feat: validator opt-out marker for intentional host ports + annotate rustdesk

The validate-docker-compose CI on this PR was failing on rustdesk's hbbs/hbbr port mappings (21115-21119) — intentional host-published ports for the RustDesk relay/rendezvous protocol, which Traefik cannot route. Adds a '# dokploy: allow-host-ports' top-of-file marker that downgrades the port-mapping errors to warnings for such protocol templates (mail/game/streaming/VPN/remote-desktop), and annotates rustdesk. Other exception templates (poste.io, mailu, oryx, fivem...) can be annotated case-by-case as the weekly audit (#1049) surfaces them. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Merge remote-tracking branch 'origin/canary' into fix/normalize-empty-mounts
2026-11-10 01:33:12 -06:00 · 2026-08-06 01:22:34 -06:00 · 2026-08-06 01:21:15 -06:00 · 2026-08-03 04:37:04 -06:00 · 2026-08-03 04:36:59 -06:00 · 2026-08-03 04:36:31 -06:00
541 changed files with 6827 additions and 1473 deletions
@@ -0,0 +1,163 @@
+name: Audit All Blueprints
+
+# The per-PR validators only look at blueprints a PR touches, which is the right
+# call for CI cost but means a template is checked when it lands and then never
+# again. When a rule is added or tightened, every existing blueprint that breaks
+# it stays broken with nothing surfacing it (see #1047).
+#
+# This job runs the same validators over ALL blueprints on a schedule, so drift
+# is reported instead of accumulating. It never runs on pull_request, so it
+# cannot block a contributor for a pre-existing problem they did not introduce.
+
+on:
+  schedule:
+    # Mondays, 04:00 UTC
+    - cron: "0 4 * * 1"
+  workflow_dispatch:
+    inputs:
+      fail_on_findings:
+        description: "Exit non-zero when findings exist (default: report only)"
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.16.0
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 8
+
+      - name: Install dependencies
+        run: cd build-scripts && pnpm install
+
+      - name: Validate per-template metadata
+        run: node build-scripts/generate-meta.js --check
+
+      - name: Audit every blueprint
+        id: audit
+        run: |
+          # $RUNNER_TEMP is per-job; also cleared explicitly so a re-run or a
+          # partially-executed earlier step can never leak into the summary.
+          WORK="${RUNNER_TEMP:-/tmp}"
+          OUT="$WORK/validator-out.txt"
+          REPORT="$WORK/audit-report.md"
+          SUMMARY="$WORK/audit-summary.md"
+          rm -f "$OUT" "$REPORT" "$SUMMARY"
+
+          COMPOSE_FAILED=""
+          TOML_FAILED=""
+
+          for dir in blueprints/*/; do
+            id="$(basename "$dir")"
+
+            # Run unconditionally: a blueprint with no docker-compose.yml or no
+            # template.toml is itself a finding, and the validators already
+            # report a missing file clearly. Skipping them would hide exactly
+            # the blueprints most likely to be broken.
+            if ! (cd build-scripts && pnpm exec tsx validate-docker-compose.ts \
+                   --file "../$dir/docker-compose.yml") > "$OUT" 2>&1; then
+              COMPOSE_FAILED="$COMPOSE_FAILED $id"
+              {
+                echo "### \`$id\` — docker-compose.yml"
+                echo '```'
+                grep '❌' "$OUT" || cat "$OUT"
+                echo '```'
+              } >> "$REPORT"
+            fi
+
+            if ! (cd build-scripts && pnpm exec tsx validate-template.ts \
+                   --dir "../$dir") > "$OUT" 2>&1; then
+              TOML_FAILED="$TOML_FAILED $id"
+              {
+                echo "### \`$id\` — template.toml"
+                echo '```'
+                grep '❌' "$OUT" || cat "$OUT"
+                echo '```'
+              } >> "$REPORT"
+            fi
+          done
+
+          COMPOSE_COUNT=$(echo $COMPOSE_FAILED | wc -w | tr -d ' ')
+          TOML_COUNT=$(echo $TOML_FAILED | wc -w | tr -d ' ')
+          TOTAL=$(ls -d blueprints/*/ | wc -l | tr -d ' ')
+
+          {
+            echo "## Blueprint audit"
+            echo ""
+            echo "| check | failing | of |"
+            echo "| --- | --- | --- |"
+            echo "| \`validate-docker-compose.ts\` | $COMPOSE_COUNT | $TOTAL |"
+            echo "| \`validate-template.ts\` | $TOML_COUNT | $TOTAL |"
+            echo ""
+          } > "$SUMMARY"
+
+          if [ -f "$REPORT" ]; then
+            cat "$REPORT" >> "$SUMMARY"
+          else
+            echo "No findings." >> "$SUMMARY"
+          fi
+
+          # The step summary caps at ~1MB and truncates silently past it, which
+          # would hide findings exactly as the backlog grows. Bound what we
+          # append and point at the artifact for the rest.
+          SUMMARY_LIMIT=$((512 * 1024))
+          SUMMARY_BYTES=$(wc -c < "$SUMMARY" | tr -d ' ')
+
+          if [ "$SUMMARY_BYTES" -gt "$SUMMARY_LIMIT" ]; then
+            # Emit the header table only, never a byte-sliced prefix: cutting
+            # mid-``` leaves an unclosed code fence, which swallows the notice
+            # below it and makes the truncation invisible in the rendered summary.
+            {
+              head -n 7 "$SUMMARY"
+              echo ""
+              echo "_Report omitted: $SUMMARY_BYTES bytes exceeds the $SUMMARY_LIMIT byte budget for a job summary._"
+              echo "_Download the \`blueprint-audit\` artifact for the complete output._"
+            } >> "$GITHUB_STEP_SUMMARY"
+          else
+            cat "$SUMMARY" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+          # Always published, so the full report survives regardless of size.
+          cp "$SUMMARY" "$WORK/blueprint-audit.md"
+          echo "report_path=$WORK/blueprint-audit.md" >> "$GITHUB_OUTPUT"
+
+          echo "compose_failed=$COMPOSE_COUNT" >> "$GITHUB_OUTPUT"
+          echo "toml_failed=$TOML_COUNT" >> "$GITHUB_OUTPUT"
+
+          if [ "$COMPOSE_COUNT" != "0" ] || [ "$TOML_COUNT" != "0" ]; then
+            echo "::warning::$COMPOSE_COUNT compose and $TOML_COUNT template.toml findings across $TOTAL blueprints"
+          fi
+
+      - name: Upload the full report
+        if: always() && steps.audit.outputs.report_path != ''
+        uses: actions/upload-artifact@v4
+        with:
+          name: blueprint-audit
+          path: ${{ steps.audit.outputs.report_path }}
+          retention-days: 30
+
+      - name: Fail if requested
+        # `inputs` is only populated for workflow_dispatch; on a schedule run it
+        # is not available, so gate on the event first and read the value through
+        # github.event.inputs, which is an empty string when absent.
+        if: >-
+          github.event_name == 'workflow_dispatch' &&
+          github.event.inputs.fail_on_findings == 'true' &&
+          (steps.audit.outputs.compose_failed != '0' || steps.audit.outputs.toml_failed != '0')
+        run: |
+          echo "❌ Findings present and fail_on_findings was requested."
+          exit 1
@@ -183,7 +183,7 @@ services:
      - 3000:3000

    # Instead use this way:
-    ports:
+    expose:
      - 3000
 ```

@@ -14,6 +14,7 @@ import { Tabs, TabsContent, TabsList, TabsTrigger } from "./ui/tabs";
 import { Label } from "./ui/label";
 import { Clipboard } from "lucide-react";
 import { Input } from "./ui/input";
+import Markdown from "./ui/markdown";

 interface Template {
  id: string;
@@ -32,6 +33,7 @@ interface Template {
 interface TemplateFiles {
  dockerCompose: string | null;
  config: string | null;
+  instructions: string | null;
 }

 interface TemplateDialogProps {
@@ -169,8 +171,23 @@ const TemplateDialog: React.FC<TemplateDialogProps> = ({
                    </div>
                  </div>
                )}
-                <Tabs defaultValue="docker-compose" className="w-full">
+                <Tabs
+                  defaultValue={
+                    templateFiles?.instructions
+                      ? "instructions"
+                      : "docker-compose"
+                  }
+                  className="w-full"
+                >
                  <TabsList className="w-full justify-start">
+                    {templateFiles?.instructions && (
+                      <TabsTrigger
+                        value="instructions"
+                        className="data-[state=active]:font-bold"
+                      >
+                        Instructions
+                      </TabsTrigger>
+                    )}
                    <TabsTrigger
                      value="docker-compose"
                      className="data-[state=active]:font-bold"
@@ -184,6 +201,24 @@ const TemplateDialog: React.FC<TemplateDialogProps> = ({
                      Configuration
                    </TabsTrigger>
                  </TabsList>
+
+                  {templateFiles?.instructions && (
+                    <TabsContent value="instructions" className="mt-4">
+                      <div className="space-y-2">
+                        <Label className="flex flex-col items-start w-fit justify-start gap-1">
+                          <span className="leading-tight text-xl font-semibold">
+                            Setup Instructions
+                          </span>
+                          <span className="leading-tight text-sm text-gray-500">
+                            instructions.md
+                          </span>
+                        </Label>
+                        <div className="rounded-md border p-4">
+                          <Markdown content={templateFiles.instructions} />
+                        </div>
+                      </div>
+                    </TabsContent>
+                  )}
                  <TabsContent value="docker-compose" className="mt-4">
                    {templateFiles?.dockerCompose && (
                      <div className="space-y-2">
@@ -28,6 +28,7 @@ interface Template {
 interface TemplateFiles {
  dockerCompose: string | null;
  config: string | null;
+  instructions: string | null;
 }

 interface TemplateGridProps {
@@ -80,20 +81,34 @@ const TemplateGrid: React.FC<TemplateGridProps> = ({ view }) => {
  const fetchTemplateFiles = async (templateId: string) => {
    setModalLoading(true);
    try {
-      const [dockerComposeRes, configRes] = await Promise.all([
-        fetch(`/blueprints/${templateId}/docker-compose.yml`),
-        fetch(`/blueprints/${templateId}/template.toml`),
-      ]);
+      const [dockerComposeRes, configRes, instructionsRes] = await Promise.all(
+        [
+          fetch(`/blueprints/${templateId}/docker-compose.yml`),
+          fetch(`/blueprints/${templateId}/template.toml`),
+          fetch(`/blueprints/${templateId}/instructions.md`),
+        ]
+      );

      const dockerCompose = dockerComposeRes.ok
        ? await dockerComposeRes.text()
        : null;
      const config = configRes.ok ? await configRes.text() : null;

-      setTemplateFiles({ dockerCompose, config });
+      // Guard against SPA fallbacks that return index.html with a 200 status
+      // for templates that don't have an instructions.md file.
+      const instructionsIsMarkdown =
+        instructionsRes.ok &&
+        !(instructionsRes.headers.get("content-type") || "").includes(
+          "text/html"
+        );
+      const instructions = instructionsIsMarkdown
+        ? await instructionsRes.text()
+        : null;
+
+      setTemplateFiles({ dockerCompose, config, instructions });
    } catch (err) {
      console.error("Error fetching template files:", err);
-      setTemplateFiles({ dockerCompose: null, config: null });
+      setTemplateFiles({ dockerCompose: null, config: null, instructions: null });
    } finally {
      setModalLoading(false);
    }
@@ -0,0 +1,177 @@
+import React from "react";
+
+// Minimal markdown renderer (no external dependencies) for the per-template
+// instructions.md files. Supports headings, paragraphs, fenced code blocks,
+// ordered/unordered lists, and inline code / bold / links.
+
+const INLINE_PATTERN =
+  /(`[^`]+`)|(\*\*[^*]+\*\*)|(\[[^\]]+\]\([^)\s]+\))/g;
+
+const renderInline = (text: string): React.ReactNode[] => {
+  const nodes: React.ReactNode[] = [];
+  let lastIndex = 0;
+  let key = 0;
+  let match: RegExpExecArray | null;
+  INLINE_PATTERN.lastIndex = 0;
+
+  while ((match = INLINE_PATTERN.exec(text)) !== null) {
+    if (match.index > lastIndex) {
+      nodes.push(text.slice(lastIndex, match.index));
+    }
+    const token = match[0];
+    if (token.startsWith("`")) {
+      nodes.push(
+        <code
+          key={key++}
+          className="px-1.5 py-0.5 rounded bg-muted font-mono text-[0.85em]"
+        >
+          {token.slice(1, -1)}
+        </code>
+      );
+    } else if (token.startsWith("**")) {
+      nodes.push(<strong key={key++}>{token.slice(2, -2)}</strong>);
+    } else {
+      const link = /^\[([^\]]+)\]\(([^)\s]+)\)$/.exec(token);
+      if (link) {
+        nodes.push(
+          <a
+            key={key++}
+            href={link[2]}
+            target="_blank"
+            rel="noopener noreferrer"
+            className="text-blue-600 dark:text-blue-400 underline underline-offset-2"
+          >
+            {link[1]}
+          </a>
+        );
+      } else {
+        nodes.push(token);
+      }
+    }
+    lastIndex = match.index + token.length;
+  }
+  if (lastIndex < text.length) {
+    nodes.push(text.slice(lastIndex));
+  }
+  return nodes;
+};
+
+const HEADING_CLASSES: Record<number, string> = {
+  1: "text-2xl font-bold mt-2",
+  2: "text-xl font-semibold mt-6 border-b pb-1",
+  3: "text-lg font-semibold mt-4",
+  4: "text-base font-semibold mt-3",
+};
+
+interface MarkdownProps {
+  content: string;
+}
+
+const Markdown: React.FC<MarkdownProps> = ({ content }) => {
+  const lines = content.replace(/\r\n/g, "\n").split("\n");
+  const blocks: React.ReactNode[] = [];
+  let key = 0;
+  let i = 0;
+
+  while (i < lines.length) {
+    const line = lines[i];
+
+    // Blank line
+    if (line.trim() === "") {
+      i++;
+      continue;
+    }
+
+    // Fenced code block
+    if (line.trim().startsWith("```")) {
+      const code: string[] = [];
+      i++;
+      while (i < lines.length && !lines[i].trim().startsWith("```")) {
+        code.push(lines[i]);
+        i++;
+      }
+      i++; // skip closing fence
+      blocks.push(
+        <pre
+          key={key++}
+          className="bg-muted rounded-md p-4 overflow-x-auto text-sm font-mono whitespace-pre"
+        >
+          <code>{code.join("\n")}</code>
+        </pre>
+      );
+      continue;
+    }
+
+    // Heading
+    const heading = /^(#{1,4})\s+(.*)$/.exec(line);
+    if (heading) {
+      const level = heading[1].length;
+      const Tag = `h${Math.min(level + 1, 6)}` as keyof React.JSX.IntrinsicElements;
+      blocks.push(
+        <Tag key={key++} className={HEADING_CLASSES[level]}>
+          {renderInline(heading[2])}
+        </Tag>
+      );
+      i++;
+      continue;
+    }
+
+    // Unordered list
+    if (/^[-*]\s+/.test(line)) {
+      const items: string[] = [];
+      while (i < lines.length && /^[-*]\s+/.test(lines[i])) {
+        items.push(lines[i].replace(/^[-*]\s+/, ""));
+        i++;
+      }
+      blocks.push(
+        <ul key={key++} className="list-disc pl-6 space-y-1">
+          {items.map((item, idx) => (
+            <li key={idx}>{renderInline(item)}</li>
+          ))}
+        </ul>
+      );
+      continue;
+    }
+
+    // Ordered list
+    if (/^\d+\.\s+/.test(line)) {
+      const items: string[] = [];
+      while (i < lines.length && /^\d+\.\s+/.test(lines[i])) {
+        items.push(lines[i].replace(/^\d+\.\s+/, ""));
+        i++;
+      }
+      blocks.push(
+        <ol key={key++} className="list-decimal pl-6 space-y-1">
+          {items.map((item, idx) => (
+            <li key={idx}>{renderInline(item)}</li>
+          ))}
+        </ol>
+      );
+      continue;
+    }
+
+    // Paragraph: consume consecutive plain lines
+    const paragraph: string[] = [line];
+    i++;
+    while (
+      i < lines.length &&
+      lines[i].trim() !== "" &&
+      !/^(#{1,4})\s+/.test(lines[i]) &&
+      !/^[-*]\s+/.test(lines[i]) &&
+      !/^\d+\.\s+/.test(lines[i]) &&
+      !lines[i].trim().startsWith("```")
+    ) {
+      paragraph.push(lines[i]);
+      i++;
+    }
+    blocks.push(
+      <p key={key++} className="leading-relaxed">
+        {renderInline(paragraph.join(" "))}
+      </p>
+    );
+  }
+
+  return <div className="space-y-3 text-sm">{blocks}</div>;
+};
+
+export default Markdown;
@@ -3,7 +3,7 @@ version: "3"
 services:
  ackee:
    image: electerious/ackee:3.4.2
-    ports:
+    expose:
      - "3000"
    environment:
      - ACKEE_USERNAME=${ACKEE_USERNAME}
@@ -1,4 +0,0 @@
-
-## Instructions
-
-We don't have nothing to show here....
@@ -61,4 +61,4 @@ services:

 volumes:
  postgres_data:
-  redis_data: 
+  redis_data: 
@@ -17,4 +17,4 @@ services:

 volumes:
  adguardhome-work: {}
-  adguardhome-conf: {}
+  adguardhome-conf: {}
@@ -3,5 +3,5 @@ services:
  adminer:
    image: adminer:4.8.1
    restart: unless-stopped
-    ports:
-      - 8080 
+    expose:
+      - 8080 
@@ -7,7 +7,7 @@
  "links": {
    "github": "https://github.com/seanmorley15/adventurelog",
    "website": "https://adventurelog.app/",
-    "docs": "https://adventurelog.app/docs/"
+    "docs": "https://adventurelog.app/docs/intro/adventurelog_overview.html"
  },
  "tags": [
    "activity",
@@ -1,9 +1,9 @@
 version: "3.8"
 services:
  affinepro:
-    image: ghcr.io/toeverything/affine-graphql:stable-780dd83
+    image: ghcr.io/toeverything/affine:stable
    restart: unless-stopped
-    ports:
+    expose:
      - 3010
    volumes:
      - affine-storage:/root/.affine/storage
@@ -12,6 +12,7 @@ services:
      - REDIS_SERVER_HOST=redis
      - REDIS_SERVER_PASSWORD=${REDIS_PASSWORD}
      - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@db:5432/affinepro
+      - AFFINE_INDEXER_ENABLED=false
      - AFFINE_SERVER_HOST=${DOMAIN}
      - MAILER_HOST=${MAILER_HOST}
      - MAILER_PORT=${MAILER_PORT}
@@ -19,16 +20,21 @@ services:
      - MAILER_PASSWORD=${MAILER_PASSWORD}
      - MAILER_SENDER=${MAILER_SENDER}
    depends_on:
-      - db
-      - redis
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      migration:
+        condition: service_completed_successfully

  migration:
-    image: ghcr.io/toeverything/affine-graphql:stable-780dd83
-    command: node ./scripts/self-host-predeploy.js
+    image: ghcr.io/toeverything/affine:stable
+    command: ["sh", "-c", "node ./scripts/self-host-predeploy.js"]
    environment:
      - REDIS_SERVER_HOST=redis
      - REDIS_SERVER_PASSWORD=${REDIS_PASSWORD}
      - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@db:5432/affinepro
+      - AFFINE_INDEXER_ENABLED=false
      - AFFINE_SERVER_HOST=${DOMAIN}
      - MAILER_HOST=${MAILER_HOST}
      - MAILER_PORT=${MAILER_PORT}
@@ -39,17 +45,25 @@ services:
      - affine-storage:/root/.affine/storage
      - affine-config:/root/.affine/config
    depends_on:
-      - db
-      - redis
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_healthy

  db:
-    image: postgres:15-alpine
+    image: pgvector/pgvector:pg16
    restart: unless-stopped
    environment:
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=affinepro
+      - POSTGRES_INITDB_ARGS=--data-checksums
    volumes:
      - postgres-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD", "pg_isready", "-U", "postgres", "-d", "affinepro"]
+      interval: 10s
+      timeout: 5s
+      retries: 5

  redis:
    image: redis:7-alpine
@@ -57,9 +71,14 @@ services:
    command: redis-server --requirepass ${REDIS_PASSWORD}
    volumes:
      - redis-data:/data
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli -a '${REDIS_PASSWORD}' ping | grep PONG"]
+      interval: 10s
+      timeout: 5s
+      retries: 5

 volumes:
  affine-storage: {}
  affine-config: {}
  postgres-data: {}
-  redis-data: {} 
+  redis-data: {}
@@ -1,13 +1,13 @@
 {
  "id": "affinepro",
  "name": "Affine Pro",
-  "version": "stable-780dd83",
+  "version": "stable",
  "description": "Affine Pro is a modern, self-hosted platform designed for collaborative content creation and project management. It offers an intuitive interface, seamless real-time collaboration, and powerful tools for organizing tasks, notes, and ideas.",
  "logo": "logo.png",
  "links": {
    "github": "https://github.com/toeverything/Affine",
    "website": "https://affine.pro/",
-    "docs": "https://affine.pro/docs"
+    "docs": "https://docs.affine.pro/"
  },
  "tags": [
    "collaboration",
@@ -11,4 +11,4 @@ services:
    volumes:
      - agent-zero-data:/a0/usr
 volumes:
-  agent-zero-data:
+  agent-zero-data:
@@ -11,12 +11,11 @@ services:
      - agentdvr-config:/AgentDVR/Media/XML/
      - agentdvr-media:/AgentDVR/Media/WebServerRoot/Media/
      - agentdvr-commands:/AgentDVR/Commands/
-    ports:
+    expose:
      - 8090
      - 3478/udp
      - 50000-50100/udp
-
 volumes:
  agentdvr-config: {}
  agentdvr-media: {}
-  agentdvr-commands: {}
+  agentdvr-commands: {}
@@ -3,6 +3,7 @@ main_domain = "${domain}"
 timezone = "America/New_York"

 [config]
+mounts = []
 [[config.domains]]
 serviceName = "agentdvr"
 port = 8090
@@ -10,5 +11,3 @@ host = "${main_domain}"

 [config.env]
 TIMEZONE = "${timezone}"
-
-[[config.mounts]]
@@ -24,6 +24,7 @@ port = 80
 host = "${main_domain}"

 [config]
+mounts = []
 env = [
  # App
  "APP_URL=${main_domain}",
@@ -50,5 +51,4 @@ env = [
  "MYSQL_RANDOM_ROOT_PASSWORD=yes"
 ]

-# No custom mounts needed; volumes are already defined in compose.
-[[config.mounts]]
+# No custom mounts needed; volumes are already defined in compose.
@@ -11,4 +11,4 @@ services:
    restart: unless-stopped

 volumes:
-  alist-data:
+  alist-data:
@@ -3,10 +3,10 @@ services:
  alltube:
    image: dnomd343/alltube:latest
    restart: unless-stopped
-    ports:
+    expose:
      - 80
    environment:
      - TITLE=${TITLE}
      - CONVERT=${CONVERT}
      - STREAM=${STREAM}
-      - REMUX=${REMUX} 
+      - REMUX=${REMUX} 
@@ -3,7 +3,7 @@ services:
  ampache:
    image: ampache/ampache:latest
    restart: unless-stopped
-    ports:
+    expose:
      - 80
    volumes:
      - config:/var/www/config
@@ -14,4 +14,4 @@ services:
 volumes:
  config: {}
  log: {}
-  mysql: {} 
+  mysql: {} 
@@ -3,7 +3,7 @@ services:
  anonupload:
    image: ghcr.io/supernova3339/anonfiles:1
    restart: unless-stopped
-    ports:
+    expose:
      - 80
    environment:
      - ADMIN_EMAIL=${ADMIN_EMAIL}
@@ -13,4 +13,4 @@ services:
      - uploads:/var/www/html/uploads

 volumes:
-  uploads: {} 
+  uploads: {} 
@@ -1,7 +1,7 @@
 services:
  answer:
    image: apache/answer:1.4.1
-    ports:
+    expose:
      - '80'
    restart: on-failure
    volumes:
@@ -10,7 +10,7 @@
    "docs": "https://answer.apache.org/docs"
  },
  "tags": [
-    "q&a",
+    "q-and-a",
    "self-hosted"
  ]
 }
@@ -3,7 +3,7 @@ services:
  anubis:
    image: ghcr.io/techarohq/anubis:latest
    restart: unless-stopped
-    ports:
+    expose:
      - "8923" # Anubis default port
    environment:
      # Required: Point to your frontend service locally
@@ -3,7 +3,7 @@ services:
  anythingllm:
    image: mintplexlabs/anythingllm:latest
    restart: unless-stopped
-    ports:
+    expose:
      - 3001
    environment:
      - STORAGE_DIR=/app/server/storage
@@ -13,4 +13,4 @@ services:
      - SYS_ADMIN

 volumes:
-  storage: {} 
+  storage: {} 
@@ -6,8 +6,8 @@
  "logo": "logo.png",
  "links": {
    "github": "https://github.com/Mintplex-Labs/anything-llm",
-    "website": "https://useanything.com",
-    "docs": "https://github.com/Mintplex-Labs/anything-llm/tree/master/docs"
+    "website": "https://anythingllm.com/",
+    "docs": "https://docs.anythingllm.com/"
  },
  "tags": [
    "ai",
@@ -13,7 +13,7 @@ services:
      - "33010:33010"
      - "33020:33020/udp"
    volumes:
-      - ./data:/data
+      - ../files/anytype-data:/data
    environment:
      # Advertise addresses clients should use. Replace with your server hostname/IP.
      ANY_SYNC_BUNDLE_INIT_EXTERNAL_ADDRS: "192.168.100.9"
@@ -3,7 +3,7 @@ services:
  apprise-api:
    image: linuxserver/apprise-api:latest
    restart: unless-stopped
-    ports:
+    expose:
      - 8000
    environment:
      - PUID=1000
@@ -13,4 +13,4 @@ services:
      - config:/config

 volumes:
-  config: {} 
+  config: {} 
@@ -7,4 +7,4 @@ services:
    restart: unless-stopped

 volumes:
-  appsmith-data:
+  appsmith-data:
@@ -3,7 +3,7 @@ services:
  arangodb:
    image: arangodb:3.12.4
    restart: unless-stopped
-    ports:
+    expose:
      - 8529
    environment:
      - ARANGO_ROOT_PASSWORD=${ARANGO_PASSWORD}
@@ -11,4 +11,4 @@ services:
      - data:/var/lib/arangodb3

 volumes:
-  data: {} 
+  data: {} 
@@ -9,8 +9,7 @@ services:
      PUBLIC_SNAPSHOTS: ${PUBLIC_SNAPSHOTS}
    volumes:
      - archivebox_data:/data
-    ports:
+    expose:
      - "8000"
-
 volumes:
  archivebox_data:
@@ -3,7 +3,7 @@ services:
  argilla-web:
    image: argilla/argilla-server:latest
    restart: unless-stopped
-    ports:
+    expose:
      - 6900
    environment:
      - ARGILLA_HOME_PATH=/var/lib/argilla
@@ -74,4 +74,4 @@ volumes:
  argilladata: {}
  elasticdata: {}
  dbdata: {}
-  redisdata: {} 
+  redisdata: {} 
@@ -3,7 +3,7 @@ services:
  audiobookshelf:
    image: ghcr.io/advplyr/audiobookshelf:2.19.4
    restart: unless-stopped
-    ports:
+    expose:
      - 80
    environment:
      - TZ=UTC
@@ -14,4 +14,4 @@ services:

 volumes:
  config: {}
-  metadata: {} 
+  metadata: {} 
@@ -16,9 +16,8 @@ services:
        condition: service_healthy
      postgres:
        condition: service_healthy
-    ports:
+    expose:
      - 9091
-
  redis:
    image: redis:7-alpine
    restart: unless-stopped
@@ -52,4 +51,4 @@ services:
 volumes:
  authelia_config:
  redis_data:
-  postgres_data:
+  postgres_data:
@@ -3,7 +3,7 @@ services:
  authorizer:
    image: lakhansamani/authorizer:1.4.4
    restart: unless-stopped
-    ports:
+    expose:
      - 8080
    environment:
      - DATABASE_TYPE=postgres
@@ -37,4 +37,4 @@ services:

 volumes:
  db_data: {}
-  redis_data: {} 
+  redis_data: {} 
@@ -2,7 +2,7 @@ services:
  autobase-console:
    image: autobase/console:2.7.2
    restart: unless-stopped
-    ports:
+    expose:
      - "80"
      - "8080"
    environment:
@@ -1,17 +1,15 @@
-version: "3.8"
 services:
  automatisch:
-    image: dockeriddonuts/automatisch:2.0
+    image: automatischio/automatisch:0.15.0
    restart: unless-stopped
-    ports:
-      - 3000
    environment:
      - HOST=${DOMAIN}
      - PROTOCOL=http
      - PORT=3000
+      - API_URL=http://${DOMAIN}
+      - WEB_APP_URL=http://${DOMAIN}
      - APP_ENV=production
      - REDIS_HOST=automatisch-redis
-      - REDIS_USERNAME=default
      - REDIS_PASSWORD=${REDIS_PASSWORD}
      - POSTGRES_HOST=automatisch-postgres
      - POSTGRES_DATABASE=automatisch
@@ -23,11 +21,13 @@ services:
    volumes:
      - storage:/automatisch/storage
    depends_on:
-      - automatisch-postgres
-      - automatisch-redis
+      automatisch-postgres:
+        condition: service_healthy
+      automatisch-redis:
+        condition: service_started

  automatisch-worker:
-    image: dockeriddonuts/automatisch:2.0
+    image: automatischio/automatisch:0.15.0
    restart: unless-stopped
    environment:
      - APP_ENV=production
@@ -44,8 +44,7 @@ services:
    volumes:
      - storage:/automatisch/storage
    depends_on:
-      - automatisch-postgres
-      - automatisch-redis
+      - automatisch

  automatisch-postgres:
    image: postgres:15-alpine
@@ -56,18 +55,20 @@ services:
      - POSTGRES_DB=automatisch
    volumes:
      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d automatisch"]
+      interval: 10s
+      timeout: 5s
+      retries: 5

  automatisch-redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: redis-server --requirepass ${REDIS_PASSWORD}
-    environment:
-      - REDIS_USERNAME=default
-      - REDIS_PASSWORD=${REDIS_PASSWORD}
    volumes:
      - redis_data:/data

 volumes:
  storage: {}
  postgres_data: {}
-  redis_data: {} 
+  redis_data: {}
@@ -1,7 +1,7 @@
 {
  "id": "automatisch",
  "name": "Automatisch",
-  "version": "2.0",
+  "version": "0.15.0",
  "description": "Automatisch is a powerful, self-hosted workflow automation tool designed for connecting your apps and automating repetitive tasks. With Automatisch, you can create workflows to sync data, send notifications, and perform various actions seamlessly across different services.",
  "logo": "logo.png",
  "links": {
@@ -13,6 +13,7 @@ port = 3000
 host = "${main_domain}"

 [config.env]
+DOMAIN = "${main_domain}"
 DB_PASSWORD = "${db_password}"
 REDIS_PASSWORD = "${redis_password}"
 ENCRYPTION_KEY = "${encryption_key}"
@@ -2,7 +2,7 @@ services:
  azuracast:
    image: ghcr.io/azuracast/azuracast:latest
    restart: unless-stopped
-    ports:
+    expose:
      - 80
    volumes:
      - azuracast-station-data:/var/azuracast/stations
@@ -36,4 +36,4 @@ volumes:
  azuracast-data: {}
  azuracast-uploads: {}
  azuracast-backups: {}
-  mariadb-data: {}
+  mariadb-data: {}
@@ -4,6 +4,7 @@ mysql_root_password = "${password:32}"
 mysql_password = "${password:16}"

 [config]
+mounts = []
 [[config.domains]]
 serviceName = "azuracast"
 port = 80
@@ -27,5 +28,3 @@ NGINX_RADIO_PORTS = "8000,8010,8020,8030,8040,8050"
 PREFER_RELEASE_BUILDS = "true"
 COMPOSER_PLUGIN_MODE = "false"
 ADDITIONAL_MEDIA_SYNC_WORKER_COUNT = "0"
-
-[[config.mounts]]
@@ -3,7 +3,7 @@ services:
  babybuddy:
    image: linuxserver/babybuddy:2.7.0
    restart: unless-stopped
-    ports:
+    expose:
      - 8000
    environment:
      - PUID=1000
@@ -16,4 +16,4 @@ services:
      - config:/config

 volumes:
-  config: {} 
+  config: {} 
@@ -7,7 +7,7 @@
  "links": {
    "github": "https://github.com/babybuddy/babybuddy",
    "website": "https://babybuddy.app",
-    "docs": "https://docs.babybuddy.app"
+    "docs": "https://docs.baby-buddy.net/"
  },
  "tags": [
    "parenting",
@@ -2,7 +2,7 @@ services:
  backrest:
    image: garethgeorge/backrest:v1.7.3
    restart: unless-stopped
-    ports:
+    expose:
      - 9898
    environment:
      - BACKREST_PORT=9898
@@ -3,7 +3,7 @@ services:
  baikal:
    image: ckulka/baikal:nginx-php8.2
    restart: unless-stopped
-    ports:
+    expose:
      - 80
    environment:
      - TZ=UTC
@@ -13,4 +13,4 @@ services:

 volumes:
  config: {}
-  data: {} 
+  data: {} 
@@ -3,11 +3,11 @@ services:
  barrage:
    image: maulik9898/barrage:0.3.0
    restart: unless-stopped
-    ports:
+    expose:
      - 3000
    environment:
      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
      - NEXTAUTH_URL=http://${DOMAIN}
      - DELUGE_URL=${DELUGE_URL}
      - DELUGE_PASSWORD=${DELUGE_PASSWORD}
-      - BARRAGE_PASSWORD=${BARRAGE_PASSWORD} 
+      - BARRAGE_PASSWORD=${BARRAGE_PASSWORD} 
@@ -3,7 +3,7 @@ services:
  bazarr:
    image: lscr.io/linuxserver/bazarr:1.5.1
    restart: unless-stopped
-    ports:
+    expose:
      - 6767
    environment:
      - PUID=1000
@@ -15,4 +15,4 @@ services:
      - ${TV_PATH}:/tv

 volumes:
-  config: {} 
+  config: {} 
@@ -7,7 +7,7 @@
  "links": {
    "github": "https://github.com/morpheus65535/bazarr",
    "website": "https://www.bazarr.media/",
-    "docs": "https://www.bazarr.media/docs"
+    "docs": "https://wiki.bazarr.media/"
  },
  "tags": [
    "subtitles",
@@ -5,9 +5,9 @@
  "description": "BentoPDF is a lightweight PDF conversion microservice that exposes a simple HTTP API for generating PDFs.",
  "logo": "image.png",
  "links": {
-    "github": "https://github.com/bentopdf/bentopdf",
+    "github": "https://github.com/alam00000/bentopdf/",
    "website": "https://bentopdf.com/",
-    "docs": "https://github.com/bentopdf/bentopdf#readme"
+    "docs": "https://www.bentopdf.com/docs/"
  },
  "tags": [
    "pdf",
@@ -3,11 +3,11 @@ services:
  beszel:
    image: henrygd/beszel:0.10.2
    restart: unless-stopped
-    ports:
+    expose:
      - 8090
    volumes:
      - beszel_data:/beszel_data
      - /var/run/docker.sock:/var/run/docker.sock:ro

 volumes:
-  beszel_data: {} 
+  beszel_data: {} 
@@ -4,10 +4,8 @@ services:
    restart: unless-stopped
    depends_on:
      - server
-    ports:
+    expose:
      - '80'
-
-
  server:
    image: bigcapitalhq/server:latest
    restart: unless-stopped
@@ -18,9 +16,8 @@ services:
        condition: service_started
      redis:
        condition: service_started
-    ports:
+    expose:
      - '3000'
-
    environment:
      # Mail
      - MAIL_HOST=${MAIL_HOST}
@@ -97,9 +94,8 @@ services:
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
    volumes:
      - mysql:/var/lib/mysql
-    ports:
+    expose:
      - '3306'
-
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping -h localhost -u root -p$$MYSQL_ROOT_PASSWORD || exit 1"]
      interval: 10s
@@ -110,7 +106,7 @@ services:
  mongo:
    image: mongo:7
    restart: unless-stopped
-    ports:
+    expose:
      - '27017'
    volumes:
      - mongo:/data/db
@@ -119,7 +115,7 @@ services:
  redis:
    image: redis:7-alpine
    restart: unless-stopped
-    ports:
+    expose:
      - '6379'
    volumes:
      - redis:/data
@@ -133,10 +129,8 @@ services:
  gotenberg:
    image: gotenberg/gotenberg:7
    restart: unless-stopped
-    ports:
+    expose:
      - '9000'
-
-
 volumes:
  mysql:
    name: bigcapital_mysql
@@ -72,7 +72,7 @@ s3_endpoint = ""
 s3_bucket = ""

 [config]
-
+mounts = []
 [[config.domains]]
 serviceName = "webapp"
 port = 80
@@ -165,6 +165,3 @@ MYSQL_DATABASE = "${system_db_name}"
 MYSQL_USER = "${db_user}"
 MYSQL_PASSWORD = "${db_password}"
 MYSQL_ROOT_PASSWORD = "${db_root_password}"
-
-[[config.mounts]]
-
@@ -28,6 +28,9 @@ services:
      - AUTORUN_LARAVEL_STORAGE_LINK=true
    volumes:
      - billmora-storage:/var/www/html/storage
+      - billmora-plugins:/var/www/html/plugin
+      - billmora-themes-resources:/var/www/html/resources/themes
+      - billmora-themes-public:/var/www/html/public/themes
    depends_on:
      billmora-db:
        condition: service_healthy
@@ -58,6 +61,9 @@ services:
      - AUTORUN_ENABLED=false
    volumes:
      - billmora-storage:/var/www/html/storage
+      - billmora-plugins:/var/www/html/plugin
+      - billmora-themes-resources:/var/www/html/resources/themes
+      - billmora-themes-public:/var/www/html/public/themes
    depends_on:
      billmora-db:
        condition: service_healthy
@@ -88,6 +94,9 @@ services:
      - AUTORUN_ENABLED=false
    volumes:
      - billmora-storage:/var/www/html/storage
+      - billmora-plugins:/var/www/html/plugin
+      - billmora-themes-resources:/var/www/html/resources/themes
+      - billmora-themes-public:/var/www/html/public/themes
    depends_on:
      billmora-db:
        condition: service_healthy
@@ -126,5 +135,8 @@ services:

 volumes:
  billmora-storage:
+  billmora-plugins:
+  billmora-themes-resources:
+  billmora-themes-public:
  billmora-db-data:
  billmora-redis-data:
@@ -19,7 +19,7 @@ services:
      - PGID=1000
      - TZ=Etc/UTC
      - SUBFOLDER=/ #optional
-    ports:
+    expose:
      - 3000
      - 3001
    restart: unless-stopped
@@ -16,9 +16,8 @@ services:
      options:
        max-size: "10m"
        max-file: "3"
-    ports:
+    expose:
      - 1111
-
  blinko-postgres:
    image: postgres:14
    restart: always
@@ -45,4 +45,4 @@ services:
      timeout: 10s
      retries: 10
 volumes: 
-  pds-data:
+  pds-data:
@@ -0,0 +1,84 @@
+version: "3.8"
+services:
+  bonfire:
+    image: bonfirenetworks/bonfire:1.0.5-social-amd64
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+      search:
+        condition: service_started
+    environment:
+      # Instance
+      - HOSTNAME=${BONFIRE_HOSTNAME}
+      - PUBLIC_PORT=${PUBLIC_PORT:-80}
+      - SERVER_PORT=4000
+      - APP_NAME=${APP_NAME:-Bonfire}
+      - LANG=en_US.UTF-8
+      # Secrets
+      - SECRET_KEY_BASE=${SECRET_KEY_BASE}
+      - SIGNING_SALT=${SIGNING_SALT}
+      - ENCRYPTION_SALT=${ENCRYPTION_SALT}
+      - RELEASE_COOKIE=${RELEASE_COOKIE}
+      # Database (migrations run automatically on startup)
+      - POSTGRES_HOST=db
+      - POSTGRES_USER=postgres
+      - POSTGRES_DB=bonfire_db
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      # Must stay false for the initial migrations; can be set to true
+      # after the first deployment to speed up future upgrades
+      - DB_MIGRATE_INDEXES_CONCURRENTLY=${DB_MIGRATE_INDEXES_CONCURRENTLY:-false}
+      # Search (Meilisearch)
+      - SEARCH_ADAPTER=meili
+      - SEARCH_MEILI_INSTANCE=http://search:7700
+      - MEILI_MASTER_KEY=${MEILI_MASTER_KEY}
+      # Email (the first account to sign up becomes admin and needs no
+      # confirmation email; configure a mail backend for further signups)
+      - MAIL_BACKEND=${MAIL_BACKEND:-none}
+      - MAIL_SERVER=${MAIL_SERVER:-}
+      - MAIL_PORT=${MAIL_PORT:-}
+      - MAIL_USER=${MAIL_USER:-}
+      - MAIL_PASSWORD=${MAIL_PASSWORD:-}
+      - MAIL_DOMAIN=${MAIL_DOMAIN:-}
+      - MAIL_FROM=${MAIL_FROM:-}
+      - MAIL_KEY=${MAIL_KEY:-}
+      # Max upload size in megabytes
+      - UPLOAD_LIMIT=${UPLOAD_LIMIT:-20}
+    volumes:
+      - bonfire-uploads:/opt/app/data/uploads
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:4000"]
+      interval: 30s
+      timeout: 10s
+      retries: 15
+      start_period: 120s
+
+  db:
+    image: postgis/postgis:17-3.5-alpine
+    restart: unless-stopped
+    environment:
+      - POSTGRES_USER=postgres
+      - POSTGRES_DB=bonfire_db
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d bonfire_db"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+
+  search:
+    image: getmeili/meilisearch:v1.11
+    restart: unless-stopped
+    environment:
+      - MEILI_MASTER_KEY=${MEILI_MASTER_KEY}
+      - MEILI_ENV=production
+      - MEILI_NO_ANALYTICS=true
+    volumes:
+      - search-data:/meili_data
+
+volumes:
+  bonfire-uploads:
+  db-data:
+  search-data:
@@ -0,0 +1,17 @@
+{
+  "id": "bonfire",
+  "name": "Bonfire",
+  "version": "1.0.5",
+  "description": "Federated social networking toolkit for communities: customizable digital spaces with ActivityPub federation, flexible boundaries and moderation tools.",
+  "logo": "bonfire.svg",
+  "links": {
+    "github": "https://github.com/bonfire-networks/bonfire-app",
+    "website": "https://bonfirenetworks.org",
+    "docs": "https://docs.bonfirenetworks.org"
+  },
+  "tags": [
+    "social",
+    "fediverse",
+    "activitypub"
+  ]
+}
@@ -0,0 +1,55 @@
+[variables]
+main_domain = "${domain}"
+secret_key_base = "${password:64}"
+signing_salt = "${password:32}"
+encryption_salt = "${password:32}"
+release_cookie = "${password:32}"
+postgres_password = "${password:32}"
+meili_master_key = "${password:32}"
+
+[config]
+[[config.domains]]
+serviceName = "bonfire"
+port = 4000
+host = "${main_domain}"
+
+[config.env]
+# Domain of your Bonfire instance (must match the domain above)
+"BONFIRE_HOSTNAME" = "${main_domain}"
+# Port used to build public URLs: keep 80 while the domain is plain HTTP,
+# and change to 443 once you enable HTTPS on the domain
+# (HTTPS is required for federation with other fediverse instances)
+"PUBLIC_PORT" = "80"
+# Display name of your instance
+"APP_NAME" = "Bonfire"
+# Max upload size in megabytes
+"UPLOAD_LIMIT" = "20"
+
+# Secrets (auto-generated)
+"SECRET_KEY_BASE" = "${secret_key_base}"
+"SIGNING_SALT" = "${signing_salt}"
+"ENCRYPTION_SALT" = "${encryption_salt}"
+"RELEASE_COOKIE" = "${release_cookie}"
+"POSTGRES_PASSWORD" = "${postgres_password}"
+"MEILI_MASTER_KEY" = "${meili_master_key}"
+
+# Optional: set to true only AFTER the first deployment finished its initial
+# database migrations (speeds up index creation during future upgrades)
+# "DB_MIGRATE_INDEXES_CONCURRENTLY" = "true"
+
+# --- Email ---
+# The first account to sign up becomes the instance admin and does not need
+# a confirmation email. Further signups are invite-only by default (the admin
+# can create invite links or open up signups in the instance settings), and
+# require a working mail backend to confirm their email address.
+# Supported backends include smtp, mailgun, brevo, postmark, ses and more:
+# https://docs.bonfirenetworks.org/deploy.html
+# "MAIL_BACKEND" = "smtp"
+# "MAIL_SERVER" = "smtp.example.com"
+# "MAIL_PORT" = "587"
+# "MAIL_USER" = "postmaster@example.com"
+# "MAIL_PASSWORD" = ""
+# "MAIL_DOMAIN" = "example.com"
+# "MAIL_FROM" = "bonfire@example.com"
+# For API-based backends (e.g. mailgun) set the API key instead:
+# "MAIL_KEY" = ""
@@ -8,7 +8,7 @@ services:
    depends_on:
      mariadb:
        condition: service_healthy
-    ports:
+    expose:
      - 6060
    volumes:
      - booklore-data:/app/data
@@ -4,6 +4,7 @@ app_password = "${password:32}"
 db_root_password = "${password:32}"

 [config]
+mounts = []
 [[config.domains]]
 serviceName = "booklore"
 port = 6060
@@ -20,5 +21,3 @@ MYSQL_USER = "booklore"
 MYSQL_PASSWORD = "${app_password}"
 # API Key
 MYSQL_ROOT_PASSWORD = "${db_root_password}"
-
-[[config.mounts]]
@@ -3,7 +3,7 @@ services:
  bookstack:
    image: lscr.io/linuxserver/bookstack:24.12.1
    restart: unless-stopped
-    ports:
+    expose:
      - 80
    environment:
      - PUID=1000
@@ -32,4 +32,4 @@ services:

 volumes:
  config: {}
-  db_data: {} 
+  db_data: {} 
@@ -2,24 +2,10 @@
 main_domain = "${domain}"

 [config]
+mounts = []
 [[config.domains]]
 serviceName = "borgitory"
 port = 8000
 host = "${main_domain}"

 [config.env]
-
-[[config.mounts]]
-name = "borgitory-data"
-mountPath = "/app/data"
-description = "Database and encryption key storage"
-
-[[config.mounts]]
-name = "borgitory-sources"
-mountPath = "/mnt/sources"
-description = "Sources to back up (read-only)"
-
-[[config.mounts]]
-name = "borgitory-repos"
-mountPath = "/mnt/repos"
-description = "Borg repositories (read-only)"
@@ -3,7 +3,7 @@ services:
  botpress:
    image: botpress/server:12.31.9
    restart: unless-stopped
-    ports:
+    expose:
      - 81
    environment:
      - BP_HOST=0.0.0.0
@@ -31,4 +31,4 @@ services:

 volumes:
  data: {}
-  db_data: {} 
+  db_data: {} 
@@ -22,7 +22,7 @@ services:
    environment:
      VITE_API_URL: http://budget-board-server
      PORT: 6253
-    ports:
+    expose:
      - 6253
    depends_on:
      - budget-board-server
@@ -3,18 +3,12 @@ main_domain = "${domain}"
 postgres_password = "${password:32}"  

 [config]
+mounts = []
 [[config.domains]]
 serviceName = "budget-board-client" 
 port = 6253  
 host = "${main_domain}"  
 path = "/"

-
 [config.env]
 POSTGRES_PASSWORD = "${postgres_password}" 
-
-
-[[config.mounts]]
-source = "../files/db-data"  
-target = "/var/lib/postgresql/data"  
-type = "bind"  
@@ -3,7 +3,7 @@ services:
  bytebase:
    image: bytebase/bytebase:3.3.0
    restart: unless-stopped
-    ports:
+    expose:
      - 8080
    environment:
      - PG_URL=postgres://postgres:${DB_PASSWORD}@bytebase-db:5432/bytebase
@@ -24,4 +24,4 @@ services:

 volumes:
  data: {}
-  db_data: {} 
+  db_data: {} 
@@ -4,7 +4,7 @@ services:
  bytestash:
    image: ghcr.io/jordan-dalby/bytestash:1.5.6
    restart: unless-stopped
-    ports:
+    expose:
      - "5000"
    environment:
      - BASE_PATH=
@@ -24,4 +24,4 @@ services:
      - snippets:/data/snippets

 volumes:
-  snippets: 
+  snippets: 
@@ -9,7 +9,7 @@ services:
      - TZ=Etc/UTC
      - PUID=1000
      - PGID=1000
-    ports:
+    expose:
      - 8080
    volumes:
      - books:/books
@@ -17,4 +17,4 @@ services:

 volumes:
  books:
-  data: 
+  data: 
@@ -10,7 +10,7 @@
    "docs": "https://manual.calibre-ebook.com/"
  },
  "tags": [
-    "Documents",
-    "E-Commerce"
+    "documents",
+    "e-commerce"
  ]
 }
@@ -7,10 +7,10 @@ services:
    environment:
      - CARBONE_EE_LICENSE=${CARBONE_KEY}
      - CARBONE_EE_STUDIO=true
-    ports:
+    expose:
      - 4000
    volumes:
      - template:/app/template

 volumes:
-  template: 
+  template: 
@@ -10,9 +10,9 @@
    "docs": "https://carbone.io/documentation/design/overview/getting-started.html"
  },
  "tags": [
-    "Document Generation",
-    "Automation",
-    "Reporting",
-    "Productivity"
+    "document-generation",
+    "automation",
+    "reporting",
+    "productivity"
  ]
 }
@@ -30,4 +30,4 @@ services:

 volumes:
  casdoor-postgres-data:
-  casdoor-data:
+  casdoor-data:
@@ -0,0 +1,33 @@
+version: "3.8"
+
+services:
+  certmate:
+    image: fabriziosalmi/certmate:2.21.3
+    environment:
+      - FLASK_ENV=production
+      - SECRET_KEY=${SECRET_KEY} # 🔐 Flask session secret
+      - API_BEARER_TOKEN=${API_BEARER_TOKEN} # 🔐 API / web UI token
+      - BEHIND_PROXY=${BEHIND_PROXY}
+      - CLOUDFLARE_TOKEN=${CLOUDFLARE_TOKEN}
+      - LETSENCRYPT_EMAIL=${LETSENCRYPT_EMAIL}
+      - LOG_LEVEL=${LOG_LEVEL}
+    expose:
+      - 8000
+    volumes:
+      - certmate_certificates:/app/certificates
+      - certmate_data:/app/data
+      - certmate_logs:/app/logs
+      - certmate_backups:/app/backups
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+
+volumes:
+  certmate_certificates:
+  certmate_data:
+  certmate_logs:
+  certmate_backups:
@@ -0,0 +1,13 @@
+# CertMate
+
+## Getting started
+
+1. Deploy the template and open the app domain.
+2. Log in with the **API bearer token**: it is auto-generated by the template and stored in the `API_BEARER_TOKEN` environment variable (Dokploy → your service → Environment). The same token authenticates REST API requests (`Authorization: Bearer <token>`).
+3. In **Settings**, set your Let's Encrypt email and add credentials for your DNS provider (Cloudflare, Route53, etc.) to issue certificates through DNS-01 challenges.
+
+## Notes
+
+- `CLOUDFLARE_TOKEN` can optionally be set as an environment variable instead of configuring it in the UI.
+- Certificates, application data and backups are persisted in the `certmate_certificates`, `certmate_data` and `certmate_backups` volumes.
+- API documentation is available at `/docs/` (Swagger) and `/redoc/` on your domain.
@@ -0,0 +1,18 @@
+{
+  "id": "certmate",
+  "name": "CertMate",
+  "version": "2.21.3",
+  "description": "CertMate is an SSL certificate management system with a web UI and REST API. It automates issuing and renewing Let's Encrypt certificates via DNS-01 challenges across 20+ DNS providers, with unified backups and multi-account support.",
+  "logo": "logo.png",
+  "links": {
+    "github": "https://github.com/fabriziosalmi/certmate",
+    "website": "https://www.certmate.org/",
+    "docs": "https://www.certmate.org/docs/"
+  },
+  "tags": [
+    "ssl",
+    "certificates",
+    "security",
+    "self-hosted"
+  ]
+}
@@ -0,0 +1,20 @@
+[variables]
+main_domain = "${domain}"
+SECRET_KEY = "${password:32}"
+API_BEARER_TOKEN = "${password:32}"
+
+[config]
+mounts = []
+
+[[config.domains]]
+serviceName = "certmate"
+port = 8000
+host = "${main_domain}"
+
+[config.env]
+SECRET_KEY = "${SECRET_KEY}" # 🔐 Flask session secret
+API_BEARER_TOKEN = "${API_BEARER_TOKEN}" # 🔐 API / web UI token
+BEHIND_PROXY = "true"
+CLOUDFLARE_TOKEN = ""
+LETSENCRYPT_EMAIL = ""
+LOG_LEVEL = "INFO"
@@ -4,10 +4,10 @@ services:
  changedetection:
    image: ghcr.io/dgtlmoon/changedetection.io:0.49
    restart: unless-stopped
-    ports:
+    expose:
      - 5000
    volumes:
      - datastore:/datastore

 volumes:
-  datastore: 
+  datastore: 
@@ -10,8 +10,8 @@
    "docs": "https://github.com/dgtlmoon/changedetection.io/wiki"
  },
  "tags": [
-    "Monitoring",
-    "Data",
-    "Notifications"
+    "monitoring",
+    "data",
+    "notifications"
  ]
 }
@@ -76,4 +76,4 @@ services:
 volumes:
  chatwoot-storage:
  chatwoot-postgres-data:
-  chatwoot-redis-data:
+  chatwoot-redis-data:
@@ -2,13 +2,10 @@
 main_domain = "${domain}"

 [config]
+mounts = []
 [[config.domains]]
 serviceName = "checkcle"
 port = 8090
 host = "${main_domain}"

 [config.env]
-
-[[config.mounts]]
-source = "checkcle-data"
-target = "/mnt/pb_data"
@@ -3,7 +3,7 @@ services:
  server:
    image: ghcr.io/bluewave-labs/checkmate-backend-mono:latest
    restart: always
-    ports:
+    expose:
      - 52345
    environment:
      - UPTIME_APP_API_BASE_URL=${UPTIME_APP_API_BASE_URL}
@@ -7,7 +7,7 @@
  "links": {
    "github": "https://github.com/bluewave-labs/checkmate",
    "website": "https://checkmate.so/",
-    "docs": "https://docs.checkmate.so"
+    "docs": "https://checkmate.so/docs"
  },
  "tags": [
    "self-hosted",
@@ -15,7 +15,7 @@ services:
      - CHEVERETO_HTTPS=0
      - CHEVERETO_MAX_POST_SIZE=2G
      - CHEVERETO_MAX_UPLOAD_SIZE=2G
-    ports:
+    expose:
      - 80
    volumes:
      - storage:/var/www/html/images/
@@ -35,4 +35,4 @@ services:

 volumes:
  storage:
-  mysql: 
+  mysql: 
@@ -10,10 +10,10 @@
    "docs": "https://v4-docs.chevereto.com/"
  },
  "tags": [
-    "Image Hosting",
-    "File Management",
-    "Open Source",
-    "Multi-User",
-    "Private Albums"
+    "image-hosting",
+    "file-management",
+    "open-source",
+    "multi-user",
+    "private-albums"
  ]
 }
@@ -10,7 +10,7 @@
    "docs": "https://chibisafe.app/docs/intro"
  },
  "tags": [
-    "media system",
+    "media-system",
    "storage",
    "file-sharing"
  ]
@@ -8,7 +8,7 @@ services:
      - SECRET_KEY=${SECRET_KEY}
      - DATABASE_URL=postgres://postgres:${DB_PASSWORD}@db:5432/chiefonboarding
      - ALLOWED_HOSTS=${DOMAIN}
-    ports:
+    expose:
      - 8000
    depends_on:
      - db
@@ -23,4 +23,4 @@ services:
      - postgres_data:/var/lib/postgresql/data

 volumes:
-  postgres_data: 
+  postgres_data: 
@@ -10,10 +10,10 @@
    "docs": "https://docs.chiefonboarding.com/"
  },
  "tags": [
-    "Employee Onboarding",
-    "HR Management",
-    "Task Tracking",
-    "Role-Based Access",
-    "Document Management"
+    "employee-onboarding",
+    "hr-management",
+    "task-tracking",
+    "role-based-access",
+    "document-management"
  ]
 }
@@ -5,7 +5,7 @@ services:
    restart: unless-stopped
    volumes:
      - ../files/chirpstack:/etc/chirpstack
-    ports:
+    expose:
      - 8080
    environment:
      - MQTT_BROKER_HOST=mosquitto
@@ -21,7 +21,7 @@ services:
    restart: unless-stopped
    volumes:
      - ../files/chirpstack-gateway-bridge:/etc/chirpstack-gateway-bridge
-    ports:
+    expose:
      - 1700/udp
    environment:
      - INTEGRATION__MQTT__EVENT_TOPIC_TEMPLATE=eu868/gateway/{{ .GatewayID }}/event/{{ .EventType }}
@@ -36,7 +36,7 @@ services:
    restart: unless-stopped
    volumes:
      - ../files/chirpstack-gateway-bridge:/etc/chirpstack-gateway-bridge
-    ports:
+    expose:
      - 3001
    depends_on:
      - mosquitto
@@ -45,7 +45,7 @@ services:
    image: chirpstack/chirpstack-rest-api:4
    restart: unless-stopped
    command: --server chirpstack:8080 --bind 0.0.0.0:8090 --insecure
-    ports:
+    expose:
      - 8090
    depends_on:
      - chirpstack
@@ -73,9 +73,8 @@ services:
    restart: unless-stopped
    volumes:
      - ../files/mosquitto/config/:/mosquitto/config/
-    ports:
+    expose:
      - 1883
-
 volumes:
  postgresqldata:
  redisdata:
@@ -3,7 +3,7 @@ version: "3"
 services:
  chromium:
    image: lscr.io/linuxserver/chromium:5f5dd27e-ls102
-    ports:
+    expose:
      - "3000"
    environment:
      - PUID=1000
@@ -13,4 +13,4 @@ services:
      - config:/config

 volumes:
-  config: 
+  config: 
@@ -3,7 +3,7 @@ version: "3"
 services:
  classicpress:
    image: classicpress/classicpress:php8.3-apache
-    ports:
+    expose:
      - "80"
    environment:
      - WORDPRESS_DB_HOST=db
@@ -27,4 +27,4 @@ services:

 volumes:
  wordpress-data:
-  db-data: 
+  db-data: 
@@ -3,7 +3,7 @@ version: "3"
 services:
  cloud9:
    image: lscr.io/linuxserver/cloud9:1.29.2
-    ports:
+    expose:
      - "8000"
    environment:
      - PUID=1000
@@ -17,4 +17,4 @@ services:
      - code:/code

 volumes:
-  code: 
+  code: 
@@ -3,7 +3,7 @@ version: "3"
 services:
  cloudcmd:
    image: coderaiser/cloudcmd:18.5.1
-    ports:
+    expose:
      - "80"
    environment:
      - CLOUDCMD_ROOT=/mnt/fs
@@ -12,4 +12,4 @@ services:
      - CLOUDCMD_PASSWORD=${PASSWORD}
    volumes:
      - /root:/root
-      - /:/mnt/fs 
+      - /:/mnt/fs 
@@ -3,7 +3,7 @@ version: "3"
 services:
  cockpit:
    image: cockpithq/cockpit:core-2.11.0
-    ports:
+    expose:
      - "80"
    environment:
      - COCKPIT_SESSION_NAME=cockpit
@@ -11,8 +11,8 @@ services:
      - COCKPIT_DATABASE_SERVER=mongodb://${MONGO_USERNAME}:${MONGO_PASSWORD}@mongo:27017
      - COCKPIT_DATABASE_NAME=cockpit
    volumes:
-      - html:/var/www/html
-      - data:/var/www/html/storage/data
+      - config:/var/www/html/config
+      - storage:/var/www/html/storage
    depends_on:
      - mongo

@@ -25,6 +25,6 @@ services:
      - mongo-data:/data/db

 volumes:
-  html:
-  data:
-  mongo-data: 
+  config:
+  storage:
+  mongo-data: 
@@ -3,7 +3,7 @@ version: "3"
 services:
  codex:
    image: ghcr.io/codex-team/codex.docs:v2.2
-    ports:
+    expose:
      - "3000"
    environment:
      - APP_CONFIG_database_driver=mongodb
@@ -28,4 +28,4 @@ services:
 volumes:
  uploads:
  db:
-  mongo-data: 
+  mongo-data: 
@@ -3,10 +3,10 @@ version: "3"
 services:
  collabora:
    image: collabora/code:latest
-    ports:
+    expose:
      - "9980"
    environment:
      - domain=${DOMAIN}
      - username=${USERNAME}
      - password=${PASSWORD}
-      - extra_params=--o:ssl.enable=false 
+      - extra_params=--o:ssl.enable=false 
@@ -5,5 +5,5 @@ services:
    restart: unless-stopped
    volumes:
      - ../files/commafeed-data:/commafeed/data
-    ports:
+    expose:
      - 8082
@@ -3,7 +3,7 @@ version: "3"
 services:
  commento:
    image: registry.gitlab.com/commento/commento:v1.8.0
-    ports:
+    expose:
      - "8080"
    environment:
      - COMMENTO_ORIGIN=${COMMENTO_ORIGIN}
@@ -19,4 +19,4 @@ services:
      - postgres-data:/var/lib/postgresql/data

 volumes:
-  postgres-data: 
+  postgres-data: 
--- a/Show More
+++ b/Show More