feat: add Oryx (SRS) media streaming template

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

blueprints/affinepro/docker-compose.yml

@@ -1,7 +1,7 @@
 version: "3.8"
 services:
   affinepro:
-    image: ghcr.io/toeverything/affine-graphql:stable-780dd83
+    image: ghcr.io/toeverything/affine:stable
     restart: unless-stopped
     ports:
       - 3010
@@ -12,6 +12,7 @@ services:
       - REDIS_SERVER_HOST=redis
       - REDIS_SERVER_PASSWORD=${REDIS_PASSWORD}
       - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@db:5432/affinepro
+      - AFFINE_INDEXER_ENABLED=false
       - AFFINE_SERVER_HOST=${DOMAIN}
       - MAILER_HOST=${MAILER_HOST}
       - MAILER_PORT=${MAILER_PORT}
@@ -19,16 +20,21 @@ services:
       - MAILER_PASSWORD=${MAILER_PASSWORD}
       - MAILER_SENDER=${MAILER_SENDER}
     depends_on:
-      - db
-      - redis
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      migration:
+        condition: service_completed_successfully
 
   migration:
-    image: ghcr.io/toeverything/affine-graphql:stable-780dd83
-    command: node ./scripts/self-host-predeploy.js
+    image: ghcr.io/toeverything/affine:stable
+    command: ["sh", "-c", "node ./scripts/self-host-predeploy.js"]
     environment:
       - REDIS_SERVER_HOST=redis
       - REDIS_SERVER_PASSWORD=${REDIS_PASSWORD}
       - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@db:5432/affinepro
+      - AFFINE_INDEXER_ENABLED=false
       - AFFINE_SERVER_HOST=${DOMAIN}
       - MAILER_HOST=${MAILER_HOST}
       - MAILER_PORT=${MAILER_PORT}
@@ -39,17 +45,25 @@ services:
       - affine-storage:/root/.affine/storage
       - affine-config:/root/.affine/config
     depends_on:
-      - db
-      - redis
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
 
   db:
-    image: postgres:15-alpine
+    image: pgvector/pgvector:pg16
     restart: unless-stopped
     environment:
       - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
       - POSTGRES_DB=affinepro
+      - POSTGRES_INITDB_ARGS=--data-checksums
     volumes:
       - postgres-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD", "pg_isready", "-U", "postgres", "-d", "affinepro"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
   redis:
     image: redis:7-alpine
@@ -57,9 +71,14 @@ services:
     command: redis-server --requirepass ${REDIS_PASSWORD}
     volumes:
       - redis-data:/data
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli -a '${REDIS_PASSWORD}' ping | grep PONG"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
 volumes:
   affine-storage: {}
   affine-config: {}
   postgres-data: {}
-  redis-data: {} 
+  redis-data: {}

blueprints/affinepro/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "affinepro",
   "name": "Affine Pro",
-  "version": "stable-780dd83",
+  "version": "stable",
   "description": "Affine Pro is a modern, self-hosted platform designed for collaborative content creation and project management. It offers an intuitive interface, seamless real-time collaboration, and powerful tools for organizing tasks, notes, and ideas.",
   "logo": "logo.png",
   "links": {

blueprints/automatisch/docker-compose.yml

@@ -1,17 +1,15 @@
-version: "3.8"
 services:
   automatisch:
-    image: dockeriddonuts/automatisch:2.0
+    image: automatischio/automatisch:0.15.0
     restart: unless-stopped
-    ports:
-      - 3000
     environment:
       - HOST=${DOMAIN}
       - PROTOCOL=http
       - PORT=3000
+      - API_URL=http://${DOMAIN}
+      - WEB_APP_URL=http://${DOMAIN}
       - APP_ENV=production
       - REDIS_HOST=automatisch-redis
-      - REDIS_USERNAME=default
       - REDIS_PASSWORD=${REDIS_PASSWORD}
       - POSTGRES_HOST=automatisch-postgres
       - POSTGRES_DATABASE=automatisch
@@ -23,11 +21,13 @@ services:
     volumes:
       - storage:/automatisch/storage
     depends_on:
-      - automatisch-postgres
-      - automatisch-redis
+      automatisch-postgres:
+        condition: service_healthy
+      automatisch-redis:
+        condition: service_started
 
   automatisch-worker:
-    image: dockeriddonuts/automatisch:2.0
+    image: automatischio/automatisch:0.15.0
     restart: unless-stopped
     environment:
       - APP_ENV=production
@@ -44,8 +44,7 @@ services:
     volumes:
       - storage:/automatisch/storage
     depends_on:
-      - automatisch-postgres
-      - automatisch-redis
+      - automatisch
 
   automatisch-postgres:
     image: postgres:15-alpine
@@ -56,18 +55,20 @@ services:
       - POSTGRES_DB=automatisch
     volumes:
       - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d automatisch"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
   automatisch-redis:
     image: redis:7-alpine
     restart: unless-stopped
     command: redis-server --requirepass ${REDIS_PASSWORD}
-    environment:
-      - REDIS_USERNAME=default
-      - REDIS_PASSWORD=${REDIS_PASSWORD}
     volumes:
       - redis_data:/data
 
 volumes:
   storage: {}
   postgres_data: {}
-  redis_data: {} 
+  redis_data: {}

blueprints/automatisch/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "automatisch",
   "name": "Automatisch",
-  "version": "2.0",
+  "version": "0.15.0",
   "description": "Automatisch is a powerful, self-hosted workflow automation tool designed for connecting your apps and automating repetitive tasks. With Automatisch, you can create workflows to sync data, send notifications, and perform various actions seamlessly across different services.",
   "logo": "logo.png",
   "links": {

blueprints/automatisch/template.toml

@@ -13,6 +13,7 @@ port = 3000
 host = "${main_domain}"
 
 [config.env]
+DOMAIN = "${main_domain}"
 DB_PASSWORD = "${db_password}"
 REDIS_PASSWORD = "${redis_password}"
 ENCRYPTION_KEY = "${encryption_key}"

blueprints/cockpit/docker-compose.yml

@@ -11,8 +11,8 @@ services:
       - COCKPIT_DATABASE_SERVER=mongodb://${MONGO_USERNAME}:${MONGO_PASSWORD}@mongo:27017
       - COCKPIT_DATABASE_NAME=cockpit
     volumes:
-      - html:/var/www/html
-      - data:/var/www/html/storage/data
+      - config:/var/www/html/config
+      - storage:/var/www/html/storage
     depends_on:
       - mongo
 
@@ -25,6 +25,6 @@ services:
       - mongo-data:/data/db
 
 volumes:
-  html:
-  data:
+  config:
+  storage:
   mongo-data: 

blueprints/evolutionapi/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   evolution-api:
-    image: evoapicloud/evolution-api:latest
+    image: evoapicloud/evolution-api:v2.3.7
     restart: always
     volumes:
       - evolution-instances:/evolution/instances
@@ -29,6 +29,13 @@ services:
       - CACHE_REDIS_URI=${CACHE_REDIS_URI}
       - CACHE_REDIS_PREFIX_KEY=${CACHE_REDIS_PREFIX_KEY}
       - CACHE_REDIS_SAVE_INSTANCES=${CACHE_REDIS_SAVE_INSTANCES}
+      - TYPEBOT_ENABLED=${TYPEBOT_ENABLED}
+      - TYPEBOT_API_VERSION=${TYPEBOT_API_VERSION}
+      - CHATWOOT_ENABLED=${CHATWOOT_ENABLED}
+      - OPENAI_ENABLED=${OPENAI_ENABLED}
+      - DIFY_ENABLED=${DIFY_ENABLED}
+      - N8N_ENABLED=${N8N_ENABLED}
+      - EVOAI_ENABLED=${EVOAI_ENABLED}
 
   evolution-postgres:
     image: postgres:16-alpine

blueprints/evolutionapi/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "evolutionapi",
   "name": "Evolution API",
-  "version": "v2.1.2",
+  "version": "v2.3.7",
   "description": "Evolution API is a robust platform dedicated to empowering small businesses with limited resources, going beyond a simple messaging solution via WhatsApp.",
   "logo": "evolutionapi.png",
   "links": {

blueprints/evolutionapi/template.toml

@@ -31,6 +31,13 @@ env = [
   "CACHE_REDIS_URI=redis://evolution-redis:6379",
   "CACHE_REDIS_PREFIX_KEY=evolution",
   "CACHE_REDIS_SAVE_INSTANCES=true",
+  "TYPEBOT_ENABLED=true",
+  "TYPEBOT_API_VERSION=latest",
+  "CHATWOOT_ENABLED=true",
+  "OPENAI_ENABLED=true",
+  "DIFY_ENABLED=true",
+  "N8N_ENABLED=true",
+  "EVOAI_ENABLED=true",
 ]
 mounts = []
 

blueprints/gitlab-ce/docker-compose.yml

@@ -1,65 +1,24 @@
 services:
   gitlab:
-    image: gitlab/gitlab-ce:latest
+    image: gitlab/gitlab-ce:19.1.2-ce.0
     restart: unless-stopped
-    hostname: gitlab.example.com
+    shm_size: "256m"
     environment:
       GITLAB_OMNIBUS_CONFIG: |
         external_url 'http://${GITLAB_HOST}'
-        gitlab_rails['gitlab_ssh_host'] = '${GITLAB_HOST}'
-        gitlab_rails['gitlab_shell_ssh_port'] = 2224
-        gitlab_rails['db_adapter'] = 'postgresql'
-        gitlab_rails['db_host'] = 'postgresql'
-        gitlab_rails['db_port'] = '5432'
-        gitlab_rails['db_database'] = '${POSTGRES_DB}'
-        gitlab_rails['db_username'] = '${POSTGRES_USER}'
-        gitlab_rails['db_password'] = '${POSTGRES_PASSWORD}'
-        # Redis config for external TCP connection
-        gitlab_rails['redis_url'] = 'redis://redis:6379/0'
-        gitlab_rails['redis_host'] = 'redis'
-        gitlab_rails['redis_port'] = 6379
-        gitlab_rails['redis_socket'] = nil
-        gitlab_rails['gitlab_email_enabled'] = false
-        gitlab_rails['gitlab_default_can_create_group'] = true
-        gitlab_rails['gitlab_username_changing_enabled'] = false
-        unicorn['worker_processes'] = 2
-        unicorn['worker_timeout'] = 60
-        postgresql['enable'] = false
-        redis['enable'] = false
-        nginx['enable'] = true
         nginx['listen_port'] = 80
         nginx['listen_https'] = false
+        gitlab_rails['initial_root_password'] = '${GITLAB_ROOT_PASSWORD}'
+        gitlab_rails['gitlab_email_enabled'] = false
+        puma['worker_processes'] = 0
+        sidekiq['concurrency'] = 10
         prometheus_monitoring['enable'] = false
-    ports:
-      - "80"
-      - "2224"
     volumes:
       - gitlab_config:/etc/gitlab
       - gitlab_logs:/var/log/gitlab
       - gitlab_data:/var/opt/gitlab
-    depends_on:
-      - postgresql
-      - redis
-
-  postgresql:
-    image: postgres:16-alpine
-    restart: unless-stopped
-    environment:
-      POSTGRES_DB: ${POSTGRES_DB}
-      POSTGRES_USER: ${POSTGRES_USER}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
-    volumes:
-      - postgresql_data:/var/lib/postgresql/data
-
-  redis:
-    image: redis:7-alpine
-    restart: unless-stopped
-    volumes:
-      - redis_data:/data
 
 volumes:
   gitlab_config:
   gitlab_logs:
   gitlab_data:
-  postgresql_data:
-  redis_data:

blueprints/gitlab-ce/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "gitlab-ce",
   "name": "GitLab CE",
-  "version": "latest",
+  "version": "19.1.2",
   "description": "GitLab Community Edition is a free and open source platform for managing Git repositories, CI/CD pipelines, and project management.",
   "logo": "gitlab-ce.svg",
   "links": {

blueprints/gitlab-ce/template.toml

@@ -1,15 +1,11 @@
 [variables]
 main_domain = "${domain}"
-postgres_db = "gitlab"
-postgres_user = "gitlab"
-postgres_password = "${password:32}"
+gitlab_root_password = "${password:32}"
 
 [config]
 env = [
   "GITLAB_HOST=${main_domain}",
-  "POSTGRES_DB=${postgres_db}",
-  "POSTGRES_USER=${postgres_user}",
-  "POSTGRES_PASSWORD=${postgres_password}",
+  "GITLAB_ROOT_PASSWORD=${gitlab_root_password}",
 ]
 
 [[config.domains]]

blueprints/homarr/docker-compose.yml

@@ -4,8 +4,11 @@ services:
     restart: unless-stopped
     volumes:
       # - /var/run/docker.sock:/var/run/docker.sock # Optional, only if you want docker integration
-      - ../homarr/appdata:/appdata
+      - homarr_appdata:/appdata
     environment:
       - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY}
     ports:
       - 7575
+
+volumes:
+  homarr_appdata:

blueprints/homarr/template.toml

@@ -1,6 +1,6 @@
 [variables]
 main_domain = "${domain}"
-secret_key = "${password:64}"
+secret_key = "${hash:64}"
 
 [config]
 env = ["SECRET_ENCRYPTION_KEY=${secret_key}"]

blueprints/immich/docker-compose.yml

@@ -2,10 +2,10 @@ version: "3.9"
 
 services:
   immich-server:
-    image: ghcr.io/immich-app/immich-server:v2.1.0
+    image: ghcr.io/immich-app/immich-server:v3.0.2
 
     volumes:
-      - immich-library:/usr/src/app/upload
+      - immich-library:/data
       - /etc/localtime:/etc/localtime:ro
     depends_on:
       immich-redis:
@@ -13,9 +13,6 @@ services:
       immich-database:
         condition: service_healthy
     environment:
-      PORT: 2283
-      SERVER_URL: ${SERVER_URL}
-      FRONT_BASE_URL: ${FRONT_BASE_URL}
       # Database Configuration
       DB_HOSTNAME: ${DB_HOSTNAME}
       DB_PORT: ${DB_PORT}
@@ -30,70 +27,45 @@ services:
       TZ: ${TZ}
     restart: unless-stopped
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:2283/server-info/ping"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
+      disable: false
 
   immich-machine-learning:
-    image: ghcr.io/immich-app/immich-machine-learning:v2.1.0
+    image: ghcr.io/immich-app/immich-machine-learning:v3.0.2
 
     volumes:
       - immich-model-cache:/cache
-    environment:
-      REDIS_HOSTNAME: ${REDIS_HOSTNAME}
-      REDIS_PORT: ${REDIS_PORT}
-      REDIS_DBINDEX: ${REDIS_DBINDEX}
     restart: unless-stopped
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3003/ping"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
+      disable: false
 
   immich-redis:
-    image: redis:6.2-alpine
+    image: valkey/valkey:9
 
     volumes:
       - immich-redis-data:/data
     healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
+      test: redis-cli ping || exit 1
       interval: 10s
       timeout: 5s
       retries: 5
     restart: unless-stopped
 
   immich-database:
-    image: tensorchord/pgvecto-rs:pg14-v0.3.0
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
 
     volumes:
       - immich-postgres:/var/lib/postgresql/data
     environment:
       POSTGRES_PASSWORD: ${DB_PASSWORD}
       POSTGRES_USER: ${DB_USERNAME}
-      POSTGRES_DB: immich
+      POSTGRES_DB: ${DB_DATABASE_NAME}
       POSTGRES_INITDB_ARGS: '--data-checksums'
+    shm_size: 128mb
     healthcheck:
-      test: pg_isready -U ${DB_USERNAME} -d immich || exit 1
+      test: pg_isready -U ${DB_USERNAME} -d ${DB_DATABASE_NAME} || exit 1
       interval: 10s
       timeout: 5s
       retries: 5
-    command:
-      [
-        'postgres',
-        '-c',
-        'shared_preload_libraries=vectors.so',
-        '-c',
-        'search_path="$$user", public, vectors',
-        '-c',
-        'logging_collector=on',
-        '-c',
-        'max_wal_size=2GB',
-        '-c',
-        'shared_buffers=512MB',
-        '-c',
-        'wal_compression=on',
-      ]
     restart: unless-stopped
 
 volumes:

blueprints/immich/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "immich",
   "name": "Immich",
-  "version": "v1.121.0",
+  "version": "v3.0.2",
   "description": "High performance self-hosted photo and video backup solution directly from your mobile phone.",
   "logo": "immich.svg",
   "links": {

blueprints/immich/template.toml

@@ -5,9 +5,6 @@ db_user = "immich"
 
 [config]
 env = [
-  "IMMICH_HOST=${main_domain}",
-  "SERVER_URL=https://${main_domain}",
-  "FRONT_BASE_URL=https://${main_domain}",
   "DB_HOSTNAME=immich-database",
   "DB_PORT=5432",
   "DB_USERNAME=${db_user}",

blueprints/infisical/docker-compose.yml

@@ -1,58 +1,29 @@
 services:
-  db-migration:
-    depends_on:
-      db:
-        condition: service_healthy
-    image: infisical/infisical:v0.135.0-postgres
-    environment:
-      - NODE_ENV=production
-      - ENCRYPTION_KEY
-      - AUTH_SECRET
-      - SITE_URL
-      - DB_CONNECTION_URI=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
-      - REDIS_URL=redis://redis:6379
-      - SMTP_HOST
-      - SMTP_PORT
-      - SMTP_FROM_NAME
-      - SMTP_USERNAME
-      - SMTP_PASSWORD
-      - SMTP_SECURE=true
-    command: npm run migration:latest
-    pull_policy: always
-
   backend:
+    image: infisical/infisical:v0.162.6
     restart: unless-stopped
     depends_on:
       db:
         condition: service_healthy
       redis:
         condition: service_started
-      db-migration:
-        condition: service_completed_successfully
-    image: infisical/infisical:v0.135.0-postgres
-    pull_policy: always
     environment:
       - NODE_ENV=production
-      - ENCRYPTION_KEY
-      - AUTH_SECRET
-      - SITE_URL
+      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
+      - AUTH_SECRET=${AUTH_SECRET}
+      - SITE_URL=${SITE_URL}
       - DB_CONNECTION_URI=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
       - REDIS_URL=redis://redis:6379
-      - SMTP_HOST
-      - SMTP_PORT
-      - SMTP_FROM_NAME
-      - SMTP_USERNAME
-      - SMTP_PASSWORD
-      - SMTP_SECURE=true
-
+      - SMTP_HOST=${SMTP_HOST}
+      - SMTP_PORT=${SMTP_PORT}
+      - SMTP_FROM_ADDRESS=${SMTP_FROM_ADDRESS}
+      - SMTP_FROM_NAME=${SMTP_FROM_NAME}
+      - SMTP_USERNAME=${SMTP_USERNAME}
+      - SMTP_PASSWORD=${SMTP_PASSWORD}
 
   redis:
     image: redis:7.4.1
-    env_file: .env
     restart: always
-    environment:
-      - ALLOW_EMPTY_PASSWORD=yes
-
     volumes:
       - redis_infisical_data:/data
 
@@ -60,12 +31,11 @@ services:
     image: postgres:14-alpine
     restart: always
     environment:
-      - POSTGRES_PASSWORD
-      - POSTGRES_USER
-      - POSTGRES_DB
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_DB=${POSTGRES_DB}
     volumes:
       - pg_infisical_data:/var/lib/postgresql/data
-
     healthcheck:
       test: "pg_isready --username=${POSTGRES_USER} && psql --username=${POSTGRES_USER} --list"
       interval: 5s
@@ -75,6 +45,3 @@ services:
 volumes:
   pg_infisical_data:
   redis_infisical_data:
-
-
-

blueprints/infisical/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "infisical",
   "name": "Infisical",
-  "version": "0.135.0",
+  "version": "0.162.6",
   "description": "All-in-one platform to securely manage application configuration and secrets across your team and infrastructure.",
   "logo": "infisical.jpg",
   "links": {

blueprints/infisical/template.toml

@@ -3,56 +3,27 @@ main_domain = "${domain}"
 postgres_password = "${password}"
 postgres_user = "infisical"
 postgres_db = "infisical"
+encryption_key = "${hash:32}"
+auth_secret = "${base64:32}"
 
 [config]
 env = [
-  "ENCRYPTION_KEY=6c1fe4e407b8911c104518103505b218",
-  "AUTH_SECRET=5lrMXKKWCVocS/uerPsl7V+TX/aaUaI7iDkgl3tSmLE=",
+  "ENCRYPTION_KEY=${encryption_key}",
+  "AUTH_SECRET=${auth_secret}",
   "POSTGRES_PASSWORD=${postgres_password}",
   "POSTGRES_USER=${postgres_user}",
   "POSTGRES_DB=${postgres_db}",
-  "SITE_URL=http://${main_domain}:8080",
+  "SITE_URL=http://${main_domain}",
   "SMTP_HOST=",
-  "SMTP_PORT=",
-  "SMTP_NAME=",
+  "SMTP_PORT=587",
+  "SMTP_FROM_ADDRESS=",
+  "SMTP_FROM_NAME=Infisical",
   "SMTP_USERNAME=",
   "SMTP_PASSWORD=",
-  "CLIENT_ID_HEROKU=",
-  "CLIENT_ID_VERCEL=",
-  "CLIENT_ID_NETLIFY=",
-  "CLIENT_ID_GITHUB=",
-  "CLIENT_ID_GITHUB_APP=",
-  "CLIENT_SLUG_GITHUB_APP=",
-  "CLIENT_ID_GITLAB=",
-  "CLIENT_ID_BITBUCKET=",
-  "CLIENT_SECRET_HEROKU=",
-  "CLIENT_SECRET_VERCEL=",
-  "CLIENT_SECRET_NETLIFY=",
-  "CLIENT_SECRET_GITHUB=",
-  "CLIENT_SECRET_GITHUB_APP=",
-  "CLIENT_SECRET_GITLAB=",
-  "CLIENT_SECRET_BITBUCKET=",
-  "CLIENT_SLUG_VERCEL=",
-  "CLIENT_PRIVATE_KEY_GITHUB_APP=",
-  "CLIENT_APP_ID_GITHUB_APP=",
-  "SENTRY_DSN=",
-  "POSTHOG_HOST=",
-  "POSTHOG_PROJECT_API_KEY=",
-  "CLIENT_ID_GOOGLE_LOGIN=",
-  "CLIENT_SECRET_GOOGLE_LOGIN=",
-  "CLIENT_ID_GITHUB_LOGIN=",
-  "CLIENT_SECRET_GITHUB_LOGIN=",
-  "CLIENT_ID_GITLAB_LOGIN=",
-  "CLIENT_SECRET_GITLAB_LOGIN=",
-  "CAPTCHA_SECRET=",
-  "NEXT_PUBLIC_CAPTCHA_SITE_KEY=",
-  "PLAIN_API_KEY=",
-  "PLAIN_WISH_LABEL_IDS=",
-  "SSL_CLIENT_CERTIFICATE_HEADER_KEY=",
 ]
 mounts = []
 
 [[config.domains]]
 serviceName = "backend"
-port = 8_080
+port = 8080
 host = "${main_domain}"

blueprints/kener/docker-compose.yml

@@ -1,39 +1,35 @@
-version: "3.8"
-
 services:
   kener:
     image: rajnandan1/kener:latest
     environment:
       - TZ=${TZ}
       - KENER_SECRET_KEY=${KENER_SECRET_KEY} # 🔐 API key / secret
+      - ORIGIN=${ORIGIN}
+      - REDIS_URL=${REDIS_URL}
       - DATABASE_URL=${DATABASE_URL}
       - KENER_BASE_PATH=${KENER_BASE_PATH}
-      - ORIGIN=${ORIGIN}
       - RESEND_API_KEY=${RESEND_API_KEY} # 🔐 API key
       - RESEND_SENDER_EMAIL=${RESEND_SENDER_EMAIL}
     ports:
       - 3000
     volumes:
       - kener_db:/app/database
-      - ../files/uploads:/app/uploads
+    depends_on:
+      redis:
+        condition: service_healthy
     restart: unless-stopped
 
-  postgres:
-    image: postgres:alpine
-    environment:
-      - POSTGRES_USER=${POSTGRES_USER}
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD} # 🔐 DB password
-      - POSTGRES_DB=${POSTGRES_DB}
-    restart: unless-stopped
-
-  mysql:
-    image: mariadb:11
-    environment:
-      - MYSQL_USER=${MYSQL_USER}
-      - MYSQL_PASSWORD=${MYSQL_PASSWORD} # 🔐 DB password
-      - MYSQL_DATABASE=${MYSQL_DATABASE}
-      - MYSQL_RANDOM_ROOT_PASSWORD=true
+  redis:
+    image: redis:7-alpine
+    volumes:
+      - kener_redis:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
     restart: unless-stopped
 
 volumes:
   kener_db: {}
+  kener_redis: {}

blueprints/kener/template.toml

@@ -1,8 +1,6 @@
 [variables]
 main_domain = "${domain}"
 KENER_SECRET_KEY = "${password:64}"
-POSTGRES_PASSWORD = "${password:32}"
-MYSQL_PASSWORD = "${password:32}"
 
 [config]
 [[config.domains]]
@@ -13,25 +11,9 @@ host = "${main_domain}"
 [config.env]
 TZ = "Etc/UTC"
 KENER_SECRET_KEY = "${KENER_SECRET_KEY}" # 🔐 API key / secret
+ORIGIN = "https://${main_domain}"
+REDIS_URL = "redis://redis:6379"
 DATABASE_URL = "sqlite://./database/kener.sqlite.db"
 KENER_BASE_PATH = ""
-ORIGIN = "http://localhost:3000"
 RESEND_API_KEY = ""
 RESEND_SENDER_EMAIL = "Accounts <accounts@resend.dev>"
-POSTGRES_USER = "user"
-POSTGRES_DB = "kener_db"
-MYSQL_USER = "user"
-MYSQL_DATABASE = "kener_db"
-MYSQL_RANDOM_ROOT_PASSWORD = "true"
-MYSQL_PASSWORD = "${MYSQL_PASSWORD}" # 🔐 DB password
-POSTGRES_PASSWORD = "${POSTGRES_PASSWORD}" # 🔐 DB password
-
-[[config.mounts]]
-type = "volume"
-source = "kener_db"
-target = "/app/database"
-
-[[config.mounts]]
-type = "bind"
-source = "../files/uploads"
-target = "/app/uploads"

blueprints/logto/docker-compose.yml

@@ -1,14 +1,11 @@
 services:
   app:
+    image: ghcr.io/logto-io/logto:1.41.0
+    restart: unless-stopped
     depends_on:
       postgres:
         condition: service_healthy
-    image: ghcr.io/logto-io/logto:1.27.0
     entrypoint: ["sh", "-c", "npm run cli db seed -- --swe && npm start"]
-    ports:
-      - 3001
-      - 3002
-
     environment:
       TRUST_PROXY_HEADER: 1
       DB_URL: postgres://logto:${LOGTO_POSTGRES_PASSWORD}@postgres:5432/logto
@@ -18,20 +15,19 @@ services:
       - logto-connectors:/etc/logto/packages/core/connectors
   postgres:
     image: postgres:17-alpine
-    user: postgres
-
+    restart: unless-stopped
     environment:
       POSTGRES_USER: logto
       POSTGRES_PASSWORD: ${LOGTO_POSTGRES_PASSWORD}
+      POSTGRES_DB: logto
     volumes:
       - postgres-data:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready"]
+      test: ["CMD-SHELL", "pg_isready -U logto -d logto"]
       interval: 10s
       timeout: 5s
       retries: 5
 
-
 volumes:
   logto-connectors:
   postgres-data:

blueprints/logto/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "logto",
   "name": "Logto",
-  "version": "1.27.0",
+  "version": "1.41.0",
   "description": "Logto is an open-source Identity and Access Management (IAM) platform designed to streamline Customer Identity and Access Management (CIAM) and Workforce Identity Management.",
   "logo": "logto.png",
   "links": {

blueprints/logto/template.toml

@@ -1,7 +1,7 @@
 [variables]
 main_domain = "${domain}"
 admin_domain = "${domain}"
-postgres_password = "${password}"
+postgres_password = "${password:32}"
 
 [config]
 mounts = []
@@ -17,6 +17,6 @@ port = 3_002
 host = "${admin_domain}"
 
 [config.env]
-LOGTO_ENDPOINT = "http://${admin_domain}"
+LOGTO_ENDPOINT = "http://${main_domain}"
 LOGTO_ADMIN_ENDPOINT = "http://${admin_domain}"
 LOGTO_POSTGRES_PASSWORD = "${postgres_password}"

blueprints/markup/docker-compose.yml

@@ -0,0 +1,39 @@
+version: "3.8"
+
+services:
+  db:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    volumes:
+      - markup-postgres-data:/var/lib/postgresql/data
+    environment:
+      POSTGRES_USER: markup
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: markup
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U markup -d markup"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  markup:
+    image: ghcr.io/pphilfre/markup:main
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      DATABASE_URL: ${DATABASE_URL}
+      NEXT_PUBLIC_DB_PROVIDER: postgres
+      NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL}
+      # WorkOS AuthKit (optional): required only for user accounts and cloud sync.
+      # Placeholders keep the app running; replace them with real credentials
+      # from https://dashboard.workos.com to enable sign-in.
+      WORKOS_CLIENT_ID: ${WORKOS_CLIENT_ID}
+      WORKOS_API_KEY: ${WORKOS_API_KEY}
+      WORKOS_COOKIE_PASSWORD: ${WORKOS_COOKIE_PASSWORD}
+      NEXT_PUBLIC_WORKOS_REDIRECT_URI: ${NEXT_PUBLIC_WORKOS_REDIRECT_URI}
+      NODE_ENV: production
+
+volumes:
+  markup-postgres-data:

blueprints/markup/markup.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" fill="none">
+  <rect width="100" height="100" rx="20" fill="#0a0a0a"/>
+  <text x="50" y="68" text-anchor="middle" font-family="system-ui, -apple-system, sans-serif" font-weight="700" font-size="48" fill="#7c3aed">M</text>
+  <rect x="22" y="76" width="56" height="3" rx="1.5" fill="#7c3aed" opacity="0.5"/>
+</svg>

blueprints/markup/meta.json

@@ -0,0 +1,18 @@
+{
+  "id": "markup",
+  "name": "Markup",
+  "version": "main",
+  "description": "Markup is a fast, keyboard-first markdown workspace with live preview, graph view, whiteboards, mind maps, and PostgreSQL-powered cloud sync.",
+  "logo": "markup.svg",
+  "links": {
+    "github": "https://github.com/pphilfre/markup",
+    "website": "https://home.markup.freddiephilpot.dev/",
+    "docs": "https://docs.markup.freddiephilpot.dev/"
+  },
+  "tags": [
+    "markdown",
+    "notes",
+    "editor",
+    "self-hosted"
+  ]
+}

blueprints/markup/template.toml

@@ -0,0 +1,25 @@
+[variables]
+main_domain = "${domain}"
+postgres_password = "${password:32}"
+cookie_password = "${password:32}"
+
+[config]
+env = [
+  "POSTGRES_PASSWORD=${postgres_password}",
+  "DATABASE_URL=postgresql://markup:${postgres_password}@db:5432/markup",
+  "NEXT_PUBLIC_SITE_URL=https://${main_domain}",
+  "# WorkOS AuthKit is optional: it powers user accounts and cloud sync.",
+  "# The app works without it (local, in-browser storage). To enable sign-in,",
+  "# create an app at https://dashboard.workos.com, set the redirect URI below",
+  "# in the WorkOS dashboard, and replace the placeholder credentials.",
+  "WORKOS_CLIENT_ID=client_id_change_me",
+  "WORKOS_API_KEY=sk_change_me",
+  "WORKOS_COOKIE_PASSWORD=${cookie_password}",
+  "NEXT_PUBLIC_WORKOS_REDIRECT_URI=https://${main_domain}/callback",
+]
+mounts = []
+
+[[config.domains]]
+serviceName = "markup"
+port = 3000
+host = "${main_domain}"

blueprints/openpanel/docker-compose.yml

@@ -54,7 +54,7 @@ services:
       retries: 5
 
   op-api:
-    image: lindesvard/openpanel-api:2
+    image: lindesvard/openpanel-api:2.2.1
     restart: always
     command: >
       sh -c "
@@ -97,7 +97,7 @@ services:
         condition: service_healthy
 
   op-dashboard:
-    image: lindesvard/openpanel-dashboard:2
+    image: lindesvard/openpanel-dashboard:2.2.1
     restart: always
     depends_on:
       op-api:
@@ -111,7 +111,7 @@ services:
       retries: 5
 
   op-worker:
-    image: lindesvard/openpanel-worker:2
+    image: lindesvard/openpanel-worker:2.2.1
     restart: always
     depends_on:
       op-api:

blueprints/openpanel/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "openpanel",
   "name": "OpenPanel",
-  "version": "latest",
+  "version": "2.2.1",
   "description": "An open-source web and product analytics platform that combines the power of Mixpanel with the ease of Plausible and one of the best Google Analytics replacements.",
   "logo": "logo.svg",
   "links": {

blueprints/openpanel/template.toml

@@ -26,7 +26,7 @@ content = """
     <part_log remove="remove"/>
     <listen_host>0.0.0.0</listen_host>
     <interserver_listen_host>0.0.0.0</interserver_listen_host>
-    <interserver_http_host>opch</interserver_http_host>
+    <interserver_http_host>op-ch</interserver_http_host>
     <!-- Disable cgroup memory observer -->
     <cgroups_memory_usage_observer_wait_time>0</cgroups_memory_usage_observer_wait_time>
     <!-- Not used anymore, but kept for backwards compatibility -->

blueprints/oryx/docker-compose.yml

@@ -0,0 +1,18 @@
+version: "3.8"
+services:
+  oryx:
+    image: ossrs/oryx:5.15.20
+    restart: unless-stopped
+    ports:
+      # RTMP, WebRTC and SRT are not HTTP protocols, so Traefik cannot route
+      # them through the domain. They must be published directly on the host
+      # (same approach as the poste.io template with its mail ports). Use the
+      # server IP (not the domain) for these protocols.
+      - "1935:1935" # RTMP ingest/playback (TCP)
+      - "8000:8000/udp" # WebRTC media transport (UDP)
+      - "10080:10080/udp" # SRT ingest/playback (UDP)
+    volumes:
+      - oryx-data:/data
+
+volumes:
+  oryx-data: {}

blueprints/oryx/instructions.md

@@ -0,0 +1,29 @@
+# Oryx (SRS Stack)
+
+Oryx is an all-in-one video streaming server built on [SRS](https://github.com/ossrs/srs), with a web console for managing streams, recording, forwarding, transcoding and virtual live streaming.
+
+## First login
+
+Open the domain assigned to this service. On the first visit Oryx asks you to **create the admin password** — set it right away, since anyone who reaches the page first can claim the instance. The password (and all other state) is stored in the `oryx-data` volume, so it survives restarts and upgrades.
+
+## Publishing streams
+
+The web console (Scenarios > Streaming) shows ready-to-copy URLs that include your stream secret. The streaming protocols are **not HTTP**, so Traefik cannot route them through your domain — they are published directly on the server's host ports instead. Use the **server IP address** (not the domain) for these:
+
+| Protocol | URL format | Host port |
+| --- | --- | --- |
+| RTMP (OBS, ffmpeg) | `rtmp://SERVER_IP/live/livestream?secret=xxx` | `1935/tcp` |
+| SRT | `srt://SERVER_IP:10080?streamid=#!::r=live/livestream,secret=xxx,m=publish` | `10080/udp` |
+| WebRTC (WHIP) | `https://your-domain/rtc/v1/whip/?app=live&stream=livestream&secret=xxx` | signaling via domain, media via `8000/udp` |
+
+Make sure your server firewall / cloud security group allows `1935/tcp`, `8000/udp` and `10080/udp`. Because these are fixed host ports, only one Oryx instance can run per server.
+
+## Playback
+
+HTTP-based playback goes through your domain (HTTPS via Traefik):
+
+- HLS: `https://your-domain/live/livestream.m3u8`
+- HTTP-FLV: `https://your-domain/live/livestream.flv`
+- WebRTC (WHEP): available from the console's preview page; media flows over `8000/udp`.
+
+If WebRTC playback or publishing connects but produces no media, verify that UDP port `8000` is reachable from the client — WebRTC media bypasses the reverse proxy entirely.

blueprints/oryx/logo.svg

@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="utf-8"?>
+<svg viewBox="0 0 64 32" height="32px" width="64px" id="svg2" version="1.1" xmlns="http://www.w3.org/2000/svg">
+    <defs id="defs6">
+        <linearGradient id="linearGradient28" spreadMethod="pad" gradientTransform="matrix(148.91527,0,0,-148.91527,151.81076,224.17897)" gradientUnits="userSpaceOnUse" y2="0" x2="1" y1="0" x1="0">
+            <stop id="stop24" offset="0" style="stop-opacity:1;stop-color:#3caae1"/>
+            <stop id="stop26" offset="1" style="stop-opacity:1;stop-color:#b65c9e"/>
+        </linearGradient>
+        <linearGradient id="linearGradient48" spreadMethod="pad" gradientTransform="matrix(155.05911,0,0,-155.05911,49.431911,216.24139)" gradientUnits="userSpaceOnUse" y2="0" x2="1" y1="0" x1="0">
+            <stop id="stop44" offset="0" style="stop-opacity:1;stop-color:#2ca0d4"/>
+            <stop id="stop46" offset="1" style="stop-opacity:1;stop-color:#305ba7"/>
+        </linearGradient>
+        <clipPath id="clipPath58" clipPathUnits="userSpaceOnUse">
+            <path id="path56" d="M 0,350.158 H 350.158 V 0 H 0 Z"/>
+        </clipPath>
+    </defs>
+    <g transform="matrix(0.172146, 0, 0, -0.188192, -9.741413, 53.288761)" id="g10" style="">
+        <g id="g12" style="" transform="matrix(0.654687, 0, 0, 0.654687, 47.49966, 55.96529)">
+            <g id="g14">
+                <g id="g20">
+                    <g id="g22">
+                        <path id="path30" style="fill:url(#linearGradient28);stroke:none" d="m 151.811,280.659 54.062,-54.064 14.238,14.586 c 13.253,11.772 33.681,8.665 42.764,-6.48 v 0 c 6.949,-11.585 4.152,-27.659 -6.248,-35.919 v 0 c -11.647,-9.249 -27.453,-8.66 -37.707,1.501 v 0 c -8.318,8.241 -16.529,16.588 -24.814,24.861 v 0 c -13.578,13.558 -26.814,27.483 -40.842,40.56 v 0 c -0.155,0.144 -0.318,0.269 -0.474,0.412 v 0 c 1.246,-1.658 40.823,-54.57 51.701,-97.422 v 0 c 14.746,-10.175 31.762,-12.852 50.25,-8.006 v 0 c 35.557,9.319 55.709,47.52 41.276,82.815 v 0 c -9.385,22.952 -27.32,35.949 -52.141,38.356 v 0 c -15.155,1.471 -27.697,-2.422 -38.597,-9.506 v 0 l -8.305,8.306 c -6.236,6.235 -14.409,9.353 -22.581,9.353 v 0 c -8.173,0 -16.346,-3.118 -22.582,-9.353"/>
+                    </g>
+                </g>
+            </g>
+        </g>
+        <g id="g32" style="" transform="matrix(0.653075, 0, 0, 0.653075, 48.56073, 55.406696)">
+            <g id="g34">
+                <g id="g40">
+                    <g id="g42">
+                        <path id="path50" style="fill:url(#linearGradient48);stroke:none" d="m 50.99,234 c -1.85,-8.185 -1.733,-14.379 -1.264,-20.194 v 0 c 2.822,-30.213 29.126,-54.494 59.465,-55.353 v 0 c 13.788,-0.391 25.237,3.439 35.23,9.815 v 0 l 8.671,-8.669 c 12.471,-12.471 32.691,-12.471 45.163,0 v 0 l -52.152,52.151 c -0.639,0.65 -1.262,1.284 -1.904,1.935 v 0 c -4.061,-4.127 -8.071,-8.229 -12.109,-12.304 v 0 c -7.927,-8.003 -17.355,-11.004 -28.326,-8.029 v 0 C 92.462,196.418 84.207,206.453 83.4,217.68 v 0 c -0.881,12.257 5.312,23.099 16.04,28.075 v 0 c 10.826,5.024 23.504,2.646 32.091,-5.942 v 0 c 21.291,-21.289 42.367,-42.8 63.987,-63.751 v 0 c 2.884,-2.793 5.882,-5.235 8.973,-7.368 v 0 c -16.324,63.52 -50.455,95.764 -51.701,97.422 v 0 c -12.077,11.041 -26.76,16.121 -41.224,16.121 v 0 C 84.3,282.238 57.808,264.189 50.99,234"/>
+                    </g>
+                </g>
+            </g>
+        </g>
+        <g id="g52" style="" transform="matrix(0.797304, 0, 0, 0.797304, 194.474228, 136.918259)">
+            <g clip-path="url(#clipPath58)" id="g54">
+                <g transform="translate(126.2779,90.4397)" id="g60">
+                    <path id="path62" style="fill:#494545;fill-opacity:1;fill-rule:nonzero;stroke:none" d="m 0,0 h -19.449 c -3.396,0.381 -5.093,2.049 -5.093,5.005 l 0.132,0.879 c 0.731,2.487 2.385,3.731 4.961,3.731 H 5.357 c 1.2,0 2.327,0.16 3.381,0.484 4.479,1.843 6.717,5.005 6.717,9.483 0,0.233 -0.073,0.351 -0.219,0.351 h -35.783 c -2.458,0 -5.034,-0.776 -7.727,-2.328 -4.419,-3.453 -6.629,-7.361 -6.629,-11.721 0,-2.167 0.337,-4.289 1.009,-6.366 2.752,-6.586 8.109,-9.879 16.069,-9.879 h 18.09 c 3.395,-0.352 5.092,-2.005 5.092,-4.961 L 5.226,-16.2 c -0.732,-2.488 -2.387,-3.732 -4.961,-3.732 h -24.807 c -1.199,0 -2.326,-0.175 -3.381,-0.527 -4.477,-1.815 -6.717,-4.962 -6.717,-9.439 0,-0.264 0.074,-0.396 0.22,-0.396 H 1.362 c 2.458,0 5.034,0.79 7.728,2.371 4.419,3.453 6.629,7.361 6.629,11.723 0,2.371 -0.337,4.404 -1.011,6.102 C 12.075,-3.365 7.172,0 0,0"/>
+                </g>
+                <g transform="translate(257.773,80.342)" id="g64">
+                    <path id="path66" style="fill:#494545;fill-opacity:1;fill-rule:nonzero;stroke:none" d="m 0,0 c -2.633,6.732 -7.536,10.098 -14.708,10.098 h -19.449 c -3.396,0.381 -5.093,2.048 -5.093,5.005 l 0.131,0.878 c 0.732,2.488 2.386,3.732 4.962,3.732 h 24.805 c 1.201,0 2.328,0.16 3.381,0.483 4.48,1.844 6.717,5.005 6.717,9.484 0,0.233 -0.072,0.35 -0.218,0.35 h -35.783 c -2.458,0 -5.035,-0.775 -7.727,-2.327 -4.419,-3.453 -6.63,-7.361 -6.63,-11.722 0,-2.167 0.337,-4.289 1.01,-6.366 2.751,-6.586 8.108,-9.879 16.069,-9.879 h 18.089 c 3.395,-0.351 5.092,-2.005 5.092,-4.961 l -0.13,-0.878 c -0.733,-2.488 -2.387,-3.731 -4.962,-3.731 H -39.25 c -1.2,0 -2.327,-0.176 -3.381,-0.527 -4.477,-1.816 -6.717,-4.962 -6.717,-9.44 0,-0.263 0.073,-0.395 0.22,-0.395 h 35.781 c 2.459,0 5.035,0.79 7.728,2.371 4.419,3.453 6.63,7.361 6.63,11.722 C 1.011,-3.731 0.674,-1.698 0,0"/>
+                </g>
+                <g transform="translate(160.6578,100.5822)" id="g68">
+                    <path id="path70" style="fill:#494545;fill-opacity:1;fill-rule:nonzero;stroke:none" d="m 0,0 h 7.033 v 5.847 c 0,1.153 0.634,2.204 1.654,2.741 1.021,0.537 2.245,0.467 3.195,-0.185 L 20.445,2.54 C 21.284,1.965 21.787,1.017 21.791,0 h 2.004 c 2.986,0 4.77,-1.713 5.356,-5.138 L 29.02,-5.839 c -0.674,-3.015 -2.416,-4.523 -5.225,-4.523 H 0 Z m 23.531,-20.108 c 2.518,0 5.182,0.834 7.991,2.503 4.594,3.306 6.894,7.507 6.894,12.6 0,4.126 -1.626,7.815 -4.874,11.064 -3.103,2.545 -5.956,3.82 -8.562,3.82 H -9.528 l -0.22,-0.265 v -49.217 l 0.133,-0.13 c 2.048,0 3.832,0.482 5.356,1.448 2.838,2.107 4.259,4.317 4.259,6.63 v 20.722 l 26.648,-26.518 c 1.288,-1.99 3.66,-2.986 7.114,-2.986 3.891,0.235 5.84,0.908 5.84,2.02 v 0.22 c 0,0.146 -5.944,6.176 -17.826,18.089 z"/>
+                </g>
+                <g transform="translate(180.5738,101.9846)" id="g72">
+                    <path id="path74" style="fill:#494545;fill-opacity:1;fill-rule:nonzero;stroke:none" d="m 0,0 -8.563,5.863 c -0.323,0.222 -0.688,0.333 -1.055,0.333 -0.299,0 -0.598,-0.072 -0.878,-0.22 -0.627,-0.33 -1,-0.95 -1,-1.659 V -7.41 c 0,-0.708 0.373,-1.327 1,-1.657 0.627,-0.332 1.349,-0.289 1.933,0.111 L 0,-3.092 c 0.518,0.354 0.815,0.918 0.815,1.545 C 0.815,-0.918 0.518,-0.354 0,0"/>
+                </g>
+            </g>
+        </g>
+    </g>
+</svg>

blueprints/oryx/meta.json

@@ -0,0 +1,22 @@
+{
+  "id": "oryx",
+  "name": "Oryx",
+  "version": "5.15.20",
+  "description": "Oryx (formerly SRS Stack) is an all-in-one, open-source video streaming server with a web console. It ingests RTMP, WebRTC (WHIP) and SRT streams and plays them back over HLS, HTTP-FLV and WebRTC (WHEP), with built-in recording, forwarding, transcoding and virtual live streaming.",
+  "logo": "logo.svg",
+  "links": {
+    "github": "https://github.com/ossrs/oryx",
+    "website": "https://ossrs.io/",
+    "docs": "https://ossrs.io/lts/en-us/docs/v6/doc/getting-started-oryx",
+    "docker": "https://hub.docker.com/r/ossrs/oryx"
+  },
+  "tags": [
+    "streaming",
+    "video",
+    "rtmp",
+    "webrtc",
+    "srt",
+    "hls",
+    "media-server"
+  ]
+}

blueprints/oryx/template.toml

@@ -0,0 +1,8 @@
+[variables]
+main_domain = "${domain}"
+
+[config]
+[[config.domains]]
+serviceName = "oryx"
+port = 2022
+host = "${main_domain}"

blueprints/phpmyadmin/docker-compose.yml

@@ -5,7 +5,7 @@ services:
     image: mysql:5.7
     environment:
       MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
-      MYSQL_DATABASE: tu_base_de_datos
+      MYSQL_DATABASE: ${MYSQL_DATABASE}
       MYSQL_USER: ${MYSQL_USER}
       MYSQL_PASSWORD: ${MYSQL_PASSWORD}
     volumes:
@@ -19,6 +19,8 @@ services:
       PMA_USER: ${MYSQL_USER}
       PMA_PASSWORD: ${MYSQL_PASSWORD}
       PMA_ARBITRARY: 1
+      UPLOAD_LIMIT: ${UPLOAD_LIMIT}
+      MAX_EXECUTION_TIME: ${MAX_EXECUTION_TIME}
     depends_on:
       - db
 

blueprints/phpmyadmin/template.toml

@@ -13,6 +13,8 @@ host = "${main_domain}"
 
 [config.env]
 MYSQL_ROOT_PASSWORD = "${root_password}"
-MYSQL_DATABASE = "mysql"
+MYSQL_DATABASE = "phpmyadmin"
 MYSQL_USER = "phpmyadmin"
 MYSQL_PASSWORD = "${user_password}"
+UPLOAD_LIMIT = "512M"
+MAX_EXECUTION_TIME = "600"

blueprints/rybbit/docker-compose.yml

@@ -1,13 +1,13 @@
 # https://www.rybbit.io/docs/self-hosting-advanced
 
 # NOTE: there are two sample HTTP traefik domain entries created:
-# - rybbit_backend (port 3001, path /api), 
+# - rybbit_backend (port 3001, path /api),
 # - rybbit_client (port 3002, path /)
 #
 # You should treat these as placeholders - Rybbit only supports HTTPS.
 #
-# You should also update the `BASE_URL`, and `DOMAIN_NAME` environment
-# variable when updating the domain entries with your custom domain.
+# You should also update the `BASE_URL` environment variable when
+# updating the domain entries with your custom domain.
 
 services:
   rybbit_clickhouse:
@@ -50,8 +50,41 @@ services:
       retries: 3
     restart: unless-stopped
 
+  rybbit_redis:
+    image: redis:7-alpine
+    volumes:
+      - redis_data:/data
+    # Backs session tracking and the BullMQ queues. noeviction is required by
+    # BullMQ (evicting job keys corrupts queues); AOF (everysec) keeps queues
+    # durable across restarts.
+    command:
+      - redis-server
+      - --requirepass
+      - ${REDIS_PASSWORD}
+      - --appendonly
+      - "yes"
+      - --appendfsync
+      - everysec
+      - --maxmemory-policy
+      - noeviction
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "redis-cli",
+          "-a",
+          "${REDIS_PASSWORD}",
+          "--no-auth-warning",
+          "ping",
+        ]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 5s
+    restart: unless-stopped
+
   rybbit_backend:
-    image: ghcr.io/rybbit-io/rybbit-backend:v1.5.1
+    image: ghcr.io/rybbit-io/rybbit-backend:v2.7.0
     environment:
       - NODE_ENV=production
       - CLICKHOUSE_HOST=http://rybbit_clickhouse:8123
@@ -63,15 +96,20 @@ services:
       - POSTGRES_DB=${POSTGRES_DB}
       - POSTGRES_USER=${POSTGRES_USER}
       - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - REDIS_HOST=rybbit_redis
+      - REDIS_PORT=6379
+      - REDIS_PASSWORD=${REDIS_PASSWORD}
       - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET}
       - BASE_URL=${BASE_URL}
-      - DOMAIN_NAME=${DOMAIN_NAME}
       - DISABLE_SIGNUP=${DISABLE_SIGNUP}
+      - DISABLE_TELEMETRY=${DISABLE_TELEMETRY}
     depends_on:
       rybbit_clickhouse:
         condition: service_healthy
       rybbit_postgres:
         condition: service_started
+      rybbit_redis:
+        condition: service_healthy
     healthcheck:
       test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:3001/api/health"]
       interval: 30s
@@ -81,11 +119,10 @@ services:
     restart: unless-stopped
 
   rybbit_client:
-    image: ghcr.io/rybbit-io/rybbit-client:v1.5.1
+    image: ghcr.io/rybbit-io/rybbit-client:v2.7.0
     environment:
       - NODE_ENV=production
       - NEXT_PUBLIC_BACKEND_URL=${BASE_URL}
-      - DOMAIN_NAME=${DOMAIN_NAME}
       - NEXT_PUBLIC_DISABLE_SIGNUP=${DISABLE_SIGNUP}
     depends_on:
       - rybbit_backend
@@ -94,3 +131,4 @@ services:
 volumes:
   clickhouse_data:
   postgres_data:
+  redis_data:

blueprints/rybbit/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "rybbit",
   "name": "Rybbit",
-  "version": "v1.5.1",
+  "version": "v2.7.0",
   "description": "Open-source and privacy-friendly alternative to Google Analytics that is 10x more intuitive",
   "logo": "rybbit.png",
   "links": {

blueprints/rybbit/template.toml

@@ -1,8 +1,9 @@
 [variables]
 main_domain = "${domain}"
-better_auth_secret = "${password:32}"
+better_auth_secret = "${base64:32}"
 clickhouse_password = "${password:32}"
 postgres_password = "${password:32}"
+redis_password = "${password:32}"
 
 [[config.domains]]
 serviceName = "rybbit_backend"
@@ -17,15 +18,16 @@ host = "${main_domain}"
 
 [config.env]
 BASE_URL = "http://${main_domain}"
-DOMAIN_NAME= "${main_domain}"
 BETTER_AUTH_SECRET = "${better_auth_secret}"
 DISABLE_SIGNUP = "false"
+DISABLE_TELEMETRY = "false"
 CLICKHOUSE_DB = "analytics"
 CLICKHOUSE_USER = "default"
 CLICKHOUSE_PASSWORD = "${clickhouse_password}"
 POSTGRES_DB = "analytics"
 POSTGRES_USER = "frog"
 POSTGRES_PASSWORD = "${postgres_password}"
+REDIS_PASSWORD = "${redis_password}"
 
 [[config.mounts]]
 filePath = "./clickhouse_config/enable_json.xml"

blueprints/signoz/docker-compose.yml

@@ -1,6 +1,4 @@
 x-common: &common
-  networks:
-    - signoz-net
   restart: unless-stopped
   logging:
     options:
@@ -89,11 +87,12 @@ services:
       - ZOO_PROMETHEUS_METRICS_PORT_NUMBER=9141
   clickhouse:
     !!merge <<: *clickhouse-defaults
-    container_name: signoz-clickhouse
+    hostname: clickhouse
     volumes:
       - ../files/clickhouse/config.xml:/etc/clickhouse-server/config.xml
       - ../files/clickhouse/user_scripts:/var/lib/clickhouse/user_scripts/
       - ../files/clickhouse/cluster.xml:/etc/clickhouse-server/config.d/cluster.xml
+      - ../files/clickhouse/docker_related_config.xml:/etc/clickhouse-server/config.d/docker_related_config.xml
       - clickhouse:/var/lib/clickhouse/
   signoz:
     !!merge <<: *db-depend
@@ -156,9 +155,6 @@ services:
       - --dsn=tcp://clickhouse:9000
       - --up=
     restart: on-failure
-networks:
-  signoz-net:
-    name: signoz-net
 volumes:
   clickhouse:
     name: signoz-clickhouse

blueprints/signoz/template.toml

@@ -1,5 +1,6 @@
 [variables]
 main_domain = "${domain}"
+otel_domain = "${domain}"
 jwt_secret = "${password:64}"
 
 [config]
@@ -12,7 +13,7 @@ path = "/"
 [[config.domains]]
 serviceName = "otel-collector"
 port = 4318
-host = "${main_domain}"
+host = "${otel_domain}"
 path = "/"
 
 [config.env]
@@ -1246,7 +1247,23 @@ content = """
 """
 
 [[config.mounts]]
-filePath = "/signoz/prometheus.xml"
+filePath = "/clickhouse/docker_related_config.xml"
+content = """
+<?xml version="1.0"?>
+<clickhouse>
+    <!-- Overrides the docker image's default config.d/docker_related_config.xml,
+         which listens on the IPv6 wildcard address ([::]) first. On hosts without
+         IPv6 support the bind fails, so listen on IPv4 only. -->
+    <listen_host>0.0.0.0</listen_host>
+    <listen_try>1</listen_try>
+    <!-- Container IPs can change and DNS records (zookeeper-1, clickhouse) may not
+         be ready the moment ClickHouse starts. Do not cache DNS lookup failures. -->
+    <disable_internal_dns_cache>1</disable_internal_dns_cache>
+</clickhouse>
+"""
+
+[[config.mounts]]
+filePath = "/signoz/prometheus.yml"
 content = """
 # my global config
 global:

blueprints/silex/docker-compose.yml

@@ -0,0 +1,20 @@
+services:
+  silex:
+    image: silexlabs/silex:3.7.0
+    restart: unless-stopped
+    ports:
+      - 6805
+    environment:
+      - SILEX_URL=${SILEX_URL}
+      - SILEX_SESSION_SECRET=${SILEX_SESSION_SECRET}
+      - STORAGE_CONNECTORS=fs
+      - HOSTING_CONNECTORS=fs,download
+      - SILEX_FS_ROOT=/silex/silex/storage
+      - SILEX_FS_HOSTING_ROOT=/silex/silex/hosting
+    volumes:
+      - silex-storage:/silex/silex/storage
+      - silex-hosting:/silex/silex/hosting
+
+volumes:
+  silex-storage:
+  silex-hosting:

blueprints/silex/meta.json

@@ -0,0 +1,17 @@
+{
+  "id": "silex",
+  "name": "Silex",
+  "version": "3.7.0",
+  "description": "Silex is a free and open-source website builder for professional designers. It lets you create static websites visually with a drag-and-drop editor, custom CSS and JavaScript, and publish them anywhere.",
+  "logo": "logo.png",
+  "links": {
+    "github": "https://github.com/silexlabs/Silex",
+    "website": "https://www.silex.me",
+    "docs": "https://docs.silex.me"
+  },
+  "tags": [
+    "website-builder",
+    "no-code",
+    "static-site"
+  ]
+}

blueprints/silex/template.toml

@@ -0,0 +1,13 @@
+[variables]
+main_domain = "${domain}"
+session_secret = "${password:32}"
+
+[config]
+[[config.domains]]
+serviceName = "silex"
+port = 6805
+host = "${main_domain}"
+
+[config.env]
+SILEX_URL = "http://${main_domain}"
+SILEX_SESSION_SECRET = "${session_secret}"

blueprints/spacetimedb/docker-compose.yml

@@ -0,0 +1,13 @@
+version: "3.8"
+services:
+  spacetimedb:
+    image: clockworklabs/spacetime:v2.6.1
+    restart: unless-stopped
+    command: start
+    ports:
+      - 3000
+    volumes:
+      - spacetimedb-data:/home/spacetime
+
+volumes:
+  spacetimedb-data: {}

blueprints/spacetimedb/instructions.md

@@ -0,0 +1,45 @@
+# SpacetimeDB
+
+SpacetimeDB is a database and server runtime in one: your clients connect directly to the database and your application logic runs inside it as WebAssembly modules. There is no web UI — the domain assigned to this service exposes the SpacetimeDB HTTP/WebSocket API (so opening `/` in a browser returns a plain 404; that is expected).
+
+## Verify the server is running
+
+```bash
+curl -i https://your-domain.com/v1/ping
+```
+
+A `200 OK` response means the server is up.
+
+## Connect with the SpacetimeDB CLI
+
+1. Install the CLI on your local machine:
+
+   ```bash
+   curl -sSf https://install.spacetimedb.com | sh
+   ```
+
+2. Register your Dokploy instance as a server and make it the default:
+
+   ```bash
+   spacetime server add --url https://your-domain.com dokploy --default
+   ```
+
+3. Log in (or create an anonymous local identity) and publish a module:
+
+   ```bash
+   spacetime login
+   spacetime publish --server dokploy my-database
+   ```
+
+4. Check connectivity at any time:
+
+   ```bash
+   spacetime server ping dokploy
+   ```
+
+From your game or app, connect with any SpacetimeDB client SDK (Rust, C#, TypeScript) using `https://your-domain.com` as the host URI. See the [getting started guide](https://spacetimedb.com/docs/getting-started) for a full walkthrough.
+
+## Notes
+
+- All server state (databases, logs and the JWT signing keys used for identities) is persisted in the `spacetimedb-data` volume, so identities survive restarts and upgrades.
+- Client connections use WebSockets over the same domain; no extra configuration is needed.

blueprints/spacetimedb/meta.json

@@ -0,0 +1,17 @@
+{
+  "id": "spacetimedb",
+  "name": "SpacetimeDB",
+  "version": "v2.6.1",
+  "description": "SpacetimeDB is a relational database with a built-in server runtime. Clients connect directly to the database and run server-side logic (modules) inside it, making it ideal for real-time multiplayer games, chat and collaborative applications without a separate backend.",
+  "logo": "logo.png",
+  "links": {
+    "github": "https://github.com/clockworklabs/SpacetimeDB",
+    "website": "https://spacetimedb.com/",
+    "docs": "https://spacetimedb.com/docs"
+  },
+  "tags": [
+    "database",
+    "realtime",
+    "backend"
+  ]
+}

blueprints/spacetimedb/template.toml

@@ -0,0 +1,8 @@
+[variables]
+main_domain = "${domain}"
+
+[config]
+[[config.domains]]
+serviceName = "spacetimedb"
+port = 3000
+host = "${main_domain}"

blueprints/zitadel/docker-compose.yml

@@ -1,9 +1,7 @@
-version: '3.8'
-
 services:
   zitadel:
     restart: 'always'
-    image: 'ghcr.io/zitadel/zitadel:latest'
+    image: 'ghcr.io/zitadel/zitadel:v4.16.0'
     command: 'start-from-init --masterkey "${ZITADEL_MASTERKEY}" --tlsMode disabled'
     environment:
       # Database Configuration
@@ -17,33 +15,37 @@ services:
       ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: "${POSTGRES_PASSWORD}"
       ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
 
-      # External Configuration for HTTP only - TLS mode disabled
-      ZITADEL_EXTERNALSECURE: false
-      ZITADEL_EXTERNALPORT: 8080
-      ZITADEL_EXTERNALDOMAIN: "${EXTERNAL_DOMAIN}"
+      # External access configuration. These MUST match the domain configured
+      # in the Domains tab and the scheme/port it is served on, otherwise
+      # Zitadel answers {"code":5,"message":"Not Found"}.
+      # HTTP  -> ZITADEL_EXTERNALPORT=80,  ZITADEL_EXTERNALSECURE=false
+      # HTTPS -> ZITADEL_EXTERNALPORT=443, ZITADEL_EXTERNALSECURE=true
+      ZITADEL_EXTERNALDOMAIN: "${ZITADEL_EXTERNALDOMAIN}"
+      ZITADEL_EXTERNALPORT: "${ZITADEL_EXTERNALPORT}"
+      ZITADEL_EXTERNALSECURE: "${ZITADEL_EXTERNALSECURE}"
       ZITADEL_TLS_ENABLED: false
 
-      # Disable Email Notifications
-      ZITADEL_NOTIFICATIONS_SMTP_HOST: ""
-      ZITADEL_NOTIFICATIONS_SMTP_PORT: ""
-
       # Custom Admin User Configuration
       ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME: "${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME}"
       ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD: "${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD}"
       ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS: "${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS}"
       ZITADEL_FIRSTINSTANCE_ORG_HUMAN_FIRSTNAME: "${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_FIRSTNAME}"
       ZITADEL_FIRSTINSTANCE_ORG_HUMAN_LASTNAME: "${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_LASTNAME}"
-      
-      # Default Instance Features
+
+      # Use the login UI built into the API container (no extra login-v2 service needed)
       ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED: false
 
+    healthcheck:
+      test: ["CMD", "/app/zitadel", "ready"]
+      interval: '10s'
+      timeout: '30s'
+      retries: 12
+      start_period: '30s'
     depends_on:
       db:
         condition: 'service_healthy'
-    ports:
-      - '8080'
-    volumes:
-      - zitadel_data:/app/data
+    expose:
+      - 8080
 
   db:
     restart: 'always'
@@ -63,4 +65,3 @@ services:
 
 volumes:
   postgres_data:
-  zitadel_data:

blueprints/zitadel/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "zitadel",
   "name": "Zitadel",
-  "version": "latest",
+  "version": "4.16.0",
   "description": "Open-source identity and access management platform with multi-tenancy, OpenID Connect, SAML, and OAuth 2.0 support.",
   "logo": "zitadel.png",
   "links": {

blueprints/zitadel/template.toml

@@ -7,6 +7,8 @@ admin_email = "${email}"
 admin_password = "AdminPassword123!"
 
 [config]
+mounts = []
+
 [[config.domains]]
 serviceName = "zitadel"
 port = 8080
@@ -16,7 +18,15 @@ path = "/"
 [config.env]
 POSTGRES_PASSWORD = "${postgres_password}"
 ZITADEL_MASTERKEY = "${zitadel_masterkey}"
-EXTERNAL_DOMAIN = "${main_domain}"
+
+# ZITADEL_EXTERNALDOMAIN must always match the domain configured in the
+# Domains tab. If you change the domain, update this variable too (and do it
+# BEFORE the first deploy — Zitadel binds its instance to this domain on
+# first start). For a domain served over HTTPS set ZITADEL_EXTERNALPORT=443
+# and ZITADEL_EXTERNALSECURE=true.
+ZITADEL_EXTERNALDOMAIN = "${main_domain}"
+ZITADEL_EXTERNALPORT = "80"
+ZITADEL_EXTERNALSECURE = "false"
 
 # Custom Admin User Configuration
 ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME = "${admin_username}"
@@ -24,5 +34,3 @@ ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD = "${admin_password}"
 ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS = "${admin_email}"
 ZITADEL_FIRSTINSTANCE_ORG_HUMAN_FIRSTNAME = "Admin"
 ZITADEL_FIRSTINSTANCE_ORG_HUMAN_LASTNAME = "User"
-
-[[config.mounts]]