fix(supabase): upgrade database to Postgres 17

Align the template with the current upstream self-hosted stack (supabase/postgres 17.6.1.136, studio 2026.08.03, kong 3.9.3), remove the deprecated analytics/vector services and switch Studio/pg-meta to the postgres role per upstream guidance. Closes #1067 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
chore: update stalwart named volumes for v0.16 (#1066 )
2026-11-10 01:33:12 -06:00 · 2026-08-06 01:09:28 -06:00 · 2026-08-05 08:54:26 -06:00 · 2026-08-04 10:07:09 -05:00 · 2026-08-03 05:02:23 -06:00 · 2026-08-03 05:01:17 -06:00
9 changed files with 108 additions and 372 deletions
@@ -0,0 +1,19 @@
+# Open Design
+
+Local-first, open-source design tool with native desktop apps, a large library of
+design systems, and an extensible plugin ecosystem.
+
+## Notes
+
+- **Access / security.** This template sets `OD_DISABLE_API_AUTH=1`. The Open Design
+  daemon token-gates its API when bound to a non-loopback address, and a browser
+  cannot supply that bearer token — so disabling it is required for the web UI to
+  load. As a result the instance is **reachable by anyone who has the URL**. If it is
+  internet-facing, put an authenticating layer in front (for example Dokploy/Traefik
+  basic-auth) and enable an HTTPS certificate on the domain.
+
+- **AI features.** The image intentionally does not bundle an AI agent CLI. To
+  generate designs, either **Sign in to Open Design** (cloud) or choose **Bring your
+  own key** and provide a provider API key (e.g. `ANTHROPIC_API_KEY`,
+  `OPENAI_API_KEY`). A "vela binary not found" notice on the sign-in screen is
+  expected and only affects the cloud-agent path.
@@ -0,0 +1,29 @@
+version: "3.8"
+
+services:
+  open-design:
+    image: ghcr.io/nexu-io/od:0.16.1
+    restart: unless-stopped
+    environment:
+      NODE_ENV: production
+      NODE_OPTIONS: --max-old-space-size=192
+      OD_BIND_HOST: 0.0.0.0
+      OD_PORT: 7456
+      OD_API_TOKEN: ${OD_API_TOKEN}
+      OD_ALLOWED_ORIGINS: ${OD_ALLOWED_ORIGINS}
+      # The daemon token-gates its API when bound to 0.0.0.0, and a browser
+      # cannot present that token, so the web UI needs API auth disabled to
+      # load. The instance is then reachable by anyone with the URL — front it
+      # with auth/HTTPS if it is internet-facing (see README.md).
+      OD_DISABLE_API_AUTH: "1"
+    volumes:
+      - open_design_data:/app/.od
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:7456/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+
+volumes:
+  open_design_data: {}
@@ -0,0 +1,16 @@
+{
+  "id": "open-design",
+  "name": "Open Design",
+  "version": "0.16.1",
+  "description": "Open Design is a local-first, open-source design tool with native desktop apps, a large library of design systems, and an extensible plugin ecosystem that runs across many coding agents.",
+  "logo": "open-design.svg",
+  "links": {
+    "github": "https://github.com/nexu-io/open-design",
+    "website": "https://open-design.ai",
+    "docs": "https://open-design.ai"
+  },
+  "tags": [
+    "design",
+    "self-hosted"
+  ]
+}
@@ -0,0 +1,3 @@
+<svg width="82" height="82" viewBox="0 0.726562 82 82" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M41 0.726562C76.5753 0.726562 82 6.15121 82 41.7266C82 77.3019 76.5753 82.7266 41 82.7266C5.42465 82.7266 0 77.3019 0 41.7266C0 6.15121 5.42465 0.726562 41 0.726562ZM40.8906 16.4258C26.9164 16.4258 15.5879 27.7543 15.5879 41.7285C15.5879 46.7757 15.5879 58.0219 15.5879 63.665C15.588 65.5281 17.091 67.0312 18.9541 67.0312H40.8906C54.8647 67.0311 66.1932 55.7026 66.1934 41.7285C66.1934 27.7544 54.8647 16.4259 40.8906 16.4258ZM40.8906 21.4863C52.0699 21.4864 61.1328 30.5492 61.1328 41.7285C61.1327 52.9078 52.0699 61.9706 40.8906 61.9707C29.7113 61.9707 20.6485 52.9078 20.6484 41.7285C20.6484 30.5491 29.7113 21.4863 40.8906 21.4863ZM32.6445 32.2549C31.9921 32.0027 31.3503 32.6469 31.5996 33.3037L39.3145 53.6045C39.6345 54.4468 40.877 54.2162 40.877 53.3145V41.6836H52.665C53.5605 41.6836 53.7908 40.4368 52.9551 40.1133L32.6445 32.2549Z" fill="#26251E"/>
+</svg>
@@ -0,0 +1,15 @@
+[variables]
+main_domain = "${domain}"
+api_token = "${password:32}"
+
+[config]
+env = [
+  "OD_API_TOKEN=${api_token}",
+  "OD_ALLOWED_ORIGINS=https://${main_domain},http://${main_domain}",
+]
+mounts = []
+
+[[config.domains]]
+serviceName = "open-design"
+port = 7456
+host = "${main_domain}"
@@ -13,8 +13,10 @@ services:
      - "110"    # POP3
      - "995"    # POP3S
    volumes:
-      - stalwart_data:/opt/stalwart-mail
+      - stalwart_etc:/etc/stalwart
+      - stalwart_data:/var/lib/stalwart
    restart: unless-stopped

 volumes:
+  stalwart_etc:
  stalwart_data:
@@ -11,7 +11,7 @@ name: supabase
 services:

  studio:
-    image: supabase/studio:2026.06.03-sha-0bca601
+    image: supabase/studio:2026.08.03-sha-022b374
    restart: unless-stopped
    healthcheck:
      test:
@@ -23,9 +23,6 @@ services:
      interval: 5s
      retries: 5
      start_period: 30s
-    depends_on:
-      analytics:
-        condition: service_healthy
    environment:
      HOSTNAME: "0.0.0.0"

@@ -35,6 +32,9 @@ services:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}

+      # See: https://supabase.com/docs/guides/self-hosting/remove-superuser-access
+      POSTGRES_USER_READ_WRITE: postgres
+
      PG_META_CRYPTO_KEY: ${PG_META_CRYPTO_KEY}
      PGRST_DB_SCHEMAS: ${PGRST_DB_SCHEMAS}
      PGRST_DB_MAX_ROWS: ${PGRST_DB_MAX_ROWS:-1000}
@@ -49,14 +49,12 @@ services:
      SUPABASE_ANON_KEY: ${ANON_KEY}
      SUPABASE_SERVICE_KEY: ${SERVICE_ROLE_KEY}
      AUTH_JWT_SECRET: ${JWT_SECRET}
+      SUPABASE_PUBLISHABLE_KEY: ${SUPABASE_PUBLISHABLE_KEY:-}
+      SUPABASE_SECRET_KEY: ${SUPABASE_SECRET_KEY:-}

-      LOGFLARE_API_KEY: ${LOGFLARE_PUBLIC_ACCESS_TOKEN}
-      LOGFLARE_PUBLIC_ACCESS_TOKEN: ${LOGFLARE_PUBLIC_ACCESS_TOKEN}
-      LOGFLARE_PRIVATE_ACCESS_TOKEN: ${LOGFLARE_PRIVATE_ACCESS_TOKEN}
+      # Analytics (Logflare) was removed from the upstream self-hosted stack
+      ENABLED_FEATURES_LOGS_ALL: "false"

-      LOGFLARE_URL: http://analytics:4000
-      NEXT_PUBLIC_ENABLE_LOGS: "true"
-      NEXT_ANALYTICS_BACKEND_PROVIDER: postgres
      SNIPPETS_MANAGEMENT_FOLDER: /app/snippets
      EDGE_FUNCTIONS_MANAGEMENT_FOLDER: /app/edge-functions
    volumes:
@@ -64,7 +62,7 @@ services:
      - ../files/volumes/functions:/app/edge-functions:Z

  kong:
-    image: kong/kong:3.9.1
+    image: kong/kong:3.9.3
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "kong", "health"]
@@ -138,6 +136,7 @@ services:
      GOTRUE_JWT_EXP: ${JWT_EXPIRY}
      GOTRUE_JWT_SECRET: ${JWT_SECRET}
      GOTRUE_JWT_KEYS: ${JWT_KEYS:-[]}
+      GOTRUE_JWT_ISSUER: ${API_EXTERNAL_URL}

      GOTRUE_EXTERNAL_EMAIL_ENABLED: ${ENABLE_EMAIL_SIGNUP}
      GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED: ${ENABLE_ANONYMOUS_USERS}
@@ -163,12 +162,19 @@ services:
    depends_on:
      db:
        condition: service_healthy
+    healthcheck:
+      test: [ "CMD", "postgrest", "--ready" ]
+      interval: 5s
+      timeout: 5s
+      retries: 3
    environment:
      PGRST_DB_URI: postgres://authenticator:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}
      PGRST_DB_SCHEMAS: ${PGRST_DB_SCHEMAS}
      PGRST_DB_MAX_ROWS: ${PGRST_DB_MAX_ROWS:-1000}
      PGRST_DB_EXTRA_SEARCH_PATH: ${PGRST_DB_EXTRA_SEARCH_PATH:-public}
      PGRST_DB_ANON_ROLE: anon
+      PGRST_ADMIN_SERVER_PORT: 3001
+      PGRST_ADMIN_SERVER_HOST: localhost
      PGRST_JWT_SECRET: ${JWT_SECRET}
      PGRST_DB_USE_LEGACY_GUCS: "false"
      PGRST_APP_SETTINGS_JWT_SECRET: ${JWT_SECRET}
@@ -292,7 +298,8 @@ services:
      PG_META_DB_HOST: ${POSTGRES_HOST}
      PG_META_DB_PORT: ${POSTGRES_PORT}
      PG_META_DB_NAME: ${POSTGRES_DB}
-      PG_META_DB_USER: supabase_admin
+      # See: https://supabase.com/docs/guides/self-hosting/remove-superuser-access
+      PG_META_DB_USER: postgres
      PG_META_DB_PASSWORD: ${POSTGRES_PASSWORD}
      CRYPTO_KEY: ${PG_META_CRYPTO_KEY}

@@ -322,43 +329,9 @@ services:
        "/home/deno/functions/main"
      ]

-  analytics:
-    image: supabase/logflare:1.36.1
-    restart: unless-stopped
-    expose:
-      - 4000
-    # First boot: Logflare seeds _analytics in Postgres; allow extra time before marking unhealthy.
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "curl -sSfL -o /dev/null http://localhost:4000/health"
-        ]
-      timeout: 10s
-      interval: 5s
-      retries: 15
-      start_period: 90s
-    depends_on:
-      db:
-        condition: service_healthy
-    environment:
-      LOGFLARE_NODE_HOST: 127.0.0.1
-      DB_USERNAME: supabase_admin
-      DB_DATABASE: _supabase
-      DB_HOSTNAME: ${POSTGRES_HOST}
-      DB_PORT: ${POSTGRES_PORT}
-      DB_PASSWORD: ${POSTGRES_PASSWORD}
-      DB_SCHEMA: _analytics
-      LOGFLARE_PUBLIC_ACCESS_TOKEN: ${LOGFLARE_PUBLIC_ACCESS_TOKEN}
-      LOGFLARE_PRIVATE_ACCESS_TOKEN: ${LOGFLARE_PRIVATE_ACCESS_TOKEN}
-      LOGFLARE_SINGLE_TENANT: "true"
-      LOGFLARE_SUPABASE_MODE: "true"
-      LOGFLARE_MIN_CLUSTER_SIZE: 1
-      POSTGRES_BACKEND_URL: postgresql://supabase_admin:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/_supabase
-      POSTGRES_BACKEND_SCHEMA: _analytics
-      LOGFLARE_FEATURE_FLAG_OVERRIDE: multibackend=true
-
  db:
+    # Major upgrade from Postgres 15 requires a dump/restore for existing installs.
+    # See: https://github.com/orgs/supabase/discussions/46080
    image: supabase/postgres:17.6.1.136
    restart: unless-stopped
    volumes:
@@ -385,9 +358,6 @@ services:
      timeout: 5s
      retries: 15
      start_period: 60s
-    depends_on:
-      vector:
-        condition: service_healthy
    environment:
      POSTGRES_HOST: /var/run/postgresql
      PGPORT: ${POSTGRES_PORT}
@@ -407,36 +377,6 @@ services:
        "log_min_messages=fatal"
      ]

-  vector:
-    image: timberio/vector:0.53.0-alpine
-    restart: unless-stopped
-    volumes:
-      - ../files/volumes/logs/vector.yml:/etc/vector/vector.yml:ro,z
-      - ${DOCKER_SOCKET_LOCATION}:/var/run/docker.sock:ro,z
-    healthcheck:
-      test:
-        [
-          "CMD",
-          "wget",
-          "--no-verbose",
-          "--tries=1",
-          "--spider",
-          "http://vector:9001/health"
-        ]
-      timeout: 5s
-      interval: 5s
-      retries: 5
-      start_period: 10s
-    environment:
-      LOGFLARE_PUBLIC_ACCESS_TOKEN: ${LOGFLARE_PUBLIC_ACCESS_TOKEN}
-    command:
-      [
-        "--config",
-        "/etc/vector/vector.yml"
-      ]
-    security_opt:
-      - "label=disable"
-
  supavisor:
    image: supabase/supavisor:2.9.5
    restart: unless-stopped
@@ -1,7 +1,7 @@
 {
  "id": "supabase",
  "name": "SupaBase",
-  "version": "2026.06.03 / dokploy >= 0.22.5",
+  "version": "2026.08.03 / dokploy >= 0.22.5",
  "description": "The open source Firebase alternative. Supabase gives you a dedicated Postgres database to build your web, mobile, and AI applications. This require at least version 0.22.5 of dokploy.",
  "links": {
    "github": "https://github.com/supabase/supabase",
@@ -2,8 +2,6 @@
 main_domain = "${domain}"
 postgres_password = "${password:32}"
 dashboard_password = "${password:32}"
-logflare_public_access_token = "${password:32}"
-logflare_private_access_token = "${password:32}"
 pg_meta_crypto_key = "${password:32}"
 s3_protocol_access_key_id = "${password:24}"
 s3_protocol_access_key_secret = "${password:48}"
@@ -59,8 +57,6 @@ env = [
 'SECRET_KEY_BASE=${secret_key_base}',
 'VAULT_ENC_KEY=${vault_enc_key}',
 'PG_META_CRYPTO_KEY=${pg_meta_crypto_key}',
-'LOGFLARE_PUBLIC_ACCESS_TOKEN=${logflare_public_access_token}',
-'LOGFLARE_PRIVATE_ACCESS_TOKEN=${logflare_private_access_token}',
 '',
 '',
 '############',
@@ -164,19 +160,7 @@ env = [
 '# Functions - Configuration for Functions',
 '############',
 '# NOTE: VERIFY_JWT applies to all functions. Per-function VERIFY_JWT is not supported yet.',
-'FUNCTIONS_VERIFY_JWT=false',
-'',
-'',
-'############',
-'# Logs - Configuration for Logflare',
-'############',
-'',
-'# Docker socket location - this value will differ depending on your OS',
-'DOCKER_SOCKET_LOCATION=/var/run/docker.sock',
-'',
-'# Google Cloud Project details',
-'GOOGLE_PROJECT_ID=GOOGLE_PROJECT_ID',
-'GOOGLE_PROJECT_NUMBER=GOOGLE_PROJECT_NUMBER']
+'FUNCTIONS_VERIFY_JWT=false']

 [[config.mounts]]
 filePath = "/volumes/api/kong-entrypoint.sh"
@@ -1007,278 +991,6 @@ Deno.serve(async (req: Request) => {
 })
 """

-[[config.mounts]]
-filePath = "/volumes/logs/vector.yml"
-content = """api:
-  enabled: true
-  address: 0.0.0.0:9001
-
-sources:
-  docker_host:
-    type: docker_logs
-
-transforms:
-  project_logs:
-    type: remap
-    inputs:
-      - docker_host
-    source: |-
-      .project = "default"
-      .event_message = del(.message)
-      compose_service, label_err = get(.label, ["com.docker.compose.service"])
-      if label_err != null || compose_service == null {
-        abort
-      }
-      compose_service = to_string!(compose_service)
-      if compose_service == "vector" {
-        abort
-      }
-      .appname = "supabase-" + compose_service
-      del(.container_created_at)
-      del(.container_id)
-      del(.source_type)
-      del(.stream)
-      del(.label)
-      del(.image)
-      del(.host)
-      del(.stream)
-  router:
-    type: route
-    inputs:
-      - project_logs
-    route:
-      kong: '.appname == "supabase-kong" || .appname == "supabase-envoy"'
-      auth: '.appname == "supabase-auth"'
-      rest: '.appname == "supabase-rest"'
-      realtime: '.appname == "supabase-realtime"'
-      storage: '.appname == "supabase-storage"'
-      functions: '.appname == "supabase-functions"'
-      db: '.appname == "supabase-db"'
-  # Ignores non nginx errors since they are related with kong booting up
-  kong_logs:
-    type: remap
-    inputs:
-      - router.kong
-    source: |-
-      req, err = parse_nginx_log(.event_message, "combined")
-      if err == null {
-          .timestamp = req.timestamp
-          .metadata.request.headers.referer = req.referer
-          .metadata.request.headers.user_agent = req.agent
-          .metadata.request.headers.cf_connecting_ip = req.client
-          .metadata.response.status_code = req.status
-          url, split_err = split(req.request, " ")
-          if split_err == null {
-              .metadata.request.method = url[0]
-              .metadata.request.path = url[1]
-              .metadata.request.protocol = url[2]
-          }
-      }
-      if err != null {
-        abort
-      }
-  kong_err:
-    type: remap
-    inputs:
-      - router.kong
-    source: |-
-      .metadata.request.method = "GET"
-      .metadata.response.status_code = 200
-      parsed, err = parse_nginx_log(.event_message, "error")
-      if err == null {
-          .timestamp = parsed.timestamp
-          .severity = parsed.severity
-          .metadata.request.host = parsed.host
-          .metadata.request.headers.cf_connecting_ip = parsed.client
-          url, err = split(parsed.request, " ")
-          if err == null {
-              .metadata.request.method = url[0]
-              .metadata.request.path = url[1]
-              .metadata.request.protocol = url[2]
-          }
-      }
-      if err != null {
-        abort
-      }
-  # Gotrue logs are structured json strings which frontend parses directly. But we keep metadata for consistency.
-  auth_logs:
-    type: remap
-    inputs:
-      - router.auth
-    source: |-
-      parsed, err = parse_json(.event_message)
-      if err == null {
-          .metadata.timestamp = parsed.time
-          .metadata = merge!(.metadata, parsed)
-      }
-  # PostgREST logs are structured so we separate timestamp from message using regex
-  rest_logs:
-    type: remap
-    inputs:
-      - router.rest
-    source: |-
-      parsed, err = parse_regex(.event_message, r'^(?P<time>.*): (?P<msg>.*)$')
-      if err == null {
-          .event_message = parsed.msg
-          .timestamp = parse_timestamp!(value: parsed.time,format: "%d/%b/%Y:%H:%M:%S %z")
-          .metadata.host = .project
-      }
-  realtime_logs_filtered:
-    type: filter
-    inputs:
-      - router.realtime
-    condition: '!contains(string!(.event_message), "/health")'
-  realtime_logs:
-    type: remap
-    inputs:
-      - realtime_logs_filtered
-    source: |-
-      .metadata.project = del(.project)
-      .metadata.external_id = .metadata.project
-      parsed, err = parse_regex(.event_message, r'^(?P<time>\\d+:\\d+:\\d+\\.\\d+) \\[(?P<level>\\w+)\\] (?P<msg>.*)$')
-      if err == null {
-          .event_message = parsed.msg
-          .metadata.level = parsed.level
-      }
-  functions_logs:
-    type: remap
-    inputs:
-      - router.functions
-    source: |-
-      .metadata.project_ref = del(.project)
-  # Storage logs may contain json objects so we parse them for completeness
-  storage_logs:
-    type: remap
-    inputs:
-      - router.storage
-    source: |-
-      .metadata.project = del(.project)
-      .metadata.tenantId = .metadata.project
-      parsed, err = parse_json(.event_message)
-      if err == null {
-          .event_message = parsed.msg
-          .metadata.level = parsed.level
-          .metadata.timestamp = parsed.time
-          .metadata.context[0].host = parsed.hostname
-          .metadata.context[0].pid = parsed.pid
-      }
-  # Postgres logs some messages to stderr which we map to warning severity level
-  db_logs:
-    type: remap
-    inputs:
-      - router.db
-    source: |-
-      .metadata.host = "db-default"
-      .metadata.parsed.timestamp = .timestamp
-
-      parsed, err = parse_regex(.event_message, r'.*(?P<level>INFO|NOTICE|WARNING|ERROR|LOG|FATAL|PANIC?):.*', numeric_groups: true)
-
-      if err != null || parsed == null {
-        .metadata.parsed.error_severity = "info"
-      }
-      if parsed.level != null {
-       .metadata.parsed.error_severity = parsed.level
-      }
-      if .metadata.parsed.error_severity == "info" {
-          .metadata.parsed.error_severity = "log"
-      }
-      .metadata.parsed.error_severity = upcase!(.metadata.parsed.error_severity)
-
-sinks:
-  logflare_auth:
-    type: 'http'
-    inputs:
-      - auth_logs
-    encoding:
-      codec: 'json'
-    method: 'post'
-    request:
-      retry_max_duration_secs: 30
-      retry_initial_backoff_secs: 1
-      headers:
-        x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}
-    uri: 'http://analytics:4000/api/logs?source_name=gotrue.logs.prod'
-  logflare_realtime:
-    type: 'http'
-    inputs:
-      - realtime_logs
-    encoding:
-      codec: 'json'
-    method: 'post'
-    request:
-      retry_max_duration_secs: 30
-      retry_initial_backoff_secs: 1
-      headers:
-        x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}
-    uri: 'http://analytics:4000/api/logs?source_name=realtime.logs.prod'
-  logflare_rest:
-    type: 'http'
-    inputs:
-      - rest_logs
-    encoding:
-      codec: 'json'
-    method: 'post'
-    request:
-      retry_max_duration_secs: 30
-      retry_initial_backoff_secs: 1
-      headers:
-        x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}
-    uri: 'http://analytics:4000/api/logs?source_name=postgREST.logs.prod'
-  logflare_db:
-    type: 'http'
-    inputs:
-      - db_logs
-    encoding:
-      codec: 'json'
-    method: 'post'
-    request:
-      retry_max_duration_secs: 30
-      retry_initial_backoff_secs: 1
-      headers:
-        x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}
-    uri: 'http://analytics:4000/api/logs?source_name=postgres.logs'
-  logflare_functions:
-    type: 'http'
-    inputs:
-      - functions_logs
-    encoding:
-      codec: 'json'
-    method: 'post'
-    request:
-      retry_max_duration_secs: 30
-      retry_initial_backoff_secs: 1
-      headers:
-        x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}
-    uri: 'http://analytics:4000/api/logs?source_name=deno-relay-logs'
-  logflare_storage:
-    type: 'http'
-    inputs:
-      - storage_logs
-    encoding:
-      codec: 'json'
-    method: 'post'
-    request:
-      retry_max_duration_secs: 30
-      retry_initial_backoff_secs: 1
-      headers:
-        x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}
-    uri: 'http://analytics:4000/api/logs?source_name=storage.logs.prod.2'
-  logflare_kong:
-    type: 'http'
-    inputs:
-      - kong_logs
-      - kong_err
-    encoding:
-      codec: 'json'
-    method: 'post'
-    request:
-      retry_max_duration_secs: 30
-      retry_initial_backoff_secs: 1
-      headers:
-        x-api-key: ${LOGFLARE_PUBLIC_ACCESS_TOKEN?LOGFLARE_PUBLIC_ACCESS_TOKEN is required}
-    uri: 'http://analytics:4000/api/logs?source_name=cloudflare.logs.prod'
-"""
-
 [[config.mounts]]
 filePath = "/volumes/pooler/pooler.exs"
 content = """{:ok, _} = Application.ensure_all_started(:supavisor)
Author	SHA1	Message	Date
Mauricio SiuandClaude Fable 5	17a53fa567	fix(supabase): upgrade database to Postgres 17 Align the template with the current upstream self-hosted stack (supabase/postgres 17.6.1.136, studio 2026.08.03, kong 3.9.3), remove the deprecated analytics/vector services and switch Studio/pg-meta to the postgres role per upstream guidance. Closes #1067 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-06 01:09:28 -06:00
Mauricio Siu GitHub rowupstream	ce2864aa12	chore: update stalwart named volumes for v0.16 (#1066 ) Co-authored-by: rowupstream <259214402+rowupstream@users.noreply.github.com>	2026-08-05 08:54:26 -06:00
rowupstream	b258e9f774	chore: update stalwart named volumes for v0.16	2026-08-04 10:07:09 -05:00
abhishukla610 GitHub Abhiigg Mauricio Siu	755c7c5c50	Add Open Design template (#966 ) * Add Open Design template Open Design is a local-first, open-source design tool that ships as a single self-contained container (no external DB or cache). Adds the blueprint (docker-compose.yml + template.toml + logo) and a meta.json entry. * Use node-based healthcheck for Open Design template (matches upstream; verified locally) * Pin Open Design image to 0.16.1 for reproducible deploys Replace :latest with the immutable released tag ghcr.io/nexu-io/od:0.16.1 in docker-compose.yml and set the matching version in meta.json, per the repo pinning convention (AGENTS.md). Tag 0.16.1 verified: /api/health returns 200 and the node-based healthcheck passes. * Allow both http and https origins for Open Design template Dokploy's auto-generated domain is served over plain HTTP by default (no cert), so OD_ALLOWED_ORIGINS=https://${main_domain} alone made the daemon reject the browser's http origin with 403, breaking the app after the onboarding shell loaded. List both schemes so the template works on the default HTTP domain and after a user adds an HTTPS certificate. Verified against a live deploy: listed origin -> 200, unlisted -> 403; the daemon supports comma-separated multi-origin per deploy/README.md. * Disable daemon API auth so the Open Design web UI loads The daemon token-gates its API when bound to 0.0.0.0 (every container), and a browser has no way to present that bearer token, so the web UI's bootstrap calls all returned 401 and the app failed to load. Set OD_DISABLE_API_AUTH=1 (the daemon's documented escape hatch) so the UI works on deploy. Add a README noting the instance is then open (front it with auth/HTTPS if internet-facing) and how to enable AI features. Verified end to end against a live deploy on a real domain. --------- Co-authored-by: Abhiigg <abhi@incrediblegoodguys.com> Co-authored-by: Mauricio Siu <siumauricio@icloud.com>	2026-08-03 05:02:23 -06:00
Mauricio Siu GitHub Claude Fable 5	025ae61c2c	feat: add Whatomate template (#1064 ) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-03 05:01:17 -06:00