fix: bring remaining blueprints in line with the port conventions (audit green)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/audit-all-blueprints.yml

@@ -0,0 +1,163 @@
+name: Audit All Blueprints
+
+# The per-PR validators only look at blueprints a PR touches, which is the right
+# call for CI cost but means a template is checked when it lands and then never
+# again. When a rule is added or tightened, every existing blueprint that breaks
+# it stays broken with nothing surfacing it (see #1047).
+#
+# This job runs the same validators over ALL blueprints on a schedule, so drift
+# is reported instead of accumulating. It never runs on pull_request, so it
+# cannot block a contributor for a pre-existing problem they did not introduce.
+
+on:
+  schedule:
+    # Mondays, 04:00 UTC
+    - cron: "0 4 * * 1"
+  workflow_dispatch:
+    inputs:
+      fail_on_findings:
+        description: "Exit non-zero when findings exist (default: report only)"
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.16.0
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 8
+
+      - name: Install dependencies
+        run: cd build-scripts && pnpm install
+
+      - name: Validate per-template metadata
+        run: node build-scripts/generate-meta.js --check
+
+      - name: Audit every blueprint
+        id: audit
+        run: |
+          # $RUNNER_TEMP is per-job; also cleared explicitly so a re-run or a
+          # partially-executed earlier step can never leak into the summary.
+          WORK="${RUNNER_TEMP:-/tmp}"
+          OUT="$WORK/validator-out.txt"
+          REPORT="$WORK/audit-report.md"
+          SUMMARY="$WORK/audit-summary.md"
+          rm -f "$OUT" "$REPORT" "$SUMMARY"
+
+          COMPOSE_FAILED=""
+          TOML_FAILED=""
+
+          for dir in blueprints/*/; do
+            id="$(basename "$dir")"
+
+            # Run unconditionally: a blueprint with no docker-compose.yml or no
+            # template.toml is itself a finding, and the validators already
+            # report a missing file clearly. Skipping them would hide exactly
+            # the blueprints most likely to be broken.
+            if ! (cd build-scripts && pnpm exec tsx validate-docker-compose.ts \
+                   --file "../$dir/docker-compose.yml") > "$OUT" 2>&1; then
+              COMPOSE_FAILED="$COMPOSE_FAILED $id"
+              {
+                echo "### \`$id\` — docker-compose.yml"
+                echo '```'
+                grep '❌' "$OUT" || cat "$OUT"
+                echo '```'
+              } >> "$REPORT"
+            fi
+
+            if ! (cd build-scripts && pnpm exec tsx validate-template.ts \
+                   --dir "../$dir") > "$OUT" 2>&1; then
+              TOML_FAILED="$TOML_FAILED $id"
+              {
+                echo "### \`$id\` — template.toml"
+                echo '```'
+                grep '❌' "$OUT" || cat "$OUT"
+                echo '```'
+              } >> "$REPORT"
+            fi
+          done
+
+          COMPOSE_COUNT=$(echo $COMPOSE_FAILED | wc -w | tr -d ' ')
+          TOML_COUNT=$(echo $TOML_FAILED | wc -w | tr -d ' ')
+          TOTAL=$(ls -d blueprints/*/ | wc -l | tr -d ' ')
+
+          {
+            echo "## Blueprint audit"
+            echo ""
+            echo "| check | failing | of |"
+            echo "| --- | --- | --- |"
+            echo "| \`validate-docker-compose.ts\` | $COMPOSE_COUNT | $TOTAL |"
+            echo "| \`validate-template.ts\` | $TOML_COUNT | $TOTAL |"
+            echo ""
+          } > "$SUMMARY"
+
+          if [ -f "$REPORT" ]; then
+            cat "$REPORT" >> "$SUMMARY"
+          else
+            echo "No findings." >> "$SUMMARY"
+          fi
+
+          # The step summary caps at ~1MB and truncates silently past it, which
+          # would hide findings exactly as the backlog grows. Bound what we
+          # append and point at the artifact for the rest.
+          SUMMARY_LIMIT=$((512 * 1024))
+          SUMMARY_BYTES=$(wc -c < "$SUMMARY" | tr -d ' ')
+
+          if [ "$SUMMARY_BYTES" -gt "$SUMMARY_LIMIT" ]; then
+            # Emit the header table only, never a byte-sliced prefix: cutting
+            # mid-``` leaves an unclosed code fence, which swallows the notice
+            # below it and makes the truncation invisible in the rendered summary.
+            {
+              head -n 7 "$SUMMARY"
+              echo ""
+              echo "_Report omitted: $SUMMARY_BYTES bytes exceeds the $SUMMARY_LIMIT byte budget for a job summary._"
+              echo "_Download the \`blueprint-audit\` artifact for the complete output._"
+            } >> "$GITHUB_STEP_SUMMARY"
+          else
+            cat "$SUMMARY" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+          # Always published, so the full report survives regardless of size.
+          cp "$SUMMARY" "$WORK/blueprint-audit.md"
+          echo "report_path=$WORK/blueprint-audit.md" >> "$GITHUB_OUTPUT"
+
+          echo "compose_failed=$COMPOSE_COUNT" >> "$GITHUB_OUTPUT"
+          echo "toml_failed=$TOML_COUNT" >> "$GITHUB_OUTPUT"
+
+          if [ "$COMPOSE_COUNT" != "0" ] || [ "$TOML_COUNT" != "0" ]; then
+            echo "::warning::$COMPOSE_COUNT compose and $TOML_COUNT template.toml findings across $TOTAL blueprints"
+          fi
+
+      - name: Upload the full report
+        if: always() && steps.audit.outputs.report_path != ''
+        uses: actions/upload-artifact@v4
+        with:
+          name: blueprint-audit
+          path: ${{ steps.audit.outputs.report_path }}
+          retention-days: 30
+
+      - name: Fail if requested
+        # `inputs` is only populated for workflow_dispatch; on a schedule run it
+        # is not available, so gate on the event first and read the value through
+        # github.event.inputs, which is an empty string when absent.
+        if: >-
+          github.event_name == 'workflow_dispatch' &&
+          github.event.inputs.fail_on_findings == 'true' &&
+          (steps.audit.outputs.compose_failed != '0' || steps.audit.outputs.toml_failed != '0')
+        run: |
+          echo "❌ Findings present and fail_on_findings was requested."
+          exit 1

README.md

@@ -183,7 +183,7 @@ services:
       - 3000:3000
 
     # Instead use this way:
-    ports:
+    expose:
       - 3000
 ```
 

app/src/components/TemplateDialog.tsx

@@ -14,6 +14,7 @@ import { Tabs, TabsContent, TabsList, TabsTrigger } from "./ui/tabs";
 import { Label } from "./ui/label";
 import { Clipboard } from "lucide-react";
 import { Input } from "./ui/input";
+import Markdown from "./ui/markdown";
 
 interface Template {
   id: string;
@@ -32,6 +33,7 @@ interface Template {
 interface TemplateFiles {
   dockerCompose: string | null;
   config: string | null;
+  instructions: string | null;
 }
 
 interface TemplateDialogProps {
@@ -169,8 +171,23 @@ const TemplateDialog: React.FC<TemplateDialogProps> = ({
                     </div>
                   </div>
                 )}
-                <Tabs defaultValue="docker-compose" className="w-full">
+                <Tabs
+                  defaultValue={
+                    templateFiles?.instructions
+                      ? "instructions"
+                      : "docker-compose"
+                  }
+                  className="w-full"
+                >
                   <TabsList className="w-full justify-start">
+                    {templateFiles?.instructions && (
+                      <TabsTrigger
+                        value="instructions"
+                        className="data-[state=active]:font-bold"
+                      >
+                        Instructions
+                      </TabsTrigger>
+                    )}
                     <TabsTrigger
                       value="docker-compose"
                       className="data-[state=active]:font-bold"
@@ -184,6 +201,24 @@ const TemplateDialog: React.FC<TemplateDialogProps> = ({
                       Configuration
                     </TabsTrigger>
                   </TabsList>
+
+                  {templateFiles?.instructions && (
+                    <TabsContent value="instructions" className="mt-4">
+                      <div className="space-y-2">
+                        <Label className="flex flex-col items-start w-fit justify-start gap-1">
+                          <span className="leading-tight text-xl font-semibold">
+                            Setup Instructions
+                          </span>
+                          <span className="leading-tight text-sm text-gray-500">
+                            instructions.md
+                          </span>
+                        </Label>
+                        <div className="rounded-md border p-4">
+                          <Markdown content={templateFiles.instructions} />
+                        </div>
+                      </div>
+                    </TabsContent>
+                  )}
                   <TabsContent value="docker-compose" className="mt-4">
                     {templateFiles?.dockerCompose && (
                       <div className="space-y-2">

app/src/components/TemplateGrid.tsx

@@ -28,6 +28,7 @@ interface Template {
 interface TemplateFiles {
   dockerCompose: string | null;
   config: string | null;
+  instructions: string | null;
 }
 
 interface TemplateGridProps {
@@ -80,20 +81,34 @@ const TemplateGrid: React.FC<TemplateGridProps> = ({ view }) => {
   const fetchTemplateFiles = async (templateId: string) => {
     setModalLoading(true);
     try {
-      const [dockerComposeRes, configRes] = await Promise.all([
-        fetch(`/blueprints/${templateId}/docker-compose.yml`),
-        fetch(`/blueprints/${templateId}/template.toml`),
-      ]);
+      const [dockerComposeRes, configRes, instructionsRes] = await Promise.all(
+        [
+          fetch(`/blueprints/${templateId}/docker-compose.yml`),
+          fetch(`/blueprints/${templateId}/template.toml`),
+          fetch(`/blueprints/${templateId}/instructions.md`),
+        ]
+      );
 
       const dockerCompose = dockerComposeRes.ok
         ? await dockerComposeRes.text()
         : null;
       const config = configRes.ok ? await configRes.text() : null;
 
-      setTemplateFiles({ dockerCompose, config });
+      // Guard against SPA fallbacks that return index.html with a 200 status
+      // for templates that don't have an instructions.md file.
+      const instructionsIsMarkdown =
+        instructionsRes.ok &&
+        !(instructionsRes.headers.get("content-type") || "").includes(
+          "text/html"
+        );
+      const instructions = instructionsIsMarkdown
+        ? await instructionsRes.text()
+        : null;
+
+      setTemplateFiles({ dockerCompose, config, instructions });
     } catch (err) {
       console.error("Error fetching template files:", err);
-      setTemplateFiles({ dockerCompose: null, config: null });
+      setTemplateFiles({ dockerCompose: null, config: null, instructions: null });
     } finally {
       setModalLoading(false);
     }

app/src/components/ui/markdown.tsx

@@ -0,0 +1,177 @@
+import React from "react";
+
+// Minimal markdown renderer (no external dependencies) for the per-template
+// instructions.md files. Supports headings, paragraphs, fenced code blocks,
+// ordered/unordered lists, and inline code / bold / links.
+
+const INLINE_PATTERN =
+  /(`[^`]+`)|(\*\*[^*]+\*\*)|(\[[^\]]+\]\([^)\s]+\))/g;
+
+const renderInline = (text: string): React.ReactNode[] => {
+  const nodes: React.ReactNode[] = [];
+  let lastIndex = 0;
+  let key = 0;
+  let match: RegExpExecArray | null;
+  INLINE_PATTERN.lastIndex = 0;
+
+  while ((match = INLINE_PATTERN.exec(text)) !== null) {
+    if (match.index > lastIndex) {
+      nodes.push(text.slice(lastIndex, match.index));
+    }
+    const token = match[0];
+    if (token.startsWith("`")) {
+      nodes.push(
+        <code
+          key={key++}
+          className="px-1.5 py-0.5 rounded bg-muted font-mono text-[0.85em]"
+        >
+          {token.slice(1, -1)}
+        </code>
+      );
+    } else if (token.startsWith("**")) {
+      nodes.push(<strong key={key++}>{token.slice(2, -2)}</strong>);
+    } else {
+      const link = /^\[([^\]]+)\]\(([^)\s]+)\)$/.exec(token);
+      if (link) {
+        nodes.push(
+          <a
+            key={key++}
+            href={link[2]}
+            target="_blank"
+            rel="noopener noreferrer"
+            className="text-blue-600 dark:text-blue-400 underline underline-offset-2"
+          >
+            {link[1]}
+          </a>
+        );
+      } else {
+        nodes.push(token);
+      }
+    }
+    lastIndex = match.index + token.length;
+  }
+  if (lastIndex < text.length) {
+    nodes.push(text.slice(lastIndex));
+  }
+  return nodes;
+};
+
+const HEADING_CLASSES: Record<number, string> = {
+  1: "text-2xl font-bold mt-2",
+  2: "text-xl font-semibold mt-6 border-b pb-1",
+  3: "text-lg font-semibold mt-4",
+  4: "text-base font-semibold mt-3",
+};
+
+interface MarkdownProps {
+  content: string;
+}
+
+const Markdown: React.FC<MarkdownProps> = ({ content }) => {
+  const lines = content.replace(/\r\n/g, "\n").split("\n");
+  const blocks: React.ReactNode[] = [];
+  let key = 0;
+  let i = 0;
+
+  while (i < lines.length) {
+    const line = lines[i];
+
+    // Blank line
+    if (line.trim() === "") {
+      i++;
+      continue;
+    }
+
+    // Fenced code block
+    if (line.trim().startsWith("```")) {
+      const code: string[] = [];
+      i++;
+      while (i < lines.length && !lines[i].trim().startsWith("```")) {
+        code.push(lines[i]);
+        i++;
+      }
+      i++; // skip closing fence
+      blocks.push(
+        <pre
+          key={key++}
+          className="bg-muted rounded-md p-4 overflow-x-auto text-sm font-mono whitespace-pre"
+        >
+          <code>{code.join("\n")}</code>
+        </pre>
+      );
+      continue;
+    }
+
+    // Heading
+    const heading = /^(#{1,4})\s+(.*)$/.exec(line);
+    if (heading) {
+      const level = heading[1].length;
+      const Tag = `h${Math.min(level + 1, 6)}` as keyof React.JSX.IntrinsicElements;
+      blocks.push(
+        <Tag key={key++} className={HEADING_CLASSES[level]}>
+          {renderInline(heading[2])}
+        </Tag>
+      );
+      i++;
+      continue;
+    }
+
+    // Unordered list
+    if (/^[-*]\s+/.test(line)) {
+      const items: string[] = [];
+      while (i < lines.length && /^[-*]\s+/.test(lines[i])) {
+        items.push(lines[i].replace(/^[-*]\s+/, ""));
+        i++;
+      }
+      blocks.push(
+        <ul key={key++} className="list-disc pl-6 space-y-1">
+          {items.map((item, idx) => (
+            <li key={idx}>{renderInline(item)}</li>
+          ))}
+        </ul>
+      );
+      continue;
+    }
+
+    // Ordered list
+    if (/^\d+\.\s+/.test(line)) {
+      const items: string[] = [];
+      while (i < lines.length && /^\d+\.\s+/.test(lines[i])) {
+        items.push(lines[i].replace(/^\d+\.\s+/, ""));
+        i++;
+      }
+      blocks.push(
+        <ol key={key++} className="list-decimal pl-6 space-y-1">
+          {items.map((item, idx) => (
+            <li key={idx}>{renderInline(item)}</li>
+          ))}
+        </ol>
+      );
+      continue;
+    }
+
+    // Paragraph: consume consecutive plain lines
+    const paragraph: string[] = [line];
+    i++;
+    while (
+      i < lines.length &&
+      lines[i].trim() !== "" &&
+      !/^(#{1,4})\s+/.test(lines[i]) &&
+      !/^[-*]\s+/.test(lines[i]) &&
+      !/^\d+\.\s+/.test(lines[i]) &&
+      !lines[i].trim().startsWith("```")
+    ) {
+      paragraph.push(lines[i]);
+      i++;
+    }
+    blocks.push(
+      <p key={key++} className="leading-relaxed">
+        {renderInline(paragraph.join(" "))}
+      </p>
+    );
+  }
+
+  return <div className="space-y-3 text-sm">{blocks}</div>;
+};
+
+export default Markdown;

blueprints/9router/docker-compose.yml

@@ -0,0 +1,32 @@
+version: "3.8"
+
+services:
+  9router:
+    image: decolua/9router:0.5.40
+    restart: unless-stopped
+    environment:
+      DATA_DIR: /app/data
+      PORT: "20128"
+      HOSTNAME: "0.0.0.0"
+      NODE_ENV: production
+      JWT_SECRET: ${JWT_SECRET}
+      INITIAL_PASSWORD: ${INITIAL_PASSWORD}
+      API_KEY_SECRET: ${API_KEY_SECRET}
+      MACHINE_ID_SALT: ${MACHINE_ID_SALT}
+      BASE_URL: http://${ROUTER_HOST}
+      NEXT_PUBLIC_BASE_URL: http://${ROUTER_HOST}
+      HEADROOM_URL: http://headroom:8787
+      AUTH_COOKIE_SECURE: "false"
+    volumes:
+      - 9router-data:/app/data
+    depends_on:
+      - headroom
+
+  # Optional token-reduction proxy that 9Router calls through HEADROOM_URL.
+  # Shipped as a sidecar because the 9Router image does not bundle it.
+  headroom:
+    image: ghcr.io/chopratejas/headroom:0.6.7
+    restart: unless-stopped
+
+volumes:
+  9router-data:

blueprints/9router/meta.json

@@ -0,0 +1,17 @@
+{
+  "id": "9router",
+  "name": "9Router",
+  "version": "0.5.40",
+  "description": "Self-hosted AI model router that rotates requests across 40+ providers with automatic fallback, exposing an OpenAI-compatible endpoint for coding agents.",
+  "logo": "9router.png",
+  "links": {
+    "github": "https://github.com/decolua/9router",
+    "website": "https://9router.com",
+    "docs": "https://github.com/decolua/9router/blob/master/DOCKER.md"
+  },
+  "tags": [
+    "ai",
+    "proxy",
+    "developer-tools"
+  ]
+}

blueprints/9router/template.toml

@@ -0,0 +1,21 @@
+[variables]
+main_domain = "${domain}"
+jwt_secret = "${password:64}"
+initial_password = "${password:32}"
+api_key_secret = "${password:64}"
+machine_id_salt = "${password:32}"
+
+[config]
+env = [
+  "ROUTER_HOST=${main_domain}",
+  "JWT_SECRET=${jwt_secret}",
+  "INITIAL_PASSWORD=${initial_password}",
+  "API_KEY_SECRET=${api_key_secret}",
+  "MACHINE_ID_SALT=${machine_id_salt}",
+]
+mounts = []
+
+[[config.domains]]
+serviceName = "9router"
+port = 20128
+host = "${main_domain}"

blueprints/ackee/docker-compose.yml

@@ -3,7 +3,7 @@ version: "3"
 services:
   ackee:
     image: electerious/ackee:3.4.2
-    ports:
+    expose:
       - "3000"
     environment:
       - ACKEE_USERNAME=${ACKEE_USERNAME}

blueprints/ackee/instructions.md

@@ -1,4 +0,0 @@
-
-## Instructions
-
-We don't have nothing to show here....

blueprints/activepieces/docker-compose.yml

@@ -61,4 +61,4 @@ services:
 
 volumes:
   postgres_data:
-  redis_data: 
+  redis_data: 

blueprints/adguardhome/docker-compose.yml

@@ -1,3 +1,4 @@
+# dokploy: allow-host-ports — DNS (53/tcp+udp), DHCP (67/68) and DNS-over-TLS/QUIC (853) are not HTTP protocols; clients must reach them directly on the host, Traefik cannot route them.
 version: "3.8"
 services:
   adguardhome:
@@ -10,11 +11,12 @@ services:
       - "68:68/tcp" # DHCP Client
       - "853:853/tcp" # DNS over TLS, DNS-over-QUIC
       - "853:853/udp" # DNS over TLS, DNS-over-QUIC
-      - "6060:6060/tcp" # HTTP (pprof)
+    expose:
+      - 6060 # HTTP (pprof) — debug endpoint, no need to publish it on the host
     volumes:
       - adguardhome-work:/opt/adguardhome/work
       - adguardhome-conf:/opt/adguardhome/conf
 
 volumes:
   adguardhome-work: {}
-  adguardhome-conf: {}
+  adguardhome-conf: {}

blueprints/adminer/docker-compose.yml

@@ -3,5 +3,5 @@ services:
   adminer:
     image: adminer:4.8.1
     restart: unless-stopped
-    ports:
-      - 8080 
+    expose:
+      - 8080 

blueprints/affinepro/docker-compose.yml

@@ -1,9 +1,9 @@
 version: "3.8"
 services:
   affinepro:
-    image: ghcr.io/toeverything/affine-graphql:stable-780dd83
+    image: ghcr.io/toeverything/affine:stable
     restart: unless-stopped
-    ports:
+    expose:
       - 3010
     volumes:
       - affine-storage:/root/.affine/storage
@@ -12,6 +12,7 @@ services:
       - REDIS_SERVER_HOST=redis
       - REDIS_SERVER_PASSWORD=${REDIS_PASSWORD}
       - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@db:5432/affinepro
+      - AFFINE_INDEXER_ENABLED=false
       - AFFINE_SERVER_HOST=${DOMAIN}
       - MAILER_HOST=${MAILER_HOST}
       - MAILER_PORT=${MAILER_PORT}
@@ -19,16 +20,21 @@ services:
       - MAILER_PASSWORD=${MAILER_PASSWORD}
       - MAILER_SENDER=${MAILER_SENDER}
     depends_on:
-      - db
-      - redis
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      migration:
+        condition: service_completed_successfully
 
   migration:
-    image: ghcr.io/toeverything/affine-graphql:stable-780dd83
-    command: node ./scripts/self-host-predeploy.js
+    image: ghcr.io/toeverything/affine:stable
+    command: ["sh", "-c", "node ./scripts/self-host-predeploy.js"]
     environment:
       - REDIS_SERVER_HOST=redis
       - REDIS_SERVER_PASSWORD=${REDIS_PASSWORD}
       - DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@db:5432/affinepro
+      - AFFINE_INDEXER_ENABLED=false
       - AFFINE_SERVER_HOST=${DOMAIN}
       - MAILER_HOST=${MAILER_HOST}
       - MAILER_PORT=${MAILER_PORT}
@@ -39,17 +45,25 @@ services:
       - affine-storage:/root/.affine/storage
       - affine-config:/root/.affine/config
     depends_on:
-      - db
-      - redis
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
 
   db:
-    image: postgres:15-alpine
+    image: pgvector/pgvector:pg16
     restart: unless-stopped
     environment:
       - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
       - POSTGRES_DB=affinepro
+      - POSTGRES_INITDB_ARGS=--data-checksums
     volumes:
       - postgres-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD", "pg_isready", "-U", "postgres", "-d", "affinepro"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
   redis:
     image: redis:7-alpine
@@ -57,9 +71,14 @@ services:
     command: redis-server --requirepass ${REDIS_PASSWORD}
     volumes:
       - redis-data:/data
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli -a '${REDIS_PASSWORD}' ping | grep PONG"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
 volumes:
   affine-storage: {}
   affine-config: {}
   postgres-data: {}
-  redis-data: {} 
+  redis-data: {}

blueprints/affinepro/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "affinepro",
   "name": "Affine Pro",
-  "version": "stable-780dd83",
+  "version": "stable",
   "description": "Affine Pro is a modern, self-hosted platform designed for collaborative content creation and project management. It offers an intuitive interface, seamless real-time collaboration, and powerful tools for organizing tasks, notes, and ideas.",
   "logo": "logo.png",
   "links": {

blueprints/agent-zero/docker-compose.yml

@@ -11,4 +11,4 @@ services:
     volumes:
       - agent-zero-data:/a0/usr
 volumes:
-  agent-zero-data:
+  agent-zero-data:

blueprints/agentdvr/docker-compose.yml

@@ -11,12 +11,11 @@ services:
       - agentdvr-config:/AgentDVR/Media/XML/
       - agentdvr-media:/AgentDVR/Media/WebServerRoot/Media/
       - agentdvr-commands:/AgentDVR/Commands/
-    ports:
+    expose:
       - 8090
       - 3478/udp
       - 50000-50100/udp
-
 volumes:
   agentdvr-config: {}
   agentdvr-media: {}
-  agentdvr-commands: {}
+  agentdvr-commands: {}

blueprints/agentdvr/template.toml

@@ -3,6 +3,7 @@ main_domain = "${domain}"
 timezone = "America/New_York"
 
 [config]
+mounts = []
 [[config.domains]]
 serviceName = "agentdvr"
 port = 8090
@@ -10,5 +11,3 @@ host = "${main_domain}"
 
 [config.env]
 TIMEZONE = "${timezone}"
-
-[[config.mounts]]

blueprints/akaunting/template.toml

@@ -24,6 +24,7 @@ port = 80
 host = "${main_domain}"
 
 [config]
+mounts = []
 env = [
   # App
   "APP_URL=${main_domain}",
@@ -50,5 +51,4 @@ env = [
   "MYSQL_RANDOM_ROOT_PASSWORD=yes"
 ]
 
-# No custom mounts needed; volumes are already defined in compose.
-[[config.mounts]]
+# No custom mounts needed; volumes are already defined in compose.

blueprints/alist/docker-compose.yml

@@ -11,4 +11,4 @@ services:
     restart: unless-stopped
 
 volumes:
-  alist-data:
+  alist-data:

blueprints/alltube/docker-compose.yml

@@ -3,10 +3,10 @@ services:
   alltube:
     image: dnomd343/alltube:latest
     restart: unless-stopped
-    ports:
+    expose:
       - 80
     environment:
       - TITLE=${TITLE}
       - CONVERT=${CONVERT}
       - STREAM=${STREAM}
-      - REMUX=${REMUX} 
+      - REMUX=${REMUX} 

blueprints/ampache/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   ampache:
     image: ampache/ampache:latest
     restart: unless-stopped
-    ports:
+    expose:
       - 80
     volumes:
       - config:/var/www/config
@@ -14,4 +14,4 @@ services:
 volumes:
   config: {}
   log: {}
-  mysql: {} 
+  mysql: {} 

blueprints/anonupload/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   anonupload:
     image: ghcr.io/supernova3339/anonfiles:1
     restart: unless-stopped
-    ports:
+    expose:
       - 80
     environment:
       - ADMIN_EMAIL=${ADMIN_EMAIL}
@@ -13,4 +13,4 @@ services:
       - uploads:/var/www/html/uploads
 
 volumes:
-  uploads: {} 
+  uploads: {} 

blueprints/answer/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   answer:
     image: apache/answer:1.4.1
-    ports:
+    expose:
       - '80'
     restart: on-failure
     volumes:

blueprints/answer/meta.json

@@ -10,7 +10,7 @@
     "docs": "https://answer.apache.org/docs"
   },
   "tags": [
-    "q&a",
+    "q-and-a",
     "self-hosted"
   ]
 }

blueprints/anubis/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   anubis:
     image: ghcr.io/techarohq/anubis:latest
     restart: unless-stopped
-    ports:
+    expose:
       - "8923" # Anubis default port
     environment:
       # Required: Point to your frontend service locally

blueprints/anythingllm/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   anythingllm:
     image: mintplexlabs/anythingllm:latest
     restart: unless-stopped
-    ports:
+    expose:
       - 3001
     environment:
       - STORAGE_DIR=/app/server/storage
@@ -13,4 +13,4 @@ services:
       - SYS_ADMIN
 
 volumes:
-  storage: {} 
+  storage: {} 

blueprints/anytype/docker-compose.yml

@@ -1,3 +1,4 @@
+# dokploy: allow-host-ports — Anytype clients speak the any-sync protocol (TCP 33010, UDP/QUIC 33020) directly against the server; it is not HTTP, so Traefik cannot route it.
 # Example: Any-Sync-Bundle with embedded MongoDB and Redis (all-in-one image)
 #
 # Usage:

blueprints/apprise-api/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   apprise-api:
     image: linuxserver/apprise-api:latest
     restart: unless-stopped
-    ports:
+    expose:
       - 8000
     environment:
       - PUID=1000
@@ -13,4 +13,4 @@ services:
       - config:/config
 
 volumes:
-  config: {} 
+  config: {} 

blueprints/appsmith/docker-compose.yml

@@ -7,4 +7,4 @@ services:
     restart: unless-stopped
 
 volumes:
-  appsmith-data:
+  appsmith-data:

blueprints/arangodb/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   arangodb:
     image: arangodb:3.12.4
     restart: unless-stopped
-    ports:
+    expose:
       - 8529
     environment:
       - ARANGO_ROOT_PASSWORD=${ARANGO_PASSWORD}
@@ -11,4 +11,4 @@ services:
       - data:/var/lib/arangodb3
 
 volumes:
-  data: {} 
+  data: {} 

blueprints/archivebox/docker-compose.yml

@@ -9,8 +9,7 @@ services:
       PUBLIC_SNAPSHOTS: ${PUBLIC_SNAPSHOTS}
     volumes:
       - archivebox_data:/data
-    ports:
+    expose:
       - "8000"
-
 volumes:
   archivebox_data:

blueprints/argilla/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   argilla-web:
     image: argilla/argilla-server:latest
     restart: unless-stopped
-    ports:
+    expose:
       - 6900
     environment:
       - ARGILLA_HOME_PATH=/var/lib/argilla
@@ -74,4 +74,4 @@ volumes:
   argilladata: {}
   elasticdata: {}
   dbdata: {}
-  redisdata: {} 
+  redisdata: {} 

blueprints/audiobookshelf/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   audiobookshelf:
     image: ghcr.io/advplyr/audiobookshelf:2.19.4
     restart: unless-stopped
-    ports:
+    expose:
       - 80
     environment:
       - TZ=UTC
@@ -14,4 +14,4 @@ services:
 
 volumes:
   config: {}
-  metadata: {} 
+  metadata: {} 

blueprints/authelia/docker-compose.yml

@@ -16,9 +16,8 @@ services:
         condition: service_healthy
       postgres:
         condition: service_healthy
-    ports:
+    expose:
       - 9091
-
   redis:
     image: redis:7-alpine
     restart: unless-stopped
@@ -52,4 +51,4 @@ services:
 volumes:
   authelia_config:
   redis_data:
-  postgres_data:
+  postgres_data:

blueprints/authorizer/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   authorizer:
     image: lakhansamani/authorizer:1.4.4
     restart: unless-stopped
-    ports:
+    expose:
       - 8080
     environment:
       - DATABASE_TYPE=postgres
@@ -37,4 +37,4 @@ services:
 
 volumes:
   db_data: {}
-  redis_data: {} 
+  redis_data: {} 

blueprints/autobase/docker-compose.yml

@@ -2,7 +2,7 @@ services:
   autobase-console:
     image: autobase/console:2.7.2
     restart: unless-stopped
-    ports:
+    expose:
       - "80"
       - "8080"
     environment:

blueprints/automatisch/docker-compose.yml

@@ -1,17 +1,15 @@
-version: "3.8"
 services:
   automatisch:
-    image: dockeriddonuts/automatisch:2.0
+    image: automatischio/automatisch:0.15.0
     restart: unless-stopped
-    ports:
-      - 3000
     environment:
       - HOST=${DOMAIN}
       - PROTOCOL=http
       - PORT=3000
+      - API_URL=http://${DOMAIN}
+      - WEB_APP_URL=http://${DOMAIN}
       - APP_ENV=production
       - REDIS_HOST=automatisch-redis
-      - REDIS_USERNAME=default
       - REDIS_PASSWORD=${REDIS_PASSWORD}
       - POSTGRES_HOST=automatisch-postgres
       - POSTGRES_DATABASE=automatisch
@@ -23,11 +21,13 @@ services:
     volumes:
       - storage:/automatisch/storage
     depends_on:
-      - automatisch-postgres
-      - automatisch-redis
+      automatisch-postgres:
+        condition: service_healthy
+      automatisch-redis:
+        condition: service_started
 
   automatisch-worker:
-    image: dockeriddonuts/automatisch:2.0
+    image: automatischio/automatisch:0.15.0
     restart: unless-stopped
     environment:
       - APP_ENV=production
@@ -44,8 +44,7 @@ services:
     volumes:
       - storage:/automatisch/storage
     depends_on:
-      - automatisch-postgres
-      - automatisch-redis
+      - automatisch
 
   automatisch-postgres:
     image: postgres:15-alpine
@@ -56,18 +55,20 @@ services:
       - POSTGRES_DB=automatisch
     volumes:
       - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d automatisch"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
   automatisch-redis:
     image: redis:7-alpine
     restart: unless-stopped
     command: redis-server --requirepass ${REDIS_PASSWORD}
-    environment:
-      - REDIS_USERNAME=default
-      - REDIS_PASSWORD=${REDIS_PASSWORD}
     volumes:
       - redis_data:/data
 
 volumes:
   storage: {}
   postgres_data: {}
-  redis_data: {} 
+  redis_data: {}

blueprints/automatisch/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "automatisch",
   "name": "Automatisch",
-  "version": "2.0",
+  "version": "0.15.0",
   "description": "Automatisch is a powerful, self-hosted workflow automation tool designed for connecting your apps and automating repetitive tasks. With Automatisch, you can create workflows to sync data, send notifications, and perform various actions seamlessly across different services.",
   "logo": "logo.png",
   "links": {

blueprints/automatisch/template.toml

@@ -13,6 +13,7 @@ port = 3000
 host = "${main_domain}"
 
 [config.env]
+DOMAIN = "${main_domain}"
 DB_PASSWORD = "${db_password}"
 REDIS_PASSWORD = "${redis_password}"
 ENCRYPTION_KEY = "${encryption_key}"

blueprints/azuracast/docker-compose.yml

@@ -2,7 +2,7 @@ services:
   azuracast:
     image: ghcr.io/azuracast/azuracast:latest
     restart: unless-stopped
-    ports:
+    expose:
       - 80
     volumes:
       - azuracast-station-data:/var/azuracast/stations
@@ -36,4 +36,4 @@ volumes:
   azuracast-data: {}
   azuracast-uploads: {}
   azuracast-backups: {}
-  mariadb-data: {}
+  mariadb-data: {}

blueprints/azuracast/template.toml

@@ -4,6 +4,7 @@ mysql_root_password = "${password:32}"
 mysql_password = "${password:16}"
 
 [config]
+mounts = []
 [[config.domains]]
 serviceName = "azuracast"
 port = 80
@@ -27,5 +28,3 @@ NGINX_RADIO_PORTS = "8000,8010,8020,8030,8040,8050"
 PREFER_RELEASE_BUILDS = "true"
 COMPOSER_PLUGIN_MODE = "false"
 ADDITIONAL_MEDIA_SYNC_WORKER_COUNT = "0"
-
-[[config.mounts]]

blueprints/babybuddy/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   babybuddy:
     image: linuxserver/babybuddy:2.7.0
     restart: unless-stopped
-    ports:
+    expose:
       - 8000
     environment:
       - PUID=1000
@@ -16,4 +16,4 @@ services:
       - config:/config
 
 volumes:
-  config: {} 
+  config: {} 

blueprints/backrest/docker-compose.yml

@@ -2,7 +2,7 @@ services:
   backrest:
     image: garethgeorge/backrest:v1.7.3
     restart: unless-stopped
-    ports:
+    expose:
       - 9898
     environment:
       - BACKREST_PORT=9898

blueprints/baikal/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   baikal:
     image: ckulka/baikal:nginx-php8.2
     restart: unless-stopped
-    ports:
+    expose:
       - 80
     environment:
       - TZ=UTC
@@ -13,4 +13,4 @@ services:
 
 volumes:
   config: {}
-  data: {} 
+  data: {} 

blueprints/barrage/docker-compose.yml

@@ -3,11 +3,11 @@ services:
   barrage:
     image: maulik9898/barrage:0.3.0
     restart: unless-stopped
-    ports:
+    expose:
       - 3000
     environment:
       - NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
       - NEXTAUTH_URL=http://${DOMAIN}
       - DELUGE_URL=${DELUGE_URL}
       - DELUGE_PASSWORD=${DELUGE_PASSWORD}
-      - BARRAGE_PASSWORD=${BARRAGE_PASSWORD} 
+      - BARRAGE_PASSWORD=${BARRAGE_PASSWORD} 

blueprints/bazarr/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   bazarr:
     image: lscr.io/linuxserver/bazarr:1.5.1
     restart: unless-stopped
-    ports:
+    expose:
       - 6767
     environment:
       - PUID=1000
@@ -15,4 +15,4 @@ services:
       - ${TV_PATH}:/tv
 
 volumes:
-  config: {} 
+  config: {} 

blueprints/beszel/docker-compose.yml

@@ -3,11 +3,11 @@ services:
   beszel:
     image: henrygd/beszel:0.10.2
     restart: unless-stopped
-    ports:
+    expose:
       - 8090
     volumes:
       - beszel_data:/beszel_data
       - /var/run/docker.sock:/var/run/docker.sock:ro
 
 volumes:
-  beszel_data: {} 
+  beszel_data: {} 

blueprints/bigcapital/docker-compose.yml

@@ -4,10 +4,8 @@ services:
     restart: unless-stopped
     depends_on:
       - server
-    ports:
+    expose:
       - '80'
-
-
   server:
     image: bigcapitalhq/server:latest
     restart: unless-stopped
@@ -18,9 +16,8 @@ services:
         condition: service_started
       redis:
         condition: service_started
-    ports:
+    expose:
       - '3000'
-
     environment:
       # Mail
       - MAIL_HOST=${MAIL_HOST}
@@ -97,9 +94,8 @@ services:
       - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
     volumes:
       - mysql:/var/lib/mysql
-    ports:
+    expose:
       - '3306'
-
     healthcheck:
       test: ["CMD-SHELL", "mysqladmin ping -h localhost -u root -p$$MYSQL_ROOT_PASSWORD || exit 1"]
       interval: 10s
@@ -110,7 +106,7 @@ services:
   mongo:
     image: mongo:7
     restart: unless-stopped
-    ports:
+    expose:
       - '27017'
     volumes:
       - mongo:/data/db
@@ -119,7 +115,7 @@ services:
   redis:
     image: redis:7-alpine
     restart: unless-stopped
-    ports:
+    expose:
       - '6379'
     volumes:
       - redis:/data
@@ -133,10 +129,8 @@ services:
   gotenberg:
     image: gotenberg/gotenberg:7
     restart: unless-stopped
-    ports:
+    expose:
       - '9000'
-
-
 volumes:
   mysql:
     name: bigcapital_mysql

blueprints/bigcapital/template.toml

@@ -72,7 +72,7 @@ s3_endpoint = ""
 s3_bucket = ""
 
 [config]
-
+mounts = []
 [[config.domains]]
 serviceName = "webapp"
 port = 80
@@ -165,6 +165,3 @@ MYSQL_DATABASE = "${system_db_name}"
 MYSQL_USER = "${db_user}"
 MYSQL_PASSWORD = "${db_password}"
 MYSQL_ROOT_PASSWORD = "${db_root_password}"
-
-[[config.mounts]]
-

blueprints/billmora/docker-compose.yml

@@ -28,6 +28,9 @@ services:
       - AUTORUN_LARAVEL_STORAGE_LINK=true
     volumes:
       - billmora-storage:/var/www/html/storage
+      - billmora-plugins:/var/www/html/plugin
+      - billmora-themes-resources:/var/www/html/resources/themes
+      - billmora-themes-public:/var/www/html/public/themes
     depends_on:
       billmora-db:
         condition: service_healthy
@@ -58,6 +61,9 @@ services:
       - AUTORUN_ENABLED=false
     volumes:
       - billmora-storage:/var/www/html/storage
+      - billmora-plugins:/var/www/html/plugin
+      - billmora-themes-resources:/var/www/html/resources/themes
+      - billmora-themes-public:/var/www/html/public/themes
     depends_on:
       billmora-db:
         condition: service_healthy
@@ -88,6 +94,9 @@ services:
       - AUTORUN_ENABLED=false
     volumes:
       - billmora-storage:/var/www/html/storage
+      - billmora-plugins:/var/www/html/plugin
+      - billmora-themes-resources:/var/www/html/resources/themes
+      - billmora-themes-public:/var/www/html/public/themes
     depends_on:
       billmora-db:
         condition: service_healthy
@@ -126,5 +135,8 @@ services:
 
 volumes:
   billmora-storage:
+  billmora-plugins:
+  billmora-themes-resources:
+  billmora-themes-public:
   billmora-db-data:
   billmora-redis-data:

blueprints/blender/docker-compose.yml

@@ -19,7 +19,7 @@ services:
       - PGID=1000
       - TZ=Etc/UTC
       - SUBFOLDER=/ #optional
-    ports:
+    expose:
       - 3000
       - 3001
     restart: unless-stopped

blueprints/blinko/docker-compose.yml

@@ -16,9 +16,8 @@ services:
       options:
         max-size: "10m"
         max-file: "3"
-    ports:
+    expose:
       - 1111
-
   blinko-postgres:
     image: postgres:14
     restart: always

blueprints/bluesky-pds/docker-compose.yml

@@ -45,4 +45,4 @@ services:
       timeout: 10s
       retries: 10
 volumes: 
-  pds-data:
+  pds-data:

blueprints/bonfire/docker-compose.yml

@@ -0,0 +1,84 @@
+version: "3.8"
+services:
+  bonfire:
+    image: bonfirenetworks/bonfire:1.0.5-social-amd64
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+      search:
+        condition: service_started
+    environment:
+      # Instance
+      - HOSTNAME=${BONFIRE_HOSTNAME}
+      - PUBLIC_PORT=${PUBLIC_PORT:-80}
+      - SERVER_PORT=4000
+      - APP_NAME=${APP_NAME:-Bonfire}
+      - LANG=en_US.UTF-8
+      # Secrets
+      - SECRET_KEY_BASE=${SECRET_KEY_BASE}
+      - SIGNING_SALT=${SIGNING_SALT}
+      - ENCRYPTION_SALT=${ENCRYPTION_SALT}
+      - RELEASE_COOKIE=${RELEASE_COOKIE}
+      # Database (migrations run automatically on startup)
+      - POSTGRES_HOST=db
+      - POSTGRES_USER=postgres
+      - POSTGRES_DB=bonfire_db
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      # Must stay false for the initial migrations; can be set to true
+      # after the first deployment to speed up future upgrades
+      - DB_MIGRATE_INDEXES_CONCURRENTLY=${DB_MIGRATE_INDEXES_CONCURRENTLY:-false}
+      # Search (Meilisearch)
+      - SEARCH_ADAPTER=meili
+      - SEARCH_MEILI_INSTANCE=http://search:7700
+      - MEILI_MASTER_KEY=${MEILI_MASTER_KEY}
+      # Email (the first account to sign up becomes admin and needs no
+      # confirmation email; configure a mail backend for further signups)
+      - MAIL_BACKEND=${MAIL_BACKEND:-none}
+      - MAIL_SERVER=${MAIL_SERVER:-}
+      - MAIL_PORT=${MAIL_PORT:-}
+      - MAIL_USER=${MAIL_USER:-}
+      - MAIL_PASSWORD=${MAIL_PASSWORD:-}
+      - MAIL_DOMAIN=${MAIL_DOMAIN:-}
+      - MAIL_FROM=${MAIL_FROM:-}
+      - MAIL_KEY=${MAIL_KEY:-}
+      # Max upload size in megabytes
+      - UPLOAD_LIMIT=${UPLOAD_LIMIT:-20}
+    volumes:
+      - bonfire-uploads:/opt/app/data/uploads
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:4000"]
+      interval: 30s
+      timeout: 10s
+      retries: 15
+      start_period: 120s
+
+  db:
+    image: postgis/postgis:17-3.5-alpine
+    restart: unless-stopped
+    environment:
+      - POSTGRES_USER=postgres
+      - POSTGRES_DB=bonfire_db
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d bonfire_db"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+
+  search:
+    image: getmeili/meilisearch:v1.11
+    restart: unless-stopped
+    environment:
+      - MEILI_MASTER_KEY=${MEILI_MASTER_KEY}
+      - MEILI_ENV=production
+      - MEILI_NO_ANALYTICS=true
+    volumes:
+      - search-data:/meili_data
+
+volumes:
+  bonfire-uploads:
+  db-data:
+  search-data:

blueprints/bonfire/meta.json

@@ -0,0 +1,17 @@
+{
+  "id": "bonfire",
+  "name": "Bonfire",
+  "version": "1.0.5",
+  "description": "Federated social networking toolkit for communities: customizable digital spaces with ActivityPub federation, flexible boundaries and moderation tools.",
+  "logo": "bonfire.svg",
+  "links": {
+    "github": "https://github.com/bonfire-networks/bonfire-app",
+    "website": "https://bonfirenetworks.org",
+    "docs": "https://docs.bonfirenetworks.org"
+  },
+  "tags": [
+    "social",
+    "fediverse",
+    "activitypub"
+  ]
+}

blueprints/bonfire/template.toml

@@ -0,0 +1,55 @@
+[variables]
+main_domain = "${domain}"
+secret_key_base = "${password:64}"
+signing_salt = "${password:32}"
+encryption_salt = "${password:32}"
+release_cookie = "${password:32}"
+postgres_password = "${password:32}"
+meili_master_key = "${password:32}"
+
+[config]
+[[config.domains]]
+serviceName = "bonfire"
+port = 4000
+host = "${main_domain}"
+
+[config.env]
+# Domain of your Bonfire instance (must match the domain above)
+"BONFIRE_HOSTNAME" = "${main_domain}"
+# Port used to build public URLs: keep 80 while the domain is plain HTTP,
+# and change to 443 once you enable HTTPS on the domain
+# (HTTPS is required for federation with other fediverse instances)
+"PUBLIC_PORT" = "80"
+# Display name of your instance
+"APP_NAME" = "Bonfire"
+# Max upload size in megabytes
+"UPLOAD_LIMIT" = "20"
+
+# Secrets (auto-generated)
+"SECRET_KEY_BASE" = "${secret_key_base}"
+"SIGNING_SALT" = "${signing_salt}"
+"ENCRYPTION_SALT" = "${encryption_salt}"
+"RELEASE_COOKIE" = "${release_cookie}"
+"POSTGRES_PASSWORD" = "${postgres_password}"
+"MEILI_MASTER_KEY" = "${meili_master_key}"
+
+# Optional: set to true only AFTER the first deployment finished its initial
+# database migrations (speeds up index creation during future upgrades)
+# "DB_MIGRATE_INDEXES_CONCURRENTLY" = "true"
+
+# --- Email ---
+# The first account to sign up becomes the instance admin and does not need
+# a confirmation email. Further signups are invite-only by default (the admin
+# can create invite links or open up signups in the instance settings), and
+# require a working mail backend to confirm their email address.
+# Supported backends include smtp, mailgun, brevo, postmark, ses and more:
+# https://docs.bonfirenetworks.org/deploy.html
+# "MAIL_BACKEND" = "smtp"
+# "MAIL_SERVER" = "smtp.example.com"
+# "MAIL_PORT" = "587"
+# "MAIL_USER" = "postmaster@example.com"
+# "MAIL_PASSWORD" = ""
+# "MAIL_DOMAIN" = "example.com"
+# "MAIL_FROM" = "bonfire@example.com"
+# For API-based backends (e.g. mailgun) set the API key instead:
+# "MAIL_KEY" = ""

blueprints/booklore/docker-compose.yml

@@ -8,7 +8,7 @@ services:
     depends_on:
       mariadb:
         condition: service_healthy
-    ports:
+    expose:
       - 6060
     volumes:
       - booklore-data:/app/data

blueprints/booklore/template.toml

@@ -4,6 +4,7 @@ app_password = "${password:32}"
 db_root_password = "${password:32}"
 
 [config]
+mounts = []
 [[config.domains]]
 serviceName = "booklore"
 port = 6060
@@ -20,5 +21,3 @@ MYSQL_USER = "booklore"
 MYSQL_PASSWORD = "${app_password}"
 # API Key
 MYSQL_ROOT_PASSWORD = "${db_root_password}"
-
-[[config.mounts]]

blueprints/bookstack/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   bookstack:
     image: lscr.io/linuxserver/bookstack:24.12.1
     restart: unless-stopped
-    ports:
+    expose:
       - 80
     environment:
       - PUID=1000
@@ -32,4 +32,4 @@ services:
 
 volumes:
   config: {}
-  db_data: {} 
+  db_data: {} 

blueprints/borgitory/template.toml

@@ -2,24 +2,10 @@
 main_domain = "${domain}"
 
 [config]
+mounts = []
 [[config.domains]]
 serviceName = "borgitory"
 port = 8000
 host = "${main_domain}"
 
 [config.env]
-
-[[config.mounts]]
-name = "borgitory-data"
-mountPath = "/app/data"
-description = "Database and encryption key storage"
-
-[[config.mounts]]
-name = "borgitory-sources"
-mountPath = "/mnt/sources"
-description = "Sources to back up (read-only)"
-
-[[config.mounts]]
-name = "borgitory-repos"
-mountPath = "/mnt/repos"
-description = "Borg repositories (read-only)"

blueprints/botpress/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   botpress:
     image: botpress/server:12.31.9
     restart: unless-stopped
-    ports:
+    expose:
       - 81
     environment:
       - BP_HOST=0.0.0.0
@@ -31,4 +31,4 @@ services:
 
 volumes:
   data: {}
-  db_data: {} 
+  db_data: {} 

blueprints/budget-board/docker-compose.yml

@@ -22,7 +22,7 @@ services:
     environment:
       VITE_API_URL: http://budget-board-server
       PORT: 6253
-    ports:
+    expose:
       - 6253
     depends_on:
       - budget-board-server

blueprints/budget-board/template.toml

@@ -3,18 +3,12 @@ main_domain = "${domain}"
 postgres_password = "${password:32}"  
 
 [config]
+mounts = []
 [[config.domains]]
 serviceName = "budget-board-client" 
 port = 6253  
 host = "${main_domain}"  
 path = "/"
 
-
 [config.env]
 POSTGRES_PASSWORD = "${postgres_password}" 
-
-
-[[config.mounts]]
-source = "../files/db-data"  
-target = "/var/lib/postgresql/data"  
-type = "bind"  

blueprints/bytebase/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   bytebase:
     image: bytebase/bytebase:3.3.0
     restart: unless-stopped
-    ports:
+    expose:
       - 8080
     environment:
       - PG_URL=postgres://postgres:${DB_PASSWORD}@bytebase-db:5432/bytebase
@@ -24,4 +24,4 @@ services:
 
 volumes:
   data: {}
-  db_data: {} 
+  db_data: {} 

blueprints/bytestash/docker-compose.yml

@@ -4,7 +4,7 @@ services:
   bytestash:
     image: ghcr.io/jordan-dalby/bytestash:1.5.6
     restart: unless-stopped
-    ports:
+    expose:
       - "5000"
     environment:
       - BASE_PATH=
@@ -24,4 +24,4 @@ services:
       - snippets:/data/snippets
 
 volumes:
-  snippets: 
+  snippets: 

blueprints/calibre/docker-compose.yml

@@ -9,7 +9,7 @@ services:
       - TZ=Etc/UTC
       - PUID=1000
       - PGID=1000
-    ports:
+    expose:
       - 8080
     volumes:
       - books:/books
@@ -17,4 +17,4 @@ services:
 
 volumes:
   books:
-  data: 
+  data: 

blueprints/calibre/meta.json

@@ -10,7 +10,7 @@
     "docs": "https://manual.calibre-ebook.com/"
   },
   "tags": [
-    "Documents",
-    "E-Commerce"
+    "documents",
+    "e-commerce"
   ]
 }

blueprints/carbone/docker-compose.yml

@@ -7,10 +7,10 @@ services:
     environment:
       - CARBONE_EE_LICENSE=${CARBONE_KEY}
       - CARBONE_EE_STUDIO=true
-    ports:
+    expose:
       - 4000
     volumes:
       - template:/app/template
 
 volumes:
-  template: 
+  template: 

blueprints/carbone/meta.json

@@ -10,9 +10,9 @@
     "docs": "https://carbone.io/documentation/design/overview/getting-started.html"
   },
   "tags": [
-    "Document Generation",
-    "Automation",
-    "Reporting",
-    "Productivity"
+    "document-generation",
+    "automation",
+    "reporting",
+    "productivity"
   ]
 }

blueprints/casdoor/docker-compose.yml

@@ -30,4 +30,4 @@ services:
 
 volumes:
   casdoor-postgres-data:
-  casdoor-data:
+  casdoor-data:

blueprints/certmate/docker-compose.yml

@@ -0,0 +1,33 @@
+version: "3.8"
+
+services:
+  certmate:
+    image: fabriziosalmi/certmate:2.21.3
+    environment:
+      - FLASK_ENV=production
+      - SECRET_KEY=${SECRET_KEY} # 🔐 Flask session secret
+      - API_BEARER_TOKEN=${API_BEARER_TOKEN} # 🔐 API / web UI token
+      - BEHIND_PROXY=${BEHIND_PROXY}
+      - CLOUDFLARE_TOKEN=${CLOUDFLARE_TOKEN}
+      - LETSENCRYPT_EMAIL=${LETSENCRYPT_EMAIL}
+      - LOG_LEVEL=${LOG_LEVEL}
+    expose:
+      - 8000
+    volumes:
+      - certmate_certificates:/app/certificates
+      - certmate_data:/app/data
+      - certmate_logs:/app/logs
+      - certmate_backups:/app/backups
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+
+volumes:
+  certmate_certificates:
+  certmate_data:
+  certmate_logs:
+  certmate_backups:

blueprints/certmate/instructions.md

@@ -0,0 +1,13 @@
+# CertMate
+
+## Getting started
+
+1. Deploy the template and open the app domain.
+2. Log in with the **API bearer token**: it is auto-generated by the template and stored in the `API_BEARER_TOKEN` environment variable (Dokploy → your service → Environment). The same token authenticates REST API requests (`Authorization: Bearer <token>`).
+3. In **Settings**, set your Let's Encrypt email and add credentials for your DNS provider (Cloudflare, Route53, etc.) to issue certificates through DNS-01 challenges.
+
+## Notes
+
+- `CLOUDFLARE_TOKEN` can optionally be set as an environment variable instead of configuring it in the UI.
+- Certificates, application data and backups are persisted in the `certmate_certificates`, `certmate_data` and `certmate_backups` volumes.
+- API documentation is available at `/docs/` (Swagger) and `/redoc/` on your domain.

blueprints/certmate/meta.json

@@ -0,0 +1,18 @@
+{
+  "id": "certmate",
+  "name": "CertMate",
+  "version": "2.21.3",
+  "description": "CertMate is an SSL certificate management system with a web UI and REST API. It automates issuing and renewing Let's Encrypt certificates via DNS-01 challenges across 20+ DNS providers, with unified backups and multi-account support.",
+  "logo": "logo.png",
+  "links": {
+    "github": "https://github.com/fabriziosalmi/certmate",
+    "website": "https://www.certmate.org/",
+    "docs": "https://www.certmate.org/docs/"
+  },
+  "tags": [
+    "ssl",
+    "certificates",
+    "security",
+    "self-hosted"
+  ]
+}

blueprints/certmate/template.toml

@@ -0,0 +1,20 @@
+[variables]
+main_domain = "${domain}"
+SECRET_KEY = "${password:32}"
+API_BEARER_TOKEN = "${password:32}"
+
+[config]
+mounts = []
+
+[[config.domains]]
+serviceName = "certmate"
+port = 8000
+host = "${main_domain}"
+
+[config.env]
+SECRET_KEY = "${SECRET_KEY}" # 🔐 Flask session secret
+API_BEARER_TOKEN = "${API_BEARER_TOKEN}" # 🔐 API / web UI token
+BEHIND_PROXY = "true"
+CLOUDFLARE_TOKEN = ""
+LETSENCRYPT_EMAIL = ""
+LOG_LEVEL = "INFO"

blueprints/changedetection/docker-compose.yml

@@ -4,10 +4,10 @@ services:
   changedetection:
     image: ghcr.io/dgtlmoon/changedetection.io:0.49
     restart: unless-stopped
-    ports:
+    expose:
       - 5000
     volumes:
       - datastore:/datastore
 
 volumes:
-  datastore: 
+  datastore: 

blueprints/changedetection/meta.json

@@ -10,8 +10,8 @@
     "docs": "https://github.com/dgtlmoon/changedetection.io/wiki"
   },
   "tags": [
-    "Monitoring",
-    "Data",
-    "Notifications"
+    "monitoring",
+    "data",
+    "notifications"
   ]
 }

blueprints/chatto/docker-compose.yml

@@ -2,7 +2,7 @@ version: "3.8"
 
 services:
   chatto:
-    image: ghcr.io/chattocorp/chatto:0.3.8
+    image: ghcr.io/chattocorp/chatto:0.4
     restart: unless-stopped
     expose:
       - "4000"

blueprints/chatto/meta.json

@@ -1,7 +1,7 @@
 {
   "id": "chatto",
   "name": "Chatto (single binary)",
-  "version": "0.3.8",
+  "version": "0.4.x",
   "description": "A fully-featured real-time chat application for teams and communities. This template deploys the single Chatto binary with embedded NATS. Note: email/password registration requires SMTP to be configured after deployment; voice/video calls are not included in the single-binary setup.",
   "logo": "logo.png",
   "links": {

blueprints/chatwoot/docker-compose.yml

@@ -76,4 +76,4 @@ services:
 volumes:
   chatwoot-storage:
   chatwoot-postgres-data:
-  chatwoot-redis-data:
+  chatwoot-redis-data:

blueprints/checkcle/template.toml

@@ -2,13 +2,10 @@
 main_domain = "${domain}"
 
 [config]
+mounts = []
 [[config.domains]]
 serviceName = "checkcle"
 port = 8090
 host = "${main_domain}"
 
 [config.env]
-
-[[config.mounts]]
-source = "checkcle-data"
-target = "/mnt/pb_data"

blueprints/checkmate/docker-compose.yml

@@ -3,7 +3,7 @@ services:
   server:
     image: ghcr.io/bluewave-labs/checkmate-backend-mono:latest
     restart: always
-    ports:
+    expose:
       - 52345
     environment:
       - UPTIME_APP_API_BASE_URL=${UPTIME_APP_API_BASE_URL}

blueprints/chevereto/docker-compose.yml

@@ -15,7 +15,7 @@ services:
       - CHEVERETO_HTTPS=0
       - CHEVERETO_MAX_POST_SIZE=2G
       - CHEVERETO_MAX_UPLOAD_SIZE=2G
-    ports:
+    expose:
       - 80
     volumes:
       - storage:/var/www/html/images/
@@ -35,4 +35,4 @@ services:
 
 volumes:
   storage:
-  mysql: 
+  mysql: 

blueprints/chevereto/meta.json

@@ -10,10 +10,10 @@
     "docs": "https://v4-docs.chevereto.com/"
   },
   "tags": [
-    "Image Hosting",
-    "File Management",
-    "Open Source",
-    "Multi-User",
-    "Private Albums"
+    "image-hosting",
+    "file-management",
+    "open-source",
+    "multi-user",
+    "private-albums"
   ]
 }

blueprints/chibisafe/docker-compose.yml

@@ -6,8 +6,6 @@
 services:
   chibisafe:
     image: chibisafe/chibisafe:latest
-    networks:
-      - chibinet
     environment:
       - BASE_API_URL=http://chibisafe_server:8000
     restart: unless-stopped
@@ -20,8 +18,6 @@ services:
 
   chibisafe_server:
     image: chibisafe/chibisafe-server:latest
-    networks:
-      - chibinet
     volumes:
       - database:/app/database:rw
       - uploads:/app/uploads:rw
@@ -43,8 +39,6 @@ services:
 
   caddy:
     image: caddy:2-alpine
-    networks:
-      - chibinet
     volumes:
       - ../files/Caddyfile:/etc/caddy/Caddyfile:ro
       - uploads:/app/uploads:ro
@@ -62,8 +56,3 @@ volumes:
   database:
   uploads:
   logs:
-
-networks:
-  chibinet:
-    driver: bridge
-    internal: true

blueprints/chibisafe/meta.json

@@ -10,7 +10,7 @@
     "docs": "https://chibisafe.app/docs/intro"
   },
   "tags": [
-    "media system",
+    "media-system",
     "storage",
     "file-sharing"
   ]

blueprints/chiefonboarding/docker-compose.yml

@@ -8,7 +8,7 @@ services:
       - SECRET_KEY=${SECRET_KEY}
       - DATABASE_URL=postgres://postgres:${DB_PASSWORD}@db:5432/chiefonboarding
       - ALLOWED_HOSTS=${DOMAIN}
-    ports:
+    expose:
       - 8000
     depends_on:
       - db
@@ -23,4 +23,4 @@ services:
       - postgres_data:/var/lib/postgresql/data
 
 volumes:
-  postgres_data: 
+  postgres_data: 

blueprints/chiefonboarding/meta.json

@@ -10,10 +10,10 @@
     "docs": "https://docs.chiefonboarding.com/"
   },
   "tags": [
-    "Employee Onboarding",
-    "HR Management",
-    "Task Tracking",
-    "Role-Based Access",
-    "Document Management"
+    "employee-onboarding",
+    "hr-management",
+    "task-tracking",
+    "role-based-access",
+    "document-management"
   ]
 }

blueprints/chirpstack/docker-compose.yml

@@ -5,7 +5,7 @@ services:
     restart: unless-stopped
     volumes:
       - ../files/chirpstack:/etc/chirpstack
-    ports:
+    expose:
       - 8080
     environment:
       - MQTT_BROKER_HOST=mosquitto
@@ -21,7 +21,7 @@ services:
     restart: unless-stopped
     volumes:
       - ../files/chirpstack-gateway-bridge:/etc/chirpstack-gateway-bridge
-    ports:
+    expose:
       - 1700/udp
     environment:
       - INTEGRATION__MQTT__EVENT_TOPIC_TEMPLATE=eu868/gateway/{{ .GatewayID }}/event/{{ .EventType }}
@@ -36,7 +36,7 @@ services:
     restart: unless-stopped
     volumes:
       - ../files/chirpstack-gateway-bridge:/etc/chirpstack-gateway-bridge
-    ports:
+    expose:
       - 3001
     depends_on:
       - mosquitto
@@ -45,7 +45,7 @@ services:
     image: chirpstack/chirpstack-rest-api:4
     restart: unless-stopped
     command: --server chirpstack:8080 --bind 0.0.0.0:8090 --insecure
-    ports:
+    expose:
       - 8090
     depends_on:
       - chirpstack
@@ -73,9 +73,8 @@ services:
     restart: unless-stopped
     volumes:
       - ../files/mosquitto/config/:/mosquitto/config/
-    ports:
+    expose:
       - 1883
-
 volumes:
   postgresqldata:
   redisdata:

blueprints/chromium/docker-compose.yml

@@ -3,7 +3,7 @@ version: "3"
 services:
   chromium:
     image: lscr.io/linuxserver/chromium:5f5dd27e-ls102
-    ports:
+    expose:
       - "3000"
     environment:
       - PUID=1000
@@ -13,4 +13,4 @@ services:
       - config:/config
 
 volumes:
-  config: 
+  config: 

blueprints/classicpress/docker-compose.yml

@@ -3,7 +3,7 @@ version: "3"
 services:
   classicpress:
     image: classicpress/classicpress:php8.3-apache
-    ports:
+    expose:
       - "80"
     environment:
       - WORDPRESS_DB_HOST=db
@@ -27,4 +27,4 @@ services:
 
 volumes:
   wordpress-data:
-  db-data: 
+  db-data: 

blueprints/cloud9/docker-compose.yml

@@ -3,7 +3,7 @@ version: "3"
 services:
   cloud9:
     image: lscr.io/linuxserver/cloud9:1.29.2
-    ports:
+    expose:
       - "8000"
     environment:
       - PUID=1000
@@ -17,4 +17,4 @@ services:
       - code:/code
 
 volumes:
-  code: 
+  code: 

blueprints/cloudcommander/docker-compose.yml

@@ -3,7 +3,7 @@ version: "3"
 services:
   cloudcmd:
     image: coderaiser/cloudcmd:18.5.1
-    ports:
+    expose:
       - "80"
     environment:
       - CLOUDCMD_ROOT=/mnt/fs
@@ -12,4 +12,4 @@ services:
       - CLOUDCMD_PASSWORD=${PASSWORD}
     volumes:
       - /root:/root
-      - /:/mnt/fs 
+      - /:/mnt/fs 

blueprints/cockpit/docker-compose.yml

@@ -3,7 +3,7 @@ version: "3"
 services:
   cockpit:
     image: cockpithq/cockpit:core-2.11.0
-    ports:
+    expose:
       - "80"
     environment:
       - COCKPIT_SESSION_NAME=cockpit
@@ -11,8 +11,8 @@ services:
       - COCKPIT_DATABASE_SERVER=mongodb://${MONGO_USERNAME}:${MONGO_PASSWORD}@mongo:27017
       - COCKPIT_DATABASE_NAME=cockpit
     volumes:
-      - html:/var/www/html
-      - data:/var/www/html/storage/data
+      - config:/var/www/html/config
+      - storage:/var/www/html/storage
     depends_on:
       - mongo
 
@@ -25,6 +25,6 @@ services:
       - mongo-data:/data/db
 
 volumes:
-  html:
-  data:
-  mongo-data: 
+  config:
+  storage:
+  mongo-data: 

blueprints/codex-docs/docker-compose.yml

@@ -3,7 +3,7 @@ version: "3"
 services:
   codex:
     image: ghcr.io/codex-team/codex.docs:v2.2
-    ports:
+    expose:
       - "3000"
     environment:
       - APP_CONFIG_database_driver=mongodb
@@ -28,4 +28,4 @@ services:
 volumes:
   uploads:
   db:
-  mongo-data: 
+  mongo-data: 

blueprints/collabora-office/docker-compose.yml

@@ -3,10 +3,10 @@ version: "3"
 services:
   collabora:
     image: collabora/code:latest
-    ports:
+    expose:
       - "9980"
     environment:
       - domain=${DOMAIN}
       - username=${USERNAME}
       - password=${PASSWORD}
-      - extra_params=--o:ssl.enable=false 
+      - extra_params=--o:ssl.enable=false 

blueprints/commafeed/docker-compose.yml

@@ -5,5 +5,5 @@ services:
     restart: unless-stopped
     volumes:
       - ../files/commafeed-data:/commafeed/data
-    ports:
+    expose:
       - 8082