabsTrigger
+                        value="instructions"
+                        className="data-[state=active]:font-bold"
+                      >
+                        Instructions
+                      </TabsTrigger>
+                    )}
                     <TabsTrigger
                       value="docker-compose"
                       className="data-[state=active]:font-bold"
@@ -184,6 +201,24 @@ const TemplateDialog: React.FC<TemplateDialogProps> = ({
                       Configuration
                     </TabsTrigger>
                   </TabsList>
+
+                  {templateFiles?.instructions && (
+                    <TabsContent value="instructions" className="mt-4">
+                      <div className="space-y-2">
+                        <Label className="flex flex-col items-start w-fit justify-start gap-1">
+                          <span className="leading-tight text-xl font-semibold">
+                            Setup Instructions
+                          </span>
+                          <span className="leading-tight text-sm text-gray-500">
+                            instructions.md
+                          </span>
+                        </Label>
+                        <div className="rounded-md border p-4">
+                          <Markdown content={templateFiles.instructions} />
+                        </div>
+                      </div>
+                    </TabsContent>
+                  )}
                   <TabsContent value="docker-compose" className="mt-4">
                     {templateFiles?.dockerCompose && (
                       <div className="space-y-2">

app/src/components/TemplateGrid.tsx

@@ -28,6 +28,7 @@ interface Template {
 interface TemplateFiles {
   dockerCompose: string | null;
   config: string | null;
+  instructions: string | null;
 }
 
 interface TemplateGridProps {
@@ -80,20 +81,34 @@ const TemplateGrid: React.FC<TemplateGridProps> = ({ view }) => {
   const fetchTemplateFiles = async (templateId: string) => {
     setModalLoading(true);
     try {
-      const [dockerComposeRes, configRes] = await Promise.all([
-        fetch(`/blueprints/${templateId}/docker-compose.yml`),
-        fetch(`/blueprints/${templateId}/template.toml`),
-      ]);
+      const [dockerComposeRes, configRes, instructionsRes] = await Promise.all(
+        [
+          fetch(`/blueprints/${templateId}/docker-compose.yml`),
+          fetch(`/blueprints/${templateId}/template.toml`),
+          fetch(`/blueprints/${templateId}/instructions.md`),
+        ]
+      );
 
       const dockerCompose = dockerComposeRes.ok
         ? await dockerComposeRes.text()
         : null;
       const config = configRes.ok ? await configRes.text() : null;
 
-      setTemplateFiles({ dockerCompose, config });
+      // Guard against SPA fallbacks that return index.html with a 200 status
+      // for templates that don't have an instructions.md file.
+      const instructionsIsMarkdown =
+        instructionsRes.ok &&
+        !(instructionsRes.headers.get("content-type") || "").includes(
+          "text/html"
+        );
+      const instructions = instructionsIsMarkdown
+        ? await instructionsRes.text()
+        : null;
+
+      setTemplateFiles({ dockerCompose, config, instructions });
     } catch (err) {
       console.error("Error fetching template files:", err);
-      setTemplateFiles({ dockerCompose: null, config: null });
+      setTemplateFiles({ dockerCompose: null, config: null, instructions: null });
     } finally {
       setModalLoading(false);
     }

app/src/components/ui/markdown.tsx

@@ -0,0 +1,177 @@
+import React from "react";
+
+// Minimal markdown renderer (no external dependencies) for the per-template
+// instructions.md files. Supports headings, paragraphs, fenced code blocks,
+// ordered/unordered lists, and inline code / bold / links.
+
+const INLINE_PATTERN =
+  /(`[^`]+`)|(\*\*[^*]+\*\*)|(\[[^\]]+\]\([^)\s]+\))/g;
+
+const renderInline = (text: string): React.ReactNode[] => {
+  const nodes: React.ReactNode[] = [];
+  let lastIndex = 0;
+  let key = 0;
+  let match: RegExpExecArray | null;
+  INLINE_PATTERN.lastIndex = 0;
+
+  while ((match = INLINE_PATTERN.exec(text)) !== null) {
+    if (match.index > lastIndex) {
+      nodes.push(text.slice(lastIndex, match.index));
+    }
+    const token = match[0];
+    if (token.startsWith("`")) {
+      nodes.push(
+        <code
+          key={key++}
+          className="px-1.5 py-0.5 rounded bg-muted font-mono text-[0.85em]"
+        >
+          {token.slice(1, -1)}
+        </code>
+      );
+    } else if (token.startsWith("**")) {
+      nodes.push(<strong key={key++}>{token.slice(2, -2)}</strong>);
+    } else {
+      const link = /^\[([^\]]+)\]\(([^)\s]+)\)$/.exec(token);
+      if (link) {
+        nodes.push(
+          <a
+            key={key++}
+            href={link[2]}
+            target="_blank"
+            rel="noopener noreferrer"
+            className="text-blue-600 dark:text-blue-400 underline underline-offset-2"
+          >
+            {link[1]}
+          </a>
+        );
+      } else {
+        nodes.push(token);
+      }
+    }
+    lastIndex = match.index + token.length;
+  }
+  if (lastIndex < text.length) {
+    nodes.push(text.slice(lastIndex));
+  }
+  return nodes;
+};
+
+const HEADING_CLASSES: Record<number, string> = {
+  1: "text-2xl font-bold mt-2",
+  2: "text-xl font-semibold mt-6 border-b pb-1",
+  3: "text-lg font-semibold mt-4",
+  4: "text-base font-semibold mt-3",
+};
+
+interface MarkdownProps {
+  content: string;
+}
+
+const Markdown: React.FC<MarkdownProps> = ({ content }) => {
+  const lines = content.replace(/\r\n/g, "\n").split("\n");
+  const blocks: React.ReactNode[] = [];
+  let key = 0;
+  let i = 0;
+
+  while (i < lines.length) {
+    const line = lines[i];
+
+    // Blank line
+    if (line.trim() === "") {
+      i++;
+      continue;
+    }
+
+    // Fenced code block
+    if (line.trim().startsWith("```")) {
+      const code: string[] = [];
+      i++;
+      while (i < lines.length && !lines[i].trim().startsWith("```")) {
+        code.push(lines[i]);
+        i++;
+      }
+      i++; // skip closing fence
+      blocks.push(
+        <pre
+          key={key++}
+          className="bg-muted rounded-md p-4 overflow-x-auto text-sm font-mono whitespace-pre"
+        >
+          <code>{code.join("\n")}</code>
+        </pre>
+      );
+      continue;
+    }
+
+    // Heading
+    const heading = /^(#{1,4})\s+(.*)$/.exec(line);
+    if (heading) {
+      const level = heading[1].length;
+      const Tag = `h${Math.min(level + 1, 6)}` as keyof React.JSX.IntrinsicElements;
+      blocks.push(
+        <Tag key={key++} className={HEADING_CLASSES[level]}>
+          {renderInline(heading[2])}
+        </Tag>
+      );
+      i++;
+      continue;
+    }
+
+    // Unordered list
+    if (/^[-*]\s+/.test(line)) {
+      const items: string[] = [];
+      while (i < lines.length && /^[-*]\s+/.test(lines[i])) {
+        items.push(lines[i].replace(/^[-*]\s+/, ""));
+        i++;
+      }
+      blocks.push(
+        <ul key={key++} className="list-disc pl-6 space-y-1">
+          {items.map((item, idx) => (
+            <li key={idx}>{renderInline(item)}</li>
+          ))}
+        </ul>
+      );
+      continue;
+    }
+
+    // Ordered list
+    if (/^\d+\.\s+/.test(line)) {
+      const items: string[] = [];
+      while (i < lines.length && /^\d+\.\s+/.test(lines[i])) {
+        items.push(lines[i].replace(/^\d+\.\s+/, ""));
+        i++;
+      }
+      blocks.push(
+        <ol key={key++} className="list-decimal pl-6 space-y-1">
+          {items.map((item, idx) => (
+            <li key={idx}>{renderInline(item)}</li>
+          ))}
+        </ol>
+      );
+      continue;
+    }
+
+    // Paragraph: consume consecutive plain lines
+    const paragraph: string[] = [line];
+    i++;
+    while (
+      i < lines.length &&
+      lines[i].trim() !== "" &&
+      !/^(#{1,4})\s+/.test(lines[i]) &&
+      !/^[-*]\s+/.test(lines[i]) &&
+      !/^\d+\.\s+/.test(lines[i]) &&
+      !lines[i].trim().startsWith("```")
+    ) {
+      paragraph.push(lines[i]);
+      i++;
+    }
+    blocks.push(
+      <p key={key++} className="leading-relaxed">
+        {renderInline(paragraph.join(" "))}
+      </p>
+    );
+  }
+
+  return <div className="space-y-3 text-sm">{blocks}</div>;
+};
+
+export default Markdown;

app/src/mode-toggle.tsx

@@ -5,7 +5,7 @@ import {
   DropdownMenu,
   DropdownMenuContent,
   DropdownMenuItem,
-  DropdownMenuTrigger,  
+  DropdownMenuTrigger,
 } from "./components/ui/dropdown-menu"
 import { useTheme } from "./theme-provider"
 
@@ -13,7 +13,7 @@ export function ModeToggle() {
   const { setTheme } = useTheme()
 
   return (
-    <DropdownMenu>
+    <DropdownMenu modal={false}>
       <DropdownMenuTrigger asChild>
         <Button variant="outline" size="icon">
           <Sun className="h-[1.2rem] w-[1.2rem] rotate-0 scale-100 transition-all dark:-rotate-90 dark:scale-0" />

blueprints/9router/docker-compose.yml

@@ -0,0 +1,32 @@
+version: "3.8"
+
+services:
+  9router:
+    image: decolua/9router:0.5.40
+    restart: unless-stopped
+    environment:
+      DATA_DIR: /app/data
+      PORT: "20128"
+      HOSTNAME: "0.0.0.0"
+      NODE_ENV: production
+      JWT_SECRET: ${JWT_SECRET}
+      INITIAL_PASSWORD: ${INITIAL_PASSWORD}
+      API_KEY_SECRET: ${API_KEY_SECRET}
+      MACHINE_ID_SALT: ${MACHINE_ID_SALT}
+      BASE_URL: http://${ROUTER_HOST}
+      NEXT_PUBLIC_BASE_URL: http://${ROUTER_HOST}
+      HEADROOM_URL: http://headroom:8787
+      AUTH_COOKIE_SECURE: "false"
+    volumes:
+      - 9router-data:/app/data
+    depends_on:
+      - headroom
+
+  # Optional token-reduction proxy that 9Router calls through HEADROOM_URL.
+  # Shipped as a sidecar because the 9Router image does not bundle it.
+  headroom:
+    image: ghcr.io/chopratejas/headroom:0.6.7
+    restart: unless-stopped
+
+volumes:
+  9router-data:

blueprints/9router/meta.json

@@ -0,0 +1,17 @@
+{
+  "id": "9router",
+  "name": "9Router",
+  "version": "0.5.40",
+  "description": "Self-hosted AI model router that rotates requests across 40+ providers with automatic fallback, exposing an OpenAI-compatible endpoint for coding agents.",
+  "logo": "9router.png",
+  "links": {
+    "github": "https://github.com/decolua/9router",
+    "website": "https://9router.com",
+    "docs": "https://github.com/decolua/9router/blob/master/DOCKER.md"
+  },
+  "tags": [
+    "ai",
+    "proxy",
+    "developer-tools"
+  ]
+}

blueprints/9router/template.toml

@@ -0,0 +1,21 @@
+[variables]
+main_domain = "${domain}"
+jwt_secret = "${password:64}"
+initial_password = "${password:32}"
+api_key_secret = "${password:64}"
+machine_id_salt = "${password:32}"
+
+[config]
+env = [
+  "ROUTER_HOST=${main_domain}",
+  "JWT_SECRET=${jwt_secret}",
+  "INITIAL_PASSWORD=${initial_password}",
+  "API_KEY_SECRET=${api_key_secret}",
+  "MACHINE_ID_SALT=${machine_id_salt}",
+]
+mounts = []
+
+[[config.domains]]
+serviceName = "9router"
+port = 20128
+host = "${main_domain}"

blueprints/ackee/docker-compose.yml

@@ -3,7 +3,7 @@ version: "3"
 services:
   ackee:
     image: electerious/ackee:3.4.2
-    ports:
+    expose:
       - "3000"
     environment:
       - ACKEE_USERNAME=${ACKEE_USERNAME}

blueprints/ackee/instructions.md

@@ -1,4 +0,0 @@
-
-## Instructions
-
-We don't have nothing to show here....

blueprints/activepieces/docker-compose.yml

@@ -61,4 +61,4 @@ services:
 
 volumes:
   postgres_data:
-  redis_data: 
+  redis_data: 

blueprints/adguardhome/docker-compose.yml

@@ -1,3 +1,4 @@
+# dokploy: allow-host-ports — DNS (53/tcp+udp), DHCP (67/68) and DNS-over-TLS/QUIC (853) are not HTTP protocols; clients must reach them directly on the host, Traefik cannot route them.
 version: "3.8"
 services:
   adguardhome:
@@ -10,11 +11,12 @@ services:
       - "68:68/tcp" # DHCP Client
       - "853:853/tcp" # DNS over TLS, DNS-over-QUIC
       - "853:853/udp" # DNS over TLS, DNS-over-QUIC
-      - "6060:6060/tcp" # HTTP (pprof)
+    expose:
+      - 6060 # HTTP (pprof) — debug endpoint, no need to publish it on the host
     volumes:
       - adguardhome-work:/opt/adguardhome/work
       - adguardhome-conf:/opt/adguardhome/conf
 
 volumes:
   adguardhome-work: {}
-  adguardhome-conf: {}
+  adguardhome-conf: {}

blueprints/adminer/docker-compose.yml

@@ -3,5 +3,5 @@ services:
   adminer:
     image: adminer:4.8.1
     restart: unless-stopped
-    ports:
-      - 8080 
+    expose:
+      - 8080 

blueprints/adventurelog/meta.json

@@ -7,7 +7,7 @@
   "links": {
     "github": "https://github.com/seanmorley15/adventurelog",
     "website": "https://adventurelog.app/",
-    "docs": "https://adventurelog.app/docs/"
+    "docs": "https://adventurelog.app/docs/intro/adventurelog_overview.html"
   },
   "tags": [
     "activity",

blueprints/affinepro/docker-compose.yml

@@ -1,9 +1,9 @@
 version: "3.8"
 services:
   affinepro:
-    image: ghcr.io/toeverything/affine-graphql:stable-780dd83
+    image: ghcr.io/toeverything/affine:stable
     restart: unless-stopped
-    ports:
+    expose:
       - 3010
     volumes:
       - affine-storage:/root/.affine/storage
@@ -12,6 +12,7 @@ services:
       - REDIS_SERVER_HOST=redis
       - REDIS_SERVER_PASSWORD=${REDIS_PASSWORD}
       - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@db:5432/affinepro
+      - AFFINE_INDEXER_ENABLED=false
       - AFFINE_SERVER_HOST=${DOMAIN}
       - MAILER_HOST=${MAILER_HOST}
       - MAILER_PORT=${MAILER_PORT}
@@ -19,16 +20,21 @@ services:
       - MAILER_PASSWORD=${MAILER_PASSWORD}
       - MAILER_SENDER=${MAILER_SENDER}
     depends_on:
-      - db
-      - redis
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      migration:
+        condition: service_completed_successfully
 
   migration:
-    image: ghcr.io/toeverything/affine-graphql:stable-780dd83
-    command: node ./scripts/self-host-predeploy.js
+    image: ghcr.io/toeverything/affine:stable
+    command: ["sh", "-c", "node ./scripts/self-host-predeploy.js"]
     environment:
       - REDIS_SERVER_HOST=redis
       - REDIS_SERVER_PASSWORD=${REDIS_PASSWORD}
       - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@db:5432/affinepro
+      - AFFINE_INDEXER_ENABLED=false
       - AFFINE_SERVER_HOST=${DOMAIN}
       - MAILER_HOST=${MAILER_HOST}
       - MAILER_PORT=${MAILER_PORT}
@@ -39,17 +45,25 @@ services:
       - affine-storage:/root/.affine/storage
       - affine-config:/root/.affine/config
     depends_on:
-      - db
-      - redis
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
 
   db:
-    image: postgres:15-alpine
+    image: pgvector/pgvector:pg16
     restart: unless-stopped
     environment:
       - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
       - POSTGRES_DB=affinepro
+      - POSTGRES_INITDB_ARGS=--data-checksums
     volumes:
       - postgres-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD", "pg_isready", "-U", "postgres", "-d", "affinepro"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
   redis:
     image: redis:7-alpine
@@ -57,9 +71,14 @@ services:
     command: redis-server --requirepass ${REDIS_PASSWORD}
     volumes:
       - redis-data:/data
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli -a '${REDIS_PASSWORD}' ping | grep PONG"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
 volumes:
   affine-storage: {}
   affine-config: {}
   postgres-data: {}
-  redis-data: {} 
+  redis-data: {}

blueprints/affinepro/meta.json

@@ -1,13 +1,13 @@
 {
   "id": "affinepro",
   "name": "Affine Pro",
-  "version": "stable-780dd83",
+  "version": "stable",
   "description": "Affine Pro is a modern, self-hosted platform designed for collaborative content creation and project management. It offers an intuitive interface, seamless real-time collaboration, and powerful tools for organizing tasks, notes, and ideas.",
   "logo": "logo.png",
   "links": {
     "github": "https://github.com/toeverything/Affine",
     "website": "https://affine.pro/",
-    "docs": "https://affine.pro/docs"
+    "docs": "https://docs.affine.pro/"
   },
   "tags": [
     "collaboration",

blueprints/agent-zero/docker-compose.yml

@@ -11,4 +11,4 @@ services:
     volumes:
       - agent-zero-data:/a0/usr
 volumes:
-  agent-zero-data:
+  agent-zero-data:

blueprints/agentdvr/docker-compose.yml

@@ -11,12 +11,11 @@ services:
       - agentdvr-config:/AgentDVR/Media/XML/
       - agentdvr-media:/AgentDVR/Media/WebServerRoot/Media/
       - agentdvr-commands:/AgentDVR/Commands/
-    ports:
+    expose:
       - 8090
       - 3478/udp
       - 50000-50100/udp
-
 volumes:
   agentdvr-config: {}
   agentdvr-media: {}
-  agentdvr-commands: {}
+  agentdvr-commands: {}

blueprints/agentdvr/template.toml

@@ -3,6 +3,7 @@ main_domain = "${domain}"
 timezone = "America/New_York"
 
 [config]
+mounts = []
 [[config.domains]]
 serviceName = "agentdvr"
 port = 8090
@@ -10,5 +11,3 @@ host = "${main_domain}"
 
 [config.env]
 TIMEZONE = "${timezone}"
-
-[[config.mounts]]

blueprints/akaunting/template.toml

@@ -24,6 +24,7 @@ port = 80
 host = "${main_domain}"
 
 [config]
+mounts = []
 env = [
   # App
   "APP_URL=${main_domain}",
@@ -50,5 +51,4 @@ env = [
   "MYSQL_RANDOM_ROOT_PASSWORD=yes"
 ]
 
-# No custom mounts needed; volumes are already defined in compose.
-[[config.mounts]]
+# No custom mounts needed; volumes are already defined in compose.

blueprints/alist/docker-compose.yml

@@ -11,4 +11,4 @@ services:
     restart: unless-stopped
 
 volumes:
-  alist-data:
+  alist-data:

blueprints/alltube/docker-compose.yml

@@ -3,10 +3,10 @@ services:
   alltube:
     image: dnomd343/alltube:latest
     restart: unless-stopped
-    ports:
+    expose:
       - 80
     environment:
       - TITLE=${TITLE}
       - CONVERT=${CONVERT}
       - STREAM=${STREAM}
-      - REMUX=${REMUX} 
+      - REMUX=${REMUX} 

blueprints/ampache/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   ampache:
     image: ampache/ampache:latest
     restart: unless-stopped
-    ports:
+    expose:
       - 80
     volumes:
       - config:/var/www/config
@@ -14,4 +14,4 @@ services:
 volumes:
   config: {}
   log: {}
-  mysql: {} 
+  mysql: {} 

blueprints/anonupload/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   anonupload:
     image: ghcr.io/supernova3339/anonfiles:1
     restart: unless-stopped
-    ports:
+    expose:
       - 80
     environment:
       - ADMIN_EMAIL=${ADMIN_EMAIL}
@@ -13,4 +13,4 @@ services:
       - uploads:/var/www/html/uploads
 
 volumes:
-  uploads: {} 
+  uploads: {} 

blueprints/answer/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   answer:
     image: apache/answer:1.4.1
-    ports:
+    expose:
       - '80'
     restart: on-failure
     volumes:

blueprints/answer/meta.json

@@ -10,7 +10,7 @@
     "docs": "https://answer.apache.org/docs"
   },
   "tags": [
-    "q&a",
+    "q-and-a",
     "self-hosted"
   ]
 }

blueprints/anubis/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   anubis:
     image: ghcr.io/techarohq/anubis:latest
     restart: unless-stopped
-    ports:
+    expose:
       - "8923" # Anubis default port
     environment:
       # Required: Point to your frontend service locally

blueprints/anythingllm/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   anythingllm:
     image: mintplexlabs/anythingllm:latest
     restart: unless-stopped
-    ports:
+    expose:
       - 3001
     environment:
       - STORAGE_DIR=/app/server/storage
@@ -13,4 +13,4 @@ services:
       - SYS_ADMIN
 
 volumes:
-  storage: {} 
+  storage: {} 

blueprints/anythingllm/meta.json

@@ -6,8 +6,8 @@
   "logo": "logo.png",
   "links": {
     "github": "https://github.com/Mintplex-Labs/anything-llm",
-    "website": "https://useanything.com",
-    "docs": "https://github.com/Mintplex-Labs/anything-llm/tree/master/docs"
+    "website": "https://anythingllm.com/",
+    "docs": "https://docs.anythingllm.com/"
   },
   "tags": [
     "ai",

blueprints/anytype/docker-compose.yml

@@ -1,3 +1,4 @@
+# dokploy: allow-host-ports — Anytype clients speak the any-sync protocol (TCP 33010, UDP/QUIC 33020) directly against the server; it is not HTTP, so Traefik cannot route it.
 # Example: Any-Sync-Bundle with embedded MongoDB and Redis (all-in-one image)
 #
 # Usage:
@@ -13,7 +14,7 @@ services:
       - "33010:33010"
       - "33020:33020/udp"
     volumes:
-      - ./data:/data
+      - ../files/anytype-data:/data
     environment:
       # Advertise addresses clients should use. Replace with your server hostname/IP.
       ANY_SYNC_BUNDLE_INIT_EXTERNAL_ADDRS: "192.168.100.9"

blueprints/apprise-api/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   apprise-api:
     image: linuxserver/apprise-api:latest
     restart: unless-stopped
-    ports:
+    expose:
       - 8000
     environment:
       - PUID=1000
@@ -13,4 +13,4 @@ services:
       - config:/config
 
 volumes:
-  config: {} 
+  config: {} 

blueprints/appsmith/docker-compose.yml

@@ -7,4 +7,4 @@ services:
     restart: unless-stopped
 
 volumes:
-  appsmith-data:
+  appsmith-data:

blueprints/appwrite/template.toml

@@ -15,7 +15,10 @@ env = [
   "_APP_POOL_ADAPTER=stack",
   "_APP_WORKER_PER_CORE=6",
   "_APP_OPTIONS_ABUSE=enabled",
-  "_APP_OPTIONS_FORCE_HTTPS=disabled",
+  # Requires HTTPS to be enabled on the main domain in Dokploy (Domains tab).
+  # Makes Appwrite generate https:// URLs (e.g. APPWRITE_FUNCTION_API_ENDPOINT for
+  # Functions) and reject plain-HTTP API calls; over plain HTTP the console cannot log in.
+  "_APP_OPTIONS_FORCE_HTTPS=enabled",
   "_APP_OPTIONS_ROUTER_FORCE_HTTPS=disabled",
   "_APP_OPTIONS_ROUTER_PROTECTION=disabled",
   "_APP_OPENSSL_KEY_V1=${openssl_key}",

blueprints/arangodb/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   arangodb:
     image: arangodb:3.12.4
     restart: unless-stopped
-    ports:
+    expose:
       - 8529
     environment:
       - ARANGO_ROOT_PASSWORD=${ARANGO_PASSWORD}
@@ -11,4 +11,4 @@ services:
       - data:/var/lib/arangodb3
 
 volumes:
-  data: {} 
+  data: {} 

blueprints/archivebox/docker-compose.yml

@@ -9,8 +9,7 @@ services:
       PUBLIC_SNAPSHOTS: ${PUBLIC_SNAPSHOTS}
     volumes:
       - archivebox_data:/data
-    ports:
+    expose:
       - "8000"
-
 volumes:
   archivebox_data:

blueprints/argilla/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   argilla-web:
     image: argilla/argilla-server:latest
     restart: unless-stopped
-    ports:
+    expose:
       - 6900
     environment:
       - ARGILLA_HOME_PATH=/var/lib/argilla
@@ -74,4 +74,4 @@ volumes:
   argilladata: {}
   elasticdata: {}
   dbdata: {}
-  redisdata: {} 
+  redisdata: {} 

blueprints/audiobookshelf/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   audiobookshelf:
     image: ghcr.io/advplyr/audiobookshelf:2.19.4
     restart: unless-stopped
-    ports:
+    expose:
       - 80
     environment:
       - TZ=UTC
@@ -14,4 +14,4 @@ services:
 
 volumes:
   config: {}
-  metadata: {} 
+  metadata: {} 

blueprints/authelia/docker-compose.yml

@@ -16,9 +16,8 @@ services:
         condition: service_healthy
       postgres:
         condition: service_healthy
-    ports:
+    expose:
       - 9091
-
   redis:
     image: redis:7-alpine
     restart: unless-stopped
@@ -52,4 +51,4 @@ services:
 volumes:
   authelia_config:
   redis_data:
-  postgres_data:
+  postgres_data:

blueprints/authorizer/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   authorizer:
     image: lakhansamani/authorizer:1.4.4
     restart: unless-stopped
-    ports:
+    expose:
       - 8080
     environment:
       - DATABASE_TYPE=postgres
@@ -37,4 +37,4 @@ services:
 
 volumes:
   db_data: {}
-  redis_data: {} 
+  redis_data: {} 

blueprints/autobase/docker-compose.yml

@@ -1,8 +1,8 @@
 services:
   autobase-console:
-    image: autobase/console:2.7.2
+    image: autobase/console:2.10.0
     restart: unless-stopped
-    ports:
+    expose:
       - "80"
       - "8080"
     environment:

blueprints/autobase/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "autobase",
   "name": "Autobase",
-  "version": "2.7.2",
+  "version": "2.10.0",
   "description": "Autobase for PostgreSQL® is an open-source alternative to cloud-managed databases (self-hosted DBaaS).",
   "links": {
     "github": "https://github.com/vitabaks/autobase",

blueprints/automatisch/docker-compose.yml

@@ -1,17 +1,15 @@
-version: "3.8"
 services:
   automatisch:
-    image: dockeriddonuts/automatisch:2.0
+    image: automatischio/automatisch:0.15.0
     restart: unless-stopped
-    ports:
-      - 3000
     environment:
       - HOST=${DOMAIN}
       - PROTOCOL=http
       - PORT=3000
+      - API_URL=http://${DOMAIN}
+      - WEB_APP_URL=http://${DOMAIN}
       - APP_ENV=production
       - REDIS_HOST=automatisch-redis
-      - REDIS_USERNAME=default
       - REDIS_PASSWORD=${REDIS_PASSWORD}
       - POSTGRES_HOST=automatisch-postgres
       - POSTGRES_DATABASE=automatisch
@@ -23,11 +21,13 @@ services:
     volumes:
       - storage:/automatisch/storage
     depends_on:
-      - automatisch-postgres
-      - automatisch-redis
+      automatisch-postgres:
+        condition: service_healthy
+      automatisch-redis:
+        condition: service_started
 
   automatisch-worker:
-    image: dockeriddonuts/automatisch:2.0
+    image: automatischio/automatisch:0.15.0
     restart: unless-stopped
     environment:
       - APP_ENV=production
@@ -44,8 +44,7 @@ services:
     volumes:
       - storage:/automatisch/storage
     depends_on:
-      - automatisch-postgres
-      - automatisch-redis
+      - automatisch
 
   automatisch-postgres:
     image: postgres:15-alpine
@@ -56,18 +55,20 @@ services:
       - POSTGRES_DB=automatisch
     volumes:
       - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d automatisch"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
   automatisch-redis:
     image: redis:7-alpine
     restart: unless-stopped
     command: redis-server --requirepass ${REDIS_PASSWORD}
-    environment:
-      - REDIS_USERNAME=default
-      - REDIS_PASSWORD=${REDIS_PASSWORD}
     volumes:
       - redis_data:/data
 
 volumes:
   storage: {}
   postgres_data: {}
-  redis_data: {} 
+  redis_data: {}

blueprints/automatisch/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "automatisch",
   "name": "Automatisch",
-  "version": "2.0",
+  "version": "0.15.0",
   "description": "Automatisch is a powerful, self-hosted workflow automation tool designed for connecting your apps and automating repetitive tasks. With Automatisch, you can create workflows to sync data, send notifications, and perform various actions seamlessly across different services.",
   "logo": "logo.png",
   "links": {

blueprints/automatisch/template.toml

@@ -13,6 +13,7 @@ port = 3000
 host = "${main_domain}"
 
 [config.env]
+DOMAIN = "${main_domain}"
 DB_PASSWORD = "${db_password}"
 REDIS_PASSWORD = "${redis_password}"
 ENCRYPTION_KEY = "${encryption_key}"

blueprints/azuracast/docker-compose.yml

@@ -2,7 +2,7 @@ services:
   azuracast:
     image: ghcr.io/azuracast/azuracast:latest
     restart: unless-stopped
-    ports:
+    expose:
       - 80
     volumes:
       - azuracast-station-data:/var/azuracast/stations
@@ -36,4 +36,4 @@ volumes:
   azuracast-data: {}
   azuracast-uploads: {}
   azuracast-backups: {}
-  mariadb-data: {}
+  mariadb-data: {}

blueprints/azuracast/template.toml

@@ -4,6 +4,7 @@ mysql_root_password = "${password:32}"
 mysql_password = "${password:16}"
 
 [config]
+mounts = []
 [[config.domains]]
 serviceName = "azuracast"
 port = 80
@@ -27,5 +28,3 @@ NGINX_RADIO_PORTS = "8000,8010,8020,8030,8040,8050"
 PREFER_RELEASE_BUILDS = "true"
 COMPOSER_PLUGIN_MODE = "false"
 ADDITIONAL_MEDIA_SYNC_WORKER_COUNT = "0"
-
-[[config.mounts]]

blueprints/babybuddy/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   babybuddy:
     image: linuxserver/babybuddy:2.7.0
     restart: unless-stopped
-    ports:
+    expose:
       - 8000
     environment:
       - PUID=1000
@@ -16,4 +16,4 @@ services:
       - config:/config
 
 volumes:
-  config: {} 
+  config: {} 

blueprints/babybuddy/meta.json

@@ -7,7 +7,7 @@
   "links": {
     "github": "https://github.com/babybuddy/babybuddy",
     "website": "https://babybuddy.app",
-    "docs": "https://docs.babybuddy.app"
+    "docs": "https://docs.baby-buddy.net/"
   },
   "tags": [
     "parenting",

blueprints/backrest/docker-compose.yml

@@ -2,7 +2,7 @@ services:
   backrest:
     image: garethgeorge/backrest:v1.7.3
     restart: unless-stopped
-    ports:
+    expose:
       - 9898
     environment:
       - BACKREST_PORT=9898

blueprints/baikal/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   baikal:
     image: ckulka/baikal:nginx-php8.2
     restart: unless-stopped
-    ports:
+    expose:
       - 80
     environment:
       - TZ=UTC
@@ -13,4 +13,4 @@ services:
 
 volumes:
   config: {}
-  data: {} 
+  data: {} 

blueprints/barrage/docker-compose.yml

@@ -3,11 +3,11 @@ services:
   barrage:
     image: maulik9898/barrage:0.3.0
     restart: unless-stopped
-    ports:
+    expose:
       - 3000
     environment:
       - NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
       - NEXTAUTH_URL=http://${DOMAIN}
       - DELUGE_URL=${DELUGE_URL}
       - DELUGE_PASSWORD=${DELUGE_PASSWORD}
-      - BARRAGE_PASSWORD=${BARRAGE_PASSWORD} 
+      - BARRAGE_PASSWORD=${BARRAGE_PASSWORD} 

blueprints/bazarr/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   bazarr:
     image: lscr.io/linuxserver/bazarr:1.5.1
     restart: unless-stopped
-    ports:
+    expose:
       - 6767
     environment:
       - PUID=1000
@@ -15,4 +15,4 @@ services:
       - ${TV_PATH}:/tv
 
 volumes:
-  config: {} 
+  config: {} 

blueprints/bazarr/meta.json

@@ -7,7 +7,7 @@
   "links": {
     "github": "https://github.com/morpheus65535/bazarr",
     "website": "https://www.bazarr.media/",
-    "docs": "https://www.bazarr.media/docs"
+    "docs": "https://wiki.bazarr.media/"
   },
   "tags": [
     "subtitles",

blueprints/bentopdf/meta.json

@@ -5,9 +5,9 @@
   "description": "BentoPDF is a lightweight PDF conversion microservice that exposes a simple HTTP API for generating PDFs.",
   "logo": "image.png",
   "links": {
-    "github": "https://github.com/bentopdf/bentopdf",
+    "github": "https://github.com/alam00000/bentopdf/",
     "website": "https://bentopdf.com/",
-    "docs": "https://github.com/bentopdf/bentopdf#readme"
+    "docs": "https://www.bentopdf.com/docs/"
   },
   "tags": [
     "pdf",

blueprints/beszel/docker-compose.yml

@@ -3,11 +3,11 @@ services:
   beszel:
     image: henrygd/beszel:0.10.2
     restart: unless-stopped
-    ports:
+    expose:
       - 8090
     volumes:
       - beszel_data:/beszel_data
       - /var/run/docker.sock:/var/run/docker.sock:ro
 
 volumes:
-  beszel_data: {} 
+  beszel_data: {} 

blueprints/bigcapital/docker-compose.yml

@@ -4,10 +4,8 @@ services:
     restart: unless-stopped
     depends_on:
       - server
-    ports:
+    expose:
       - '80'
-
-
   server:
     image: bigcapitalhq/server:latest
     restart: unless-stopped
@@ -18,9 +16,8 @@ services:
         condition: service_started
       redis:
         condition: service_started
-    ports:
+    expose:
       - '3000'
-
     environment:
       # Mail
       - MAIL_HOST=${MAIL_HOST}
@@ -97,9 +94,8 @@ services:
       - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
     volumes:
       - mysql:/var/lib/mysql
-    ports:
+    expose:
       - '3306'
-
     healthcheck:
       test: ["CMD-SHELL", "mysqladmin ping -h localhost -u root -p$$MYSQL_ROOT_PASSWORD || exit 1"]
       interval: 10s
@@ -110,7 +106,7 @@ services:
   mongo:
     image: mongo:7
     restart: unless-stopped
-    ports:
+    expose:
       - '27017'
     volumes:
       - mongo:/data/db
@@ -119,7 +115,7 @@ services:
   redis:
     image: redis:7-alpine
     restart: unless-stopped
-    ports:
+    expose:
       - '6379'
     volumes:
       - redis:/data
@@ -133,10 +129,8 @@ services:
   gotenberg:
     image: gotenberg/gotenberg:7
     restart: unless-stopped
-    ports:
+    expose:
       - '9000'
-
-
 volumes:
   mysql:
     name: bigcapital_mysql

blueprints/bigcapital/template.toml

@@ -72,7 +72,7 @@ s3_endpoint = ""
 s3_bucket = ""
 
 [config]
-
+mounts = []
 [[config.domains]]
 serviceName = "webapp"
 port = 80
@@ -165,6 +165,3 @@ MYSQL_DATABASE = "${system_db_name}"
 MYSQL_USER = "${db_user}"
 MYSQL_PASSWORD = "${db_password}"
 MYSQL_ROOT_PASSWORD = "${db_root_password}"
-
-[[config.mounts]]
-

blueprints/billmora/docker-compose.yml

@@ -28,6 +28,9 @@ services:
       - AUTORUN_LARAVEL_STORAGE_LINK=true
     volumes:
       - billmora-storage:/var/www/html/storage
+      - billmora-plugins:/var/www/html/plugin
+      - billmora-themes-resources:/var/www/html/resources/themes
+      - billmora-themes-public:/var/www/html/public/themes
     depends_on:
       billmora-db:
         condition: service_healthy
@@ -58,6 +61,9 @@ services:
       - AUTORUN_ENABLED=false
     volumes:
       - billmora-storage:/var/www/html/storage
+      - billmora-plugins:/var/www/html/plugin
+      - billmora-themes-resources:/var/www/html/resources/themes
+      - billmora-themes-public:/var/www/html/public/themes
     depends_on:
       billmora-db:
         condition: service_healthy
@@ -88,6 +94,9 @@ services:
       - AUTORUN_ENABLED=false
     volumes:
       - billmora-storage:/var/www/html/storage
+      - billmora-plugins:/var/www/html/plugin
+      - billmora-themes-resources:/var/www/html/resources/themes
+      - billmora-themes-public:/var/www/html/public/themes
     depends_on:
       billmora-db:
         condition: service_healthy
@@ -126,5 +135,8 @@ services:
 
 volumes:
   billmora-storage:
+  billmora-plugins:
+  billmora-themes-resources:
+  billmora-themes-public:
   billmora-db-data:
   billmora-redis-data:

blueprints/blender/docker-compose.yml

@@ -19,7 +19,7 @@ services:
       - PGID=1000
       - TZ=Etc/UTC
       - SUBFOLDER=/ #optional
-    ports:
+    expose:
       - 3000
       - 3001
     restart: unless-stopped

blueprints/blinko/docker-compose.yml

@@ -16,9 +16,8 @@ services:
       options:
         max-size: "10m"
         max-file: "3"
-    ports:
+    expose:
       - 1111
-
   blinko-postgres:
     image: postgres:14
     restart: always

blueprints/blogfactory/README.md

@@ -0,0 +1,12 @@
+# BlogFactory on Dokploy
+
+Dokploy creates independent database, storage, JWT, encryption, and scheduler secrets during import. Only the `web` service receives a public domain; the API, scheduler, PostgreSQL, and MinIO remain private.
+
+## First administrator
+
+1. Open the Compose service's environment settings and copy the generated `ADMIN_EMAILS` value.
+2. Open the generated BlogFactory domain and register with that exact email address.
+3. Return to the Compose environment settings, change `BLOGFACTORY_ALLOW_SIGNUP` to `false`, and redeploy.
+4. Add OpenRouter, CMS, or Google Search Console credentials from BlogFactory only when you need those optional integrations.
+
+BlogFactory sends reviewed content to connected CMS providers as drafts. The template does not grant live-publish or delete authority.

blueprints/blogfactory/blogfactory.svg

@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <rect width="64" height="64" rx="8" fill="#fff"/>
+  <rect x="1" y="1" width="62" height="62" rx="7" fill="none" stroke="#d7d8d4" stroke-width="2"/>
+  <circle cx="50" cy="14" r="5" fill="#ff5a1f"/>
+  <rect x="13" y="31" width="10" height="18" fill="#202224"/>
+  <rect x="27" y="20" width="10" height="29" fill="#202224"/>
+  <rect x="41" y="26" width="10" height="23" fill="#202224"/>
+</svg>

blueprints/blogfactory/docker-compose.yml

@@ -0,0 +1,102 @@
+version: "3.8"
+
+services:
+  postgres:
+    image: postgres:17.6-alpine3.22
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: blogfactory
+      POSTGRES_USER: blogfactory
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U blogfactory -d blogfactory"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+  minio:
+    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
+    restart: unless-stopped
+    command: server /data --console-address :9001
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
+    volumes:
+      - minio-data:/data
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+  api:
+    image: ghcr.io/blogfactoryhq/blogfactory-api:v0.1.0
+    restart: unless-stopped
+    command: >-
+      sh -c "bun run src/init-s3-bucket.ts && bun run src/db/migrate.ts && exec bun run src/index.ts"
+    depends_on:
+      postgres:
+        condition: service_healthy
+      minio:
+        condition: service_healthy
+    expose:
+      - 3000
+    environment:
+      NODE_ENV: production
+      PORT: 3000
+      BLOGFACTORY_SELF_HOSTED: "true"
+      DATABASE_URL: postgresql://blogfactory:${POSTGRES_PASSWORD}@postgres:5432/blogfactory
+      JWT_SECRET: ${JWT_SECRET}
+      API_KEY_ENCRYPTION_SECRET: ${API_KEY_ENCRYPTION_SECRET}
+      ADMIN_EMAILS: ${ADMIN_EMAILS}
+      BLOGFACTORY_ALLOW_SIGNUP: ${BLOGFACTORY_ALLOW_SIGNUP}
+      CRON_SECRET: ${CRON_SECRET}
+      WEB_APP_URL: ${BLOGFACTORY_URL}
+      MCP_APP_URL: http://web/mcp-review.html
+      MCP_ALLOWED_ORIGINS: ${BLOGFACTORY_URL}
+      S3_ENDPOINT: http://minio:9000
+      S3_ACCESS_KEY_ID: ${MINIO_ROOT_USER}
+      S3_SECRET_ACCESS_KEY: ${MINIO_ROOT_PASSWORD}
+      S3_BUCKET: blogfactory
+      S3_REGION: us-east-1
+    healthcheck:
+      test: ["CMD", "bun", "-e", "fetch('http://localhost:3000/api/ready').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      interval: 10s
+      timeout: 5s
+      retries: 20
+
+  web:
+    image: ghcr.io/blogfactoryhq/blogfactory-web:v0.1.0
+    restart: unless-stopped
+    depends_on:
+      api:
+        condition: service_healthy
+    expose:
+      - 80
+    environment:
+      API_UPSTREAM: http://api:3000
+    healthcheck:
+      test: ["CMD-SHELL", "nginx -t >/dev/null 2>&1 && wget -q -O /dev/null http://api:3000/api/ready"]
+      interval: 10s
+      timeout: 5s
+      retries: 20
+
+  scheduler:
+    image: curlimages/curl:8.15.0
+    restart: unless-stopped
+    depends_on:
+      api:
+        condition: service_healthy
+    environment:
+      CRON_SECRET: ${CRON_SECRET}
+      CRON_INTERVAL_SECONDS: 21600
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - >-
+        while true; do curl --fail --silent --show-error --output /dev/null -H "Authorization: Bearer $${CRON_SECRET}" http://api:3000/api/cron/drain && echo "Scheduler drain completed"; sleep "$${CRON_INTERVAL_SECONDS}"; done
+
+volumes:
+  postgres-data:
+  minio-data:

blueprints/blogfactory/meta.json

@@ -0,0 +1,13 @@
+{
+  "id": "blogfactory",
+  "name": "BlogFactory",
+  "version": "v0.1.0",
+  "description": "Self-hosted control plane for AI-assisted content operations and human-approved CMS draft delivery.",
+  "logo": "blogfactory.svg",
+  "links": {
+    "github": "https://github.com/BlogFactoryHQ/blogfactory",
+    "website": "https://blogfactory.io/",
+    "docs": "https://github.com/BlogFactoryHQ/blogfactory/blob/main/docs/self-hosting.md"
+  },
+  "tags": ["ai", "automation", "content-management"]
+}

blueprints/blogfactory/template.toml

@@ -0,0 +1,28 @@
+[variables]
+main_domain = "${domain}"
+postgres_password = "${password:48}"
+minio_root_user = "blogfactory"
+minio_root_password = "${password:48}"
+jwt_secret = "${base64:48}"
+encryption_secret = "${base64:48}"
+cron_secret = "${base64:48}"
+admin_email = "${email}"
+
+[config]
+env = [
+  "POSTGRES_PASSWORD=${postgres_password}",
+  "MINIO_ROOT_USER=${minio_root_user}",
+  "MINIO_ROOT_PASSWORD=${minio_root_password}",
+  "JWT_SECRET=${jwt_secret}",
+  "API_KEY_ENCRYPTION_SECRET=${encryption_secret}",
+  "CRON_SECRET=${cron_secret}",
+  "ADMIN_EMAILS=${admin_email}",
+  "BLOGFACTORY_ALLOW_SIGNUP=true",
+  "BLOGFACTORY_URL=https://${main_domain}",
+]
+mounts = []
+
+[[config.domains]]
+serviceName = "web"
+port = 80
+host = "${main_domain}"

blueprints/bluesky-pds/docker-compose.yml

@@ -45,4 +45,4 @@ services:
       timeout: 10s
       retries: 10
 volumes: 
-  pds-data:
+  pds-data:

blueprints/bonfire/docker-compose.yml

@@ -0,0 +1,84 @@
+version: "3.8"
+services:
+  bonfire:
+    image: bonfirenetworks/bonfire:1.0.5-social-amd64
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+      search:
+        condition: service_started
+    environment:
+      # Instance
+      - HOSTNAME=${BONFIRE_HOSTNAME}
+      - PUBLIC_PORT=${PUBLIC_PORT:-80}
+      - SERVER_PORT=4000
+      - APP_NAME=${APP_NAME:-Bonfire}
+      - LANG=en_US.UTF-8
+      # Secrets
+      - SECRET_KEY_BASE=${SECRET_KEY_BASE}
+      - SIGNING_SALT=${SIGNING_SALT}
+      - ENCRYPTION_SALT=${ENCRYPTION_SALT}
+      - RELEASE_COOKIE=${RELEASE_COOKIE}
+      # Database (migrations run automatically on startup)
+      - POSTGRES_HOST=db
+      - POSTGRES_USER=postgres
+      - POSTGRES_DB=bonfire_db
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      # Must stay false for the initial migrations; can be set to true
+      # after the first deployment to speed up future upgrades
+      - DB_MIGRATE_INDEXES_CONCURRENTLY=${DB_MIGRATE_INDEXES_CONCURRENTLY:-false}
+      # Search (Meilisearch)
+      - SEARCH_ADAPTER=meili
+      - SEARCH_MEILI_INSTANCE=http://search:7700
+      - MEILI_MASTER_KEY=${MEILI_MASTER_KEY}
+      # Email (the first account to sign up becomes admin and needs no
+      # confirmation email; configure a mail backend for further signups)
+      - MAIL_BACKEND=${MAIL_BACKEND:-none}
+      - MAIL_SERVER=${MAIL_SERVER:-}
+      - MAIL_PORT=${MAIL_PORT:-}
+      - MAIL_USER=${MAIL_USER:-}
+      - MAIL_PASSWORD=${MAIL_PASSWORD:-}
+      - MAIL_DOMAIN=${MAIL_DOMAIN:-}
+      - MAIL_FROM=${MAIL_FROM:-}
+      - MAIL_KEY=${MAIL_KEY:-}
+      # Max upload size in megabytes
+      - UPLOAD_LIMIT=${UPLOAD_LIMIT:-20}
+    volumes:
+      - bonfire-uploads:/opt/app/data/uploads
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:4000"]
+      interval: 30s
+      timeout: 10s
+      retries: 15
+      start_period: 120s
+
+  db:
+    image: postgis/postgis:17-3.5-alpine
+    restart: unless-stopped
+    environment:
+      - POSTGRES_USER=postgres
+      - POSTGRES_DB=bonfire_db
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d bonfire_db"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+
+  search:
+    image: getmeili/meilisearch:v1.11
+    restart: unless-stopped
+    environment:
+      - MEILI_MASTER_KEY=${MEILI_MASTER_KEY}
+      - MEILI_ENV=production
+      - MEILI_NO_ANALYTICS=true
+    volumes:
+      - search-data:/meili_data
+
+volumes:
+  bonfire-uploads:
+  db-data:
+  search-data:

blueprints/bonfire/meta.json

@@ -0,0 +1,17 @@
+{
+  "id": "bonfire",
+  "name": "Bonfire",
+  "version": "1.0.5",
+  "description": "Federated social networking toolkit for communities: customizable digital spaces with ActivityPub federation, flexible boundaries and moderation tools.",
+  "logo": "bonfire.svg",
+  "links": {
+    "github": "https://github.com/bonfire-networks/bonfire-app",
+    "website": "https://bonfirenetworks.org",
+    "docs": "https://docs.bonfirenetworks.org"
+  },
+  "tags": [
+    "social",
+    "fediverse",
+    "activitypub"
+  ]
+}

blueprints/bonfire/template.toml

@@ -0,0 +1,55 @@
+[variables]
+main_domain = "${domain}"
+secret_key_base = "${password:64}"
+signing_salt = "${password:32}"
+encryption_salt = "${password:32}"
+release_cookie = "${password:32}"
+postgres_password = "${password:32}"
+meili_master_key = "${password:32}"
+
+[config]
+[[config.domains]]
+serviceName = "bonfire"
+port = 4000
+host = "${main_domain}"
+
+[config.env]
+# Domain of your Bonfire instance (must match the domain above)
+"BONFIRE_HOSTNAME" = "${main_domain}"
+# Port used to build public URLs: keep 80 while the domain is plain HTTP,
+# and change to 443 once you enable HTTPS on the domain
+# (HTTPS is required for federation with other fediverse instances)
+"PUBLIC_PORT" = "80"
+# Display name of your instance
+"APP_NAME" = "Bonfire"
+# Max upload size in megabytes
+"UPLOAD_LIMIT" = "20"
+
+# Secrets (auto-generated)
+"SECRET_KEY_BASE" = "${secret_key_base}"
+"SIGNING_SALT" = "${signing_salt}"
+"ENCRYPTION_SALT" = "${encryption_salt}"
+"RELEASE_COOKIE" = "${release_cookie}"
+"POSTGRES_PASSWORD" = "${postgres_password}"
+"MEILI_MASTER_KEY" = "${meili_master_key}"
+
+# Optional: set to true only AFTER the first deployment finished its initial
+# database migrations (speeds up index creation during future upgrades)
+# "DB_MIGRATE_INDEXES_CONCURRENTLY" = "true"
+
+# --- Email ---
+# The first account to sign up becomes the instance admin and does not need
+# a confirmation email. Further signups are invite-only by default (the admin
+# can create invite links or open up signups in the instance settings), and
+# require a working mail backend to confirm their email address.
+# Supported backends include smtp, mailgun, brevo, postmark, ses and more:
+# https://docs.bonfirenetworks.org/deploy.html
+# "MAIL_BACKEND" = "smtp"
+# "MAIL_SERVER" = "smtp.example.com"
+# "MAIL_PORT" = "587"
+# "MAIL_USER" = "postmaster@example.com"
+# "MAIL_PASSWORD" = ""
+# "MAIL_DOMAIN" = "example.com"
+# "MAIL_FROM" = "bonfire@example.com"
+# For API-based backends (e.g. mailgun) set the API key instead:
+# "MAIL_KEY" = ""

blueprints/booklore/docker-compose.yml

@@ -8,7 +8,7 @@ services:
     depends_on:
       mariadb:
         condition: service_healthy
-    ports:
+    expose:
       - 6060
     volumes:
       - booklore-data:/app/data

blueprints/booklore/template.toml

@@ -4,6 +4,7 @@ app_password = "${password:32}"
 db_root_password = "${password:32}"
 
 [config]
+mounts = []
 [[config.domains]]
 serviceName = "booklore"
 port = 6060
@@ -20,5 +21,3 @@ MYSQL_USER = "booklore"
 MYSQL_PASSWORD = "${app_password}"
 # API Key
 MYSQL_ROOT_PASSWORD = "${db_root_password}"
-
-[[config.mounts]]

blueprints/bookstack/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   bookstack:
     image: lscr.io/linuxserver/bookstack:24.12.1
     restart: unless-stopped
-    ports:
+    expose:
       - 80
     environment:
       - PUID=1000
@@ -32,4 +32,4 @@ services:
 
 volumes:
   config: {}
-  db_data: {} 
+  db_data: {} 

blueprints/borgitory/template.toml

@@ -2,24 +2,10 @@
 main_domain = "${domain}"
 
 [config]
+mounts = []
 [[config.domains]]
 serviceName = "borgitory"
 port = 8000
 host = "${main_domain}"
 
 [config.env]
-
-[[config.mounts]]
-name = "borgitory-data"
-mountPath = "/app/data"
-description = "Database and encryption key storage"
-
-[[config.mounts]]
-name = "borgitory-sources"
-mountPath = "/mnt/sources"
-description = "Sources to back up (read-only)"
-
-[[config.mounts]]
-name = "borgitory-repos"
-mountPath = "/mnt/repos"
-description = "Borg repositories (read-only)"

blueprints/botpress/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   botpress:
     image: botpress/server:12.31.9
     restart: unless-stopped
-    ports:
+    expose:
       - 81
     environment:
       - BP_HOST=0.0.0.0
@@ -31,4 +31,4 @@ services:
 
 volumes:
   data: {}
-  db_data: {} 
+  db_data: {} 

blueprints/budget-board/docker-compose.yml

@@ -22,7 +22,7 @@ services:
     environment:
       VITE_API_URL: http://budget-board-server
       PORT: 6253
-    ports:
+    expose:
       - 6253
     depends_on:
       - budget-board-server

blueprints/budget-board/template.toml

@@ -3,18 +3,12 @@ main_domain = "${domain}"
 postgres_password = "${password:32}"  
 
 [config]
+mounts = []
 [[config.domains]]
 serviceName = "budget-board-client" 
 port = 6253  
 host = "${main_domain}"  
 path = "/"
 
-
 [config.env]
 POSTGRES_PASSWORD = "${postgres_password}" 
-
-
-[[config.mounts]]
-source = "../files/db-data"  
-target = "/var/lib/postgresql/data"  
-type = "bind"  

blueprints/bytebase/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   bytebase:
     image: bytebase/bytebase:3.3.0
     restart: unless-stopped
-    ports:
+    expose:
       - 8080
     environment:
       - PG_URL=postgres://postgres:${DB_PASSWORD}@bytebase-db:5432/bytebase
@@ -24,4 +24,4 @@ services:
 
 volumes:
   data: {}
-  db_data: {} 
+  db_data: {} 

blueprints/bytestash/docker-compose.yml

@@ -4,7 +4,7 @@ services:
   bytestash:
     image: ghcr.io/jordan-dalby/bytestash:1.5.6
     restart: unless-stopped
-    ports:
+    expose:
       - "5000"
     environment:
       - BASE_PATH=
@@ -24,4 +24,4 @@ services:
       - snippets:/data/snippets
 
 volumes:
-  snippets: 
+  snippets: 

blueprints/calcom/docker-compose.yml

@@ -1,3 +1,8 @@
+# If you are on a machine with ARM architecture, please add a "-arm" suffix to the calcom image on line 19.
+# For example, `calcom/cal.com:v6.2.0` will become `calcom/cal.com:v6.2.0-arm`
+
+# If serving the instance on https, change `NEXT_PUBLIC_WEBAPP_URL` (Line 28) and `NEXTAUTH_URL` (Line 30) to https
+
 services:
   postgres:
     image: postgres:16-alpine
@@ -11,15 +16,25 @@ services:
       - DATABASE_URL=postgres://postgres:password@postgres:5432/db
 
   calcom:
-    image: calcom/cal.com:v2.7.6
+    image: calcom/cal.com:v6.2.0
     depends_on:
       - postgres
     environment:
       - NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
       - CALENDSO_ENCRYPTION_KEY=${CALENDSO_ENCRYPTION_KEY}
       - DATABASE_URL=postgres://postgres:password@postgres:5432/db
+      - DATABASE_DIRECT_URL=postgres://postgres:password@postgres:5432/db
+      - DATABASE_HOST=postgres:5432
       - NEXT_PUBLIC_WEBAPP_URL=http://${CALCOM_HOST}
+      - ALLOWED_HOSTNAMES="${CALCOM_HOST}"
       - NEXTAUTH_URL=http://${CALCOM_HOST}/api/auth
+      - NEXT_PUBLIC_DISABLE_SIGNUP=${DISABLE_SIGNUP}
+      - EMAIL_SERVER_HOST=${SMTP_SERVER}
+      - EMAIL_SERVER_PORT=${SMTP_PORT}
+      - EMAIL_SERVER_USER=${EMAIL_SERVER_USER}
+      - EMAIL_SERVER_PASSWORD=${SMTP_PASSWORD}
+      - EMAIL_FROM=${EMAIL_FROM}
+
 
 volumes:
   calcom-data:

blueprints/calcom/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "calcom",
   "name": "Calcom",
-  "version": "v2.7.6",
+  "version": "v6.2.0",
   "description": "Calcom is a open source alternative to Calendly that allows to create scheduling and booking services.",
   "links": {
     "github": "https://github.com/calcom/cal.com",

blueprints/calcom/template.toml

@@ -8,6 +8,12 @@ env = [
   "CALCOM_HOST=${main_domain}",
   "NEXTAUTH_SECRET=${nextauth_secret}",
   "CALENDSO_ENCRYPTION_KEY=${calcom_encryption_key}",
+  "DISABLE_SIGNUP=true",
+  "SMTP_SERVER=",
+  "SMTP_PORT=",
+  "SMTP_PASSWORD=",
+  "EMAIL_SERVER_USER=",
+  "EMAIL_FROM=",
 ]
 mounts = []
 

blueprints/calibre/docker-compose.yml

@@ -9,7 +9,7 @@ services:
       - TZ=Etc/UTC
       - PUID=1000
       - PGID=1000
-    ports:
+    expose:
       - 8080
     volumes:
       - books:/books
@@ -17,4 +17,4 @@ services:
 
 volumes:
   books:
-  data: 
+  data: 

blueprints/calibre/meta.json

@@ -10,7 +10,7 @@
     "docs": "https://manual.calibre-ebook.com/"
   },
   "tags": [
-    "Documents",
-    "E-Commerce"
+    "documents",
+    "e-commerce"
   ]
 }

blueprints/carbone/docker-compose.yml

@@ -7,10 +7,10 @@ services:
     environment:
       - CARBONE_EE_LICENSE=${CARBONE_KEY}
       - CARBONE_EE_STUDIO=true
-    ports:
+    expose:
       - 4000
     volumes:
       - template:/app/template
 
 volumes:
-  template: 
+  template: 

blueprints/carbone/meta.json

@@ -10,9 +10,9 @@
     "docs": "https://carbone.io/documentation/design/overview/getting-started.html"
   },
   "tags": [
-    "Document Generation",
-    "Automation",
-    "Reporting",
-    "Productivity"
+    "document-generation",
+    "automation",
+    "reporting",
+    "productivity"
   ]
 }

blueprints/casdoor/docker-compose.yml

@@ -30,4 +30,4 @@ services:
 
 volumes:
   casdoor-postgres-data:
-  casdoor-data:
+  casdoor-data:

blueprints/certmate/docker-compose.yml

@@ -0,0 +1,33 @@
+version: "3.8"
+
+services:
+  certmate:
+    image: fabriziosalmi/certmate:2.21.3
+    environment:
+      - FLASK_ENV=production
+      - SECRET_KEY=${SECRET_KEY} # 🔐 Flask session secret
+      - API_BEARER_TOKEN=${API_BEARER_TOKEN} # 🔐 API / web UI token
+      - BEHIND_PROXY=${BEHIND_PROXY}
+      - CLOUDFLARE_TOKEN=${CLOUDFLARE_TOKEN}
+      - LETSENCRYPT_EMAIL=${LETSENCRYPT_EMAIL}
+      - LOG_LEVEL=${LOG_LEVEL}
+    expose:
+      - 8000
+    volumes:
+      - certmate_certificates:/app/certificates
+      - certmate_data:/app/data
+      - certmate_logs:/app/logs
+      - certmate_backups:/app/backups
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+
+volumes:
+  certmate_certificates:
+  certmate_data:
+  certmate_logs:
+  certmate_backups:

blueprints/certmate/instructions.md

@@ -0,0 +1,13 @@
+# CertMate
+
+## Getting started
+
+1. Deploy the template and open the app domain.
+2. Log in with the **API bearer token**: it is auto-generated by the template and stored in the `API_BEARER_TOKEN` environment variable (Dokploy → your service → Environment). The same token authenticates REST API requests (`Authorization: Bearer <token>`).
+3. In **Settings**, set your Let's Encrypt email and add credentials for your DNS provider (Cloudflare, Route53, etc.) to issue certificates through DNS-01 challenges.
+
+## Notes
+
+- `CLOUDFLARE_TOKEN` can optionally be set as an environment variable instead of configuring it in the UI.
+- Certificates, application data and backups are persisted in the `certmate_certificates`, `certmate_data` and `certmate_backups` volumes.
+- API documentation is available at `/docs/` (Swagger) and `/redoc/` on your domain.

blueprints/certmate/meta.json

@@ -0,0 +1,18 @@
+{
+  "id": "certmate",
+  "name": "CertMate",
+  "version": "2.21.3",
+  "description": "CertMate is an SSL certificate management system with a web UI and REST API. It automates issuing and renewing Let's Encrypt certificates via DNS-01 challenges across 20+ DNS providers, with unified backups and multi-account support.",
+  "logo": "logo.png",
+  "links": {
+    "github": "https://github.com/fabriziosalmi/certmate",
+    "website": "https://www.certmate.org/",
+    "docs": "https://www.certmate.org/docs/"
+  },
+  "tags": [
+    "ssl",
+    "certificates",
+    "security",
+    "self-hosted"
+  ]
+}

blueprints/certmate/template.toml

@@ -0,0 +1,20 @@
+[variables]
+main_domain = "${domain}"
+SECRET_KEY = "${password:32}"
+API_BEARER_TOKEN = "${password:32}"
+
+[config]
+mounts = []
+
+[[config.domains]]
+serviceName = "certmate"
+port = 8000
+host = "${main_domain}"
+
+[config.env]
+SECRET_KEY = "${SECRET_KEY}" # 🔐 Flask session secret
+API_BEARER_TOKEN = "${API_BEARER_TOKEN}" # 🔐 API / web UI token
+BEHIND_PROXY = "true"
+CLOUDFLARE_TOKEN = ""
+LETSENCRYPT_EMAIL = ""
+LOG_LEVEL = "INFO"

blueprints/changedetection/docker-compose.yml

@@ -4,10 +4,10 @@ services:
   changedetection:
     image: ghcr.io/dgtlmoon/changedetection.io:0.49
     restart: unless-stopped
-    ports:
+    expose:
       - 5000
     volumes:
       - datastore:/datastore
 
 volumes:
-  datastore: 
+  datastore: 

blueprints/changedetection/meta.json

@@ -10,8 +10,8 @@
     "docs": "https://github.com/dgtlmoon/changedetection.io/wiki"
   },
   "tags": [
-    "Monitoring",
-    "Data",
-    "Notifications"
+    "monitoring",
+    "data",
+    "notifications"
   ]
 }

blueprints/chatto/docker-compose.yml

@@ -2,7 +2,7 @@ version: "3.8"
 
 services:
   chatto:
-    image: ghcr.io/chattocorp/chatto:0.3.8
+    image: ghcr.io/chattocorp/chatto:0.4
     restart: unless-stopped
     expose:
       - "4000"

blueprints/chatto/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "chatto",
   "name": "Chatto (single binary)",
-  "version": "0.3.8",
+  "version": "0.4.x",
   "description": "A fully-featured real-time chat application for teams and communities. This template deploys the single Chatto binary with embedded NATS. Note: email/password registration requires SMTP to be configured after deployment; voice/video calls are not included in the single-binary setup.",
   "logo": "logo.png",
   "links": {

blueprints/chatwoot/docker-compose.yml

@@ -76,4 +76,4 @@ services:
 volumes:
   chatwoot-storage:
   chatwoot-postgres-data:
-  chatwoot-redis-data:
+  chatwoot-redis-data: