The template shipped every S3_* variable empty while the compose requires
them, so it could never deploy. Feedbacks needs an HTTPS S3 endpoint in
production: the template now ships SeaweedFS (minio images are no longer
pullable) with a self-signed cert generated on first start and trusted via
NODE_EXTRA_CA_CERTS, plus a one-shot bucket job. External S3 can still be
used by overriding S3_*. The image digest is pinned in the compose file.
Verified on Dokploy: feedbacks returns 200, all services healthy.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The product's own copy rule reads a numeral in front of a bare "engines" as the
count of drivers it ships, which is twenty-six. Fifty-four is the total once the
twenty-eight engines that speak an existing driver's wire protocol are counted,
so it needs the narrower noun the upstream README uses for the same figure.
Dokploy does not substitute variables in object items of an env array, so the
three [[config.env]] tables reached the container as literal ${...} and the app
started with empty ADMIN_PASSWORD, USER_PASSWORD and JWT_SECRET. The
[config.env] table form, which every other blueprint in this repo uses,
substitutes correctly. Same change as #1201.
0.18.0 is the current release. The description's engine count moves with it:
this release ships twenty-six drivers reaching fifty-four named engines,
where 0.17.0 reached forty-six.
0.16.2 was current when this branch was last refreshed. The description also
said sixteen engines; 0.17.0 reaches eighteen, because Prometheus and Apache
Kafka were added since.
Adds the appwrite-mqtt push broker (MQTT over WebSocket on mqtt.<domain>), replaces the removed _APP_CONSOLE_URL_SCHEME with _APP_CONSOLE_URL, adds _APP_PWNED_PASSWORDS_DSN, and moves the console to 1.1.159, orchestrator to 2.2.2 and autogravity to 0.0.11 to match the stock 2.3.0 installer.
Dokploy v0.29.3 to v0.29.13 deploys templates with isolated deployment on unless the template sets isolated = false (older releases always isolate, v0.29.14+ never does by default). That mode attaches every service to an external <appName> network and never creates <appName>_default, so the orchestrator starts build jobs on a network that does not exist and the executor puts runtimes on a network of its own. The orchestrator cannot create or join networks itself, and the repo validator rejects a networks section, so the template opts out of isolation to keep the default network every service shares.
Run the headless Orca runtime (orca serve) on Dokploy. Orca publishes
no container image, so the compose builds one from the pinned upstream
release AppImage (amd64 or arm64) on Ubuntu 24.04, following the
official headless Linux server guide.
The runtime is served on one domain for both the WebSocket endpoint and
the web client. ORCA_PAIRING_ADDRESS sets the address advertised in
pairing links, and ORCA_SERVE_ARGS passes extra serve flags such as
--mobile-pairing for the Orca mobile app.
S3-compatible gateway over a POSIX backend with versioning, flat-file IAM
and the built-in WebUI exposed on the domain; S3 API and admin API ports
stay internal per the upstream Docker guide.
Picks up the 2.1 and 2.2 releases on top of the 2.0 rebuild: console
1.1.96 self-hosted build, orchestrator 2.2.0, the autogravity service, and
the env changes from those releases (executions are ClickHouse only, the
pool adapter and legacy logging providers are gone).
- Bump metabase/metabase image from v0.50.8 to v0.63.18
- Bump postgres from 14 to 16 and persist data with a named volume
- Generate the database password via the password helper instead of
hardcoding it
- Add restart policy, expose port and depends_on with healthchecks
Clearing ANON_KEY and SERVICE_ROLE_KEY is a supported mode — Envoy guards
every legacy branch — but four places broke when you did it. storage,
studio, functions and the realtime healthcheck all read the legacy pair
directly, and storage can never use an sb_ key because it calls PostgREST
at rest:3000 and never traverses the gateway. All four now resolve
${ANON_KEY:-${ANON_KEY_ASYMMETRIC}}. Verified with docker compose config
against a real deployment env: all six land on the ES256 JWTs and the
healthcheck token is non-empty.
Storage S3 block, with the three traps: REGION is read as the S3 signing
region when STORAGE_S3_REGION is unset, and this template ships it as
"stub"; STORAGE_S3_DISABLE_CHECKSUM is needed for providers that reject
the SDK's CRC32 and appears in no upstream file; GLOBAL_S3_PROTOCOL is
in the official compose and read nowhere in supabase/storage. Also noted
that imgproxy needs no S3 config — storage hands it a presigned URL.
STORAGE_TENANT_ID is the top-level key prefix, so it is permanent.
Two more warnings from a real first deploy: the domain is interpolated at
creation, so editing the Domains tab later leaves API_EXTERNAL_URL — and
therefore every token's iss — pointing at the old host; and the ES256
six-value swap does not touch the legacy pair.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Three fixes found by deploying this blueprint and testing it surface by surface.
The functions service sets SUPABASE_URL to the internal gateway address, while
Auth signs tokens with API_EXTERNAL_URL as the issuer. Supabase's own edge
function JWT helper (_shared/jwt/default.ts) derives its expected issuer from
SUPABASE_URL unless SB_JWT_ISSUER is set, so it rejects every valid token with
an issuer mismatch. Passing SB_JWT_ISSUER through fixes that, and is inert for
functions that do not read it.
The ES256 procedure had three problems. It told you to clone supabase/supabase,
which is a very large monorepo, for one 7 KB script; fetching that file is
enough and node is its only requirement. It omitted --update-env, without which
only four of the six values are printed at all — ANON_KEY_ASYMMETRIC and
SERVICE_ROLE_KEY_ASYMMETRIC reach .env alone, so "replace all six with the ones
it prints" could not be followed. And the script exits 1 after writing the keys,
because it then looks for a docker-compose.yml to patch that is not there and
need not be, since this blueprint already wires all four variables; that made a
successful run look like a failure.
Also documents that pg_graphql is not installed on a fresh database, so the
/graphql/v1 route the gateway already exposes answers with an error until one
statement is run. The hosted platform ships it enabled, so this is a real
difference for code moving across.
Verified against a live deployment: the documented steps run as written, all six
values land, and the issuer now matches so edge-function JWT verification
succeeds. Blueprint validators and generate-meta --check all pass.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017DjX4ai6xiixeV8knW9Hpa
Appwrite 2.0 replaces the engine, ships the new root-path console and
defaults new installs to PostgreSQL, so the template is rebuilt from the
stock 2.0.0 installer output rather than bumped:
- PostgreSQL (appwrite/postgres) is the database; MariaDB/MongoDB and
their init mounts are dropped.
- Combined worker/scheduler topology (appwrite-worker, appwrite-task-scheduler)
replaces the per-queue worker containers.
- New services: orchestrator (builds), clickhouse (usage/executions),
appwrite-geo; executor bumped to 0.29.0, console to appwrite/new.
- Console is served at / with the API on /v1 and /.well-known and the
realtime server on /v1/realtime.
- Runtime and build containers join the stack's own Compose network and
the builds volume is pinned per project via COMPOSE_PROJECT_NAME.
The template generates SUPABASE_PUBLIC_URL, API_EXTERNAL_URL and
ADDITIONAL_REDIRECT_URLS with https://, which is right for a public domain with
a certificate. Dokploy creates the template's domain with none, so until one is
enabled the domain answers on http only and those three values point at a
scheme that does not respond.
Measured on a live deploy: the stack reports 11/11 healthy and the gateway
answers http with Studio's 401 basic-auth challenge, while https returns 404 —
so nothing looks broken, but Studio's own calls fail, Envoy's CORS check
compares Origin against the https string and refuses, and GoTrue builds its
issuer, OAuth redirects and email links from the dead scheme.
Also records that Let's Encrypt cannot rescue a private address: an sslip.io
name pointing at a Tailscale 100.x or a LAN address cannot be validated.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A multi-agent audit of the Envoy port compared the blueprint against
supabase/supabase@master, against Dokploy's own source, and against the repo's
conventions. Three findings survived an adversarial refute pass and two more
were traced to the same cause. All five are divergences from official that
predate this branch, but they sit on the surface this branch touches.
- template.toml: API_EXTERNAL_URL gains /auth/v1, matching official
docker/.env.example:101 since supabase e7abda8d (PR #47640, 2026-07-07).
Without it GoTrue advertises https://<domain>/callback for every OAuth and
SAML flow, and Envoy's lds routes bare /callback to the `/` catch-all — that
is Studio, not auth. Measured: /auth/v1/authorize returns GoTrue's 400, while
/callback returns Studio's 401 basic-auth challenge.
- template.toml: add the /volumes/functions/deno.jsonc import map and point
main/index.ts at it, and take official's `hello` sample. Upstream shipped
these in 9ef9f1b8 (2026-08-14) and f5f897a2 (2026-08-28); the blueprint's
functions volume was still at the 2023-era deno.land/std sample with
importMapPath = null, so no function written against current Supabase docs
could resolve @supabase/server. Also injects SUPABASE_FUNCTION_SLUG.
- docker-compose.yml: restore official's SELinux flags on the shared functions
directory — `:z` not `:Z`, and `:ro` back on Studio's copy. `:Z` applies a
private MCS label, so mounting one host directory into two containers with
it revokes the first container's access on an SELinux host. Every other bind
flag in the file already matched official; these three were the only drift.
- meta.json: version becomes 2026.08.03-3. The images are unchanged from
official's 2026.08.03 snapshot, so 2026.08.17 advertised a state the template
does not ship.
- template.toml: API_GW_HTTP_PORT is inert, because the port is pinned by
`expose` and by the domain block. The comment above it said the opposite.
- instructions.md: two operational gaps the audit surfaced. Renaming kong to
api-gw makes Dokploy reject a redeploy of an existing service until the
domain's Service Name is edited. And the Postgres data directory is a bind
mount, so Dokploy's Volume Backups cannot see it, deleting the service
destroys it regardless of the delete-volumes toggle, and "redeploy with fresh
volumes" does not reset the database.
Re-verified end to end on Docker 29.4.0: all three repo validators pass, all 11
services healthy, and the eight original checks still pass. Two new ones: the
hello sample returns 200 {"message":"Hello from Edge Functions!"} for both
sb_publishable_ and sb_secret_ keys — proving the import map resolves — and
/auth/v1/settings and /auth/v1/authorize reach GoTrue.
Note a deliberate behaviour change from official: the new sample declares
auth: ["publishable","secret"], so a legacy anon JWT now gets a 401 with an
explanatory INVALID_API_KEY body where the old sample accepted it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Official Supabase made Envoy the default API gateway on 2026-08-11 (PR #48153,
self-hosted release 0.8.0) and shipped a CORS fix for /pg/ routes on 2026-08-17
(PR #49136) that only Envoy carries. This blueprint still shipped Kong.
Changes:
- docker-compose.yml: rename `kong` to `api-gw`, on envoyproxy/envoy:v1.39.0.
TCP healthcheck because the image has no curl or wget. Expose 8000 only —
Envoy has no 8443 listener. Env vars follow official: ANON_KEY /
SERVICE_ROLE_KEY replace SUPABASE_ANON_KEY / SUPABASE_SERVICE_KEY, every
KONG_* is dropped, and SUPABASE_PUBLIC_URL is added for #49136. Rename the
three internal references to the gateway, and add official's `functions`
healthcheck.
- template.toml: swap the two Kong mounts for the four envoy ones, copied from
supabase/supabase@master. serviceName becomes `api-gw`; KONG_HTTP_PORT
becomes API_GW_HTTP_PORT and KONG_HTTPS_PORT is dropped.
- meta.json: version marker names the Envoy switch.
- instructions.md: Kong replaced by Envoy in all four places, plus a note that
Studio's basic-auth credential is a SHA1+base64 hash of DASHBOARD_PASSWORD
computed by Envoy's entrypoint at startup.
Two Dokploy adaptations, deliberate and both needed:
- No `networks:` aliases block and no `ports:` mapping — validate-docker-compose
rejects both. The alias exists upstream only for backwards compatibility, and
nothing here still points at `kong`.
- cds.yaml points the realtime cluster at `realtime`, not at official's
`realtime-dev.supabase-realtime` container_name, because this blueprint sets
no container_name. lds.template.yaml is byte-identical to official, so the
Host header realtime uses for tenant resolution is unchanged.
Verified locally against Docker 29.4.0 / Compose v5.1.2, rendering the template
the way Dokploy does. All 11 services healthy; legacy keys work; sb_publishable_
is blocked by RLS while sb_secret_ reads the row; Studio basic auth challenges
and accepts; /realtime/v1/api/tenants and /realtime/v1/api/openapi return 403
and the /rest/v1/ root stays service-role only; an OPTIONS to /pg/ returns
access-control-allow-origin matching SUPABASE_PUBLIC_URL; a realtime channel
join over ?apikey=sb_publishable_… replies status ok; and the sample edge
function returns its response.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Self-hosted OpenStatus (status pages + uptime monitoring) following the
official docker-compose.github-packages.yaml setup: local libSQL database,
one-shot migration runner built from the pinned upstream commit, workflows,
API server, dashboard, status-page, and the private-location ingest server.
All app images pinned to upstream commit e1a9825; Tinybird analytics run in
no-op mode by default.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Same root cause as odoo_19 (#1108, fixed in #1110): the compose file
bind-mounts ../files/config over /etc/odoo, but with mounts = [] the
directory is empty, hiding the image's /etc/odoo/odoo.conf. As a result
wait-for-psql.py crashes with configparser.NoSectionError: No section:
'options' and the web container never starts.
Ship odoo.conf through the template config mount instead, with
proxy_mode enabled so websocket/POS/livechat work behind Traefik.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(postiz): pass all social provider env vars and fix Temporal healthcheck
* fix(postiz): drop env vars Postiz does not read, unset NOT_SECURED
- GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET are not read by Postiz:
the Google auth provider and GMB both use YOUTUBE_CLIENT_ID
(google.provider.ts, gmb.provider.ts).
- NEXT_PUBLIC_FRONTEND_URL does not exist in the Postiz codebase.
- Postiz checks NOT_SECURED for truthiness only, so the string
"false" still enables insecure mode; remove the variable so
secure cookies are actually on for the HTTPS deployment.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Mauricio Siu <mauricio@dokploy.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* data permission right & Traefik configuration
Permession to write on data directory is mandatory for odoo server to run
Added Traefik configuration to allow POS and live chat to run
* fix(odoo_19): provide odoo.conf via config mount and enable proxy_mode
The empty ../files/config bind mount was hiding the image's
/etc/odoo/odoo.conf, crashing wait-for-psql.py (NoSectionError:
'options') in a restart loop. Ship odoo.conf through the template
mount instead, with proxy_mode enabled so websocket/POS/livechat
work behind Traefik (threaded mode serves /websocket on 8069, so
no extra routing is needed). Revert the manual Traefik labels
(invalid compose: labels must be a mapping; Dokploy generates
routing from template.toml) and the chown command (the named
volume already gets odoo ownership from the image).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Mauricio Siu <mauricio@dokploy.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
- ghcr.io/plausible/community-edition v2.1.5 -> v3.2.1 (latest stable release)
- clickhouse-server 24.3.3.102-alpine -> 24.12-alpine, matching the official
CE v3.2.1 compose.yml
- CLICKHOUSE_SKIP_USER_SETUP=1 on the events db: required by ClickHouse
24.11+ images so Plausible can connect as the passwordless default user
(without it the app crash-loops with AUTHENTICATION_FAILED)
- plausible-data volume + TMPDIR per the official v3 compose
Deploy-verified on a Dokploy instance: fresh import, all 3 containers
running, HTTP 200 on the domain with the Plausible login page.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
#1107 targeted main instead of canary and was squash-merged there. This merge
brings blueprints/openseo into canary and keeps both histories converged so
the next canary->main release stays conflict-free.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Add OpenSEO template
OpenSEO is an open source, self-hosted alternative to Semrush and
Ahrefs (keyword research, rank tracking, backlinks, site audits).
Requires a DataForSEO API key, which the template leaves blank for
the user to fill in via the Dokploy UI.
* openseo: pin image to v0.1.6 and set ALLOWED_HOST so Vite preview accepts the Dokploy domain
---------
Co-authored-by: Mauricio Siu <mauricio@dokploy.com>
* fix(appwrite): enable HTTPS for function API endpoint
* appwrite: document that _APP_OPTIONS_FORCE_HTTPS=enabled requires an HTTPS domain
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Mauricio Siu <mauricio@dokploy.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: update calcom image version and add QOL Env Var for public signup
* fix: add quotes to env var definition
* fix: add more information for selfhosting
* feat: add env vars and config for Email SMTP Creds
* chore(calcom): bump meta.json version to v6.2.0 and fix ARM comment line reference
---------
Co-authored-by: Mauricio Siu <mauricio@dokploy.com>
* feat: add Instatic template
Instatic is a self-hosted, open-source visual CMS combining a canvas
editor, content engine, and static site publisher. Deployed as a
single container backed by SQLite, with uploads and DB on one
persistent volume.
Signed-off-by: Tekena Solomon <tekena157@gmail.com>
* fix: add init container to fix Instatic storage volume permissions
Signed-off-by: Tekena Solomon <tekena157@gmail.com>
* fix(instatic): accept both https and http public origins so the setup wizard works before HTTPS is enabled
---------
Signed-off-by: Tekena Solomon <tekena157@gmail.com>
Co-authored-by: Mauricio Siu <mauricio@dokploy.com>
- rustrak-full: the Next.js standalone UI bound to $HOSTNAME (container id),
so Traefik got connection refused and the UI domain returned 502 (pre-existing
on canary, confirmed by deploying both #1102 and canary). HOSTNAME=0.0.0.0
was deploy-verified: UI 200 "Rustrak - Error Tracking System".
- trmnl-larapaper: #1101 bumped to 0.33.0 (Apr 2026); upstream is at 0.40.0.
0.40.0 was deploy-verified on the same template: healthy, /, /login,
/register, /up all 200.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Both Rustrak blueprints shipped abians7/* images pinned to v0.2.1, twelve
minor versions behind the current release, and linked to the old personal
repo. Updated to the official rustrak/* images on latest, refreshed the
metadata, and replaced the logo with the current mark.
The memory figure in the description is now measured rather than estimated:
32 MB resident at idle with SQLite, from docker stats on these images.
* feat: add postgres-pgadmin template
* feat: expose postgres via second domain
Add postgres_domain variable and second [[config.domains]] for
postgres:5432 alongside pgadmin:80, so both the DB and the web UI
are reachable via Dokploy domains.
* fix(postgres-pgadmin): drop HTTP domain on postgres:5432, pre-register server in pgAdmin, bump pgAdmin to 9.17
- Remove the second [[config.domains]] pointing an HTTP host at postgres:5432 (Traefik returned 502).
- Mount servers.json + pgpass via config.mounts so pgAdmin comes with the bundled PostgreSQL pre-registered and connects without a password prompt (pgpass is copied to the data volume with 0600 for uid 5050).
- Bump dpage/pgadmin4 8.13 -> 9.17.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Mauricio Siu <mauricio@dokploy.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
- ghcr.io/trixtylab/kotonoba:latest -> 1.0.19 (same digest as latest today); meta.json version 1.0.19.
- ADMIN_DOMAIN is documented upstream as a bare hostname, pass ${main_domain} without scheme.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Instatic is a self-hosted, open-source visual CMS combining a canvas
editor, content engine, and static site publisher. Deployed as a
single container backed by SQLite, with uploads and DB on one
persistent volume.
Signed-off-by: Tekena Solomon <tekena157@gmail.com>
* feat: add DockRoute template
* fix: pass template env vars through to the dockroute container
The compose file had no environment block, so the DOCKROUTE_*/CLOUDFLARE_*
variables defined in template.toml never reached the container - switching
the provider to cloudflare from the Dokploy environment tab would have
silently stayed in the log dry-run mode.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Mauricio Siu <mauricio@dokploy.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Louez is an open-source equipment rental platform (AGPL-3.0): a booking
storefront with live availability plus a back office for reservations,
customers, PDF contracts and statistics.
The blueprint brings up the app, MySQL 8.4 and a private MinIO bucket for
product images. Louez installs its own database schema on first boot.
Didacta is a fair-code self-hosted LMS. The blueprint ships the app image
alongside a pgvector-enabled Postgres (the baseline migration runs
CREATE EXTENSION "vector", so a plain postgres image fails on first boot)
and Redis.
A single domain is enough: the container runs the API on :4000 and the web
on :3000, and Next.js rewrites /api/*, /healthz and /readyz to the internal
API, so the domain only targets port 3000.
* Add Langfuse template
Open-source LLM engineering platform: tracing, prompt management,
evaluation and cost/usage analytics for LLM apps.
Stack: langfuse-web + langfuse-worker (image tag 4), Postgres 17,
ClickHouse 25.12, Redis 7, MinIO. Adapted from the official
docker-compose.yml at https://github.com/langfuse/langfuse/blob/main/docker-compose.yml,
with all secrets generated via Dokploy's template.toml helpers instead
of the upstream hardcoded defaults.
MinIO gets its own domain because Langfuse's web UI issues presigned
S3 URLs that the browser fetches directly (media attached to traces),
so that endpoint has to be reachable from outside the internal network.
Validated locally with build-scripts/validate-template.ts,
validate-docker-compose.ts and generate-meta.js --check (all pass),
plus `docker compose config` with sample secrets to confirm the
langfuse-web override of LANGFUSE_S3_MEDIA_UPLOAD_ENDPOINT resolves
correctly. Not yet deployed on a live Dokploy instance.
* fix: bind langfuse-web to 0.0.0.0 so Traefik can reach it
Docker sets HOSTNAME to the container id, and Next.js standalone binds to
it, which resolves to a single network's IP. With Dokploy's proxy network
attached as a second network, Traefik got connection refused (502).
Setting HOSTNAME=0.0.0.0 fixes routing; verified with a live deploy.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Mauricio Siu <mauricio@dokploy.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: add Waxum template
* fix(waxum): pin SQLITE_PATH inside the mounted session volume
Waxum's default SQLite path already resolves inside
WHATSAPP_STORAGE_PATH, so this was already persisted, but make it
explicit so it doesn't depend on undocumented default derivation
surviving a redeploy.
Addresses: https://github.com/Dokploy/templates/pull/1074#pullrequestreview-4883962555
---------
Co-authored-by: fdciabdul <taqin2731@gmail.com>
* fix(supabase): generate the new API keys and wire up JWKS verification
The template has carried the plumbing for Supabase's new opaque API keys
since #872 — kong-entrypoint.sh builds the Lua translation expressions and
kong.yml registers the keys as key-auth credentials — and #1068 added the
studio/kong compose references while aligning with upstream.
But four of the variables that plumbing reads have never been declared in
template.toml, so they never reached the Environment tab:
SUPABASE_PUBLISHABLE_KEY, SUPABASE_SECRET_KEY,
ANON_KEY_ASYMMETRIC, SERVICE_ROLE_KEY_ASYMMETRIC
kong-entrypoint.sh gates on the first two being non-empty, so every deploy
silently took the legacy-only branch and users had no field to fill in.
Generate them from [variables] instead:
- SUPABASE_PUBLISHABLE_KEY / SUPABASE_SECRET_KEY as opaque sb_* strings
- ANON_KEY / SERVICE_ROLE_KEY move to [variables] so ANON_KEY_ASYMMETRIC
and SERVICE_ROLE_KEY_ASYMMETRIC can reuse the same JWT
Kong substitutes whatever token those hold and every backend already
verifies HS256 with JWT_SECRET, so the opaque keys work without an EC
keypair (which the dokploy helpers cannot generate). Clients still only
ever hold an opaque string. JWT_KEYS / JWT_JWKS stay empty as a
documented opt-in for real ES256.
Also fixed while in here:
- JWT_JWKS was missing entirely. GOTRUE_JWT_KEYS was already enabled, so
anyone setting a real JWKS got Auth signing ES256 tokens that PostgREST,
Storage, Realtime and Functions had no way to verify. Wire it into all
four verifiers.
- Restore two routes kong.yml dropped: /realtime/v1/api/tenants and
/realtime/v1/api/openapi were reachable with the anon key, and the
PostgREST OpenAPI root at /rest/v1/ was anon-readable (supabase#42949).
Needs KONG_ROUTER_FLAVOR: expressions, as upstream sets.
- graphql-v1 had key-auth hide_credentials: true. key-auth runs before
request-transformer, so the apikey header was stripped before the Lua
expression could read it and service_role GraphQL requests were
silently downgraded to anon.
- DB_ENC_KEY was hardcoded to the well-known "supabaserealtime" default;
generate REALTIME_DB_ENC_KEY instead.
- functions/main/index.ts was the old remote-JWKS version pinned to
deno.land/x/jose@4.14.4; sync with upstream (jsr:@panva/jose@6 and
local SUPABASE_JWKS).
Verified against all 11 services running locally: an RLS-protected table
confirms anon and publishable keys are blocked while service_role and
secret keys read the row, so the opaque keys really are translated and
not downgraded. Storage and Realtime still verify HS256 with JWT_JWKS
empty. 21/22 end-to-end checks pass; the last was the test not following
Studio's redirect.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(supabase): match dokploy hash helper semantics (length = chars, not bytes)
Dokploy's generateHash(length) returns exactly `length` hex characters,
not `length` random bytes hex-encoded. Realtime requires DB_ENC_KEY to be
exactly 16 characters (AES-128), so ${hash:8} produced an 8-char key and
the realtime container crash-looped. Bump to ${hash:16}, and bump the
opaque API key segments to ${hash:22}/${hash:8} to match the intended
sb_<role>_<22>_<8> shape.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Mauricio Siu <mauricio@dokploy.com>
* feat: add NaviMusic blueprint template with docker-compose and configuration support for NaviMusic #1058
* fix: align NaviMusic blueprint metadata
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix: remove invalid NaviMusic env comment
* fix: pin NaviMusic to 4.1.0 and keep container alive without credentials
4.1.1+ throws at startup unless a valid YouTube OAuth2 refresh token
(interactive device-code flow) is provided, so no placeholder config can
ever boot those tags. 4.1.0 is the newest release that boots without it.
Also wrap the entrypoint so a clean exit (empty/invalid DISCORD_TOKEN is
logged, not thrown) idles with instructions in the logs instead of
restart-looping; non-zero exits still hit the restart policy.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Mauricio Siu <siumauricio@icloud.com>
Co-authored-by: Mauricio Siu <mauricio@dokploy.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: add Novu self-hosted notification template
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat: enhance Novu template with comprehensive environment variable configuration
Added a detailed environment variable section to the Novu template, including secrets, feature flags, service URLs, and database configurations. This update improves clarity and usability for self-hosted deployments.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* Update forgejo template; bumps Forgejo version to 15; fixes git push over ssh
* updates template compose and toml to use internal port mapping
* fix: bump Forgejo to 16, use expose per repo convention, drop HTTP domain on SSH port
- codeberg.org/forgejo/forgejo:15 -> :16 (current stable, 16.0.2)
- ports -> expose (repo convention since #1053; Traefik reaches the
container over the docker network, no host port publishing needed)
- remove the [[config.domains]] entry on port 22: Dokploy domains are
Traefik HTTP routers and cannot proxy SSH (returned 500 in testing)
- drop empty FORGEJO__server__SSH_PORT= and SSH_LISTEN_PORT overrides
(image defaults already listen on 22)
- clean comment/blank entries from template.toml env array
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Mauricio Siu <siumauricio@icloud.com>
Co-authored-by: Mauricio Siu <mauricio@dokploy.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix: normalize template.toml mounts across all blueprints (closes#1047)
- 79 blueprints declared a bare [[config.mounts]] header (one empty array
element in TOML) -> replaced with the repo idiom 'mounts = []'
- 38 blueprints carried doc-style mount blocks (name/mountPath/description)
that don't match the schema (filePath/content) and are inert in Dokploy's
template processor -> removed; their named volumes already live in each
docker-compose.yml
- penpot: duplicate 'expose' map key made its docker-compose.yml invalid
YAML -> merged into one expose list
After this, validate-template.ts passes for all 502 blueprints. The
remaining validate-docker-compose.ts flags are the intentional host-port
templates (mail/game/streaming protocols: poste.io, mailu, oryx, fivem,
lodestone, etc.) which the validator does not yet model as exceptions.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: validator opt-out marker for intentional host ports + annotate rustdesk
The validate-docker-compose CI on this PR was failing on rustdesk's
hbbs/hbbr port mappings (21115-21119) — intentional host-published ports
for the RustDesk relay/rendezvous protocol, which Traefik cannot route.
Adds a '# dokploy: allow-host-ports' top-of-file marker that downgrades
the port-mapping errors to warnings for such protocol templates
(mail/game/streaming/VPN/remote-desktop), and annotates rustdesk.
Other exception templates (poste.io, mailu, oryx, fivem...) can be
annotated case-by-case as the weekly audit (#1049) surfaces them.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Align the template with the current upstream self-hosted stack
(supabase/postgres 17.6.1.136, studio 2026.08.03, kong 3.9.3),
remove the deprecated analytics/vector services and switch
Studio/pg-meta to the postgres role per upstream guidance.
Closes#1067
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Add Yuvomi template
Privacy-first, self-hosted family planner.
- Image pinned to 0.71.10 (latest stable GHCR tag)
- 4 named volumes (data/backups/modules/documents)
- SESSION_SECRET via ${password:64} helper
- Single domain on port 3000
- Healthcheck wired
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* chore(yuvomi): bump image to 1.85.0
The PR pinned ghcr.io/ulsklyc/yuvomi:0.71.10, but upstream's latest
stable release is v1.85.0. Bump the compose image tag and meta.json
version to match.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Mauricio Siu <siumauricio@icloud.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat(templates): add Creed self-host template
Adds a Dokploy blueprint for Creed (creed.md), built from source since
no official Docker image exists yet. Requires an external Supabase
project (schema pushed via the Supabase CLI), so only what can be
generated locally (CREED_ENCRYPTION_SECRET) is auto-filled; Supabase,
Stripe, OpenRouter, Resend, and GitHub OAuth vars are left blank with
setup steps documented in the mounted README.
NEXT_PUBLIC_* vars are threaded through as Docker build args (not just
runtime env), since Next.js inlines them at build time and the app
hard-fails the build if NEXT_PUBLIC_SITE_URL is unset — this was
caught by an actual `docker compose build` run against the upstream
repo, not just template validation.
Verified with docker compose build/up: image builds cleanly, container
boots, / returns 200, and /api/health correctly reports "degraded"
with Supabase unconfigured as expected.
* Pin creed build context and refactor env
- Pin creed docker-compose build context to a specific commit
hash to ensure reproducible builds
- Expose port 3000 in docker-compose (use expose instead of ports)
- Update meta.json version from latest to the pinned hash e9b096d
- Convert template.toml env block from [config.env] to a single env
array
- Keep the README.md mount in place
* Modify docker-compose build context URL
Updated the build context URL to the main branch.
* fix(creed): pin build context and move env under [config]
Restore the commit pin so the inline Dockerfile matches the pre-monorepo
layout, and place env under [config] before domains so Dokploy imports
the environment correctly.
* fix: meta.json of Poke blueprint
The current github/docs links was broken
before:
https://codeberg.org/ashley/poke
after:
https://codeberg.org/ashleyirispuppy/poke
* fix: broken links in some blueprints
* Add openhabittracker blueprint
* fix(affinepro): update to current AFFiNE images
The template pinned ghcr.io/toeverything/affine-graphql:stable-780dd83,
an ephemeral per-commit tag on the old image name that has since been
removed from GHCR, so the template could no longer pull and deploy.
- Switch both app and migration services to ghcr.io/toeverything/affine:stable,
the rolling stable tag recommended by the official self-host compose,
so the template no longer rots when per-commit tags are garbage-collected
- Move postgres to pgvector/pgvector:pg16 and set AFFINE_INDEXER_ENABLED=false,
matching the current upstream self-host compose requirements
- Add postgres/redis healthchecks and proper depends_on conditions so the
self-host-predeploy migration job runs only once the database is ready,
and the server starts only after migrations complete successfully
Closes#777
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(cockpit): persist config and storage volumes per upstream docs
The template mounted `html:/var/www/html` (freezing the app code from the
first deploy) and `data:/var/www/html/storage/data`, which misses uploaded
assets (stored under `storage/uploads`) and cache. Per the official Cockpit
persistent-storage docs, mount `config:/var/www/html/config` and
`storage:/var/www/html/storage` instead.
Closes#549
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(kener): define REDIS_URL and drop unused databases
Kener v4 requires Redis for its BullMQ queues, caching and scheduler,
so the app crashed on startup with "REDIS_URL is not defined in
environment variables" right after printing that it was running
(issue #976). The template also spun up both a postgres and a mariadb
container while DATABASE_URL pointed at SQLite, so neither database
was ever used (issue #282).
Changes, aligned with the upstream docker-compose.yml
(rajnandan1/kener):
- Add a redis:7-alpine service with a healthcheck and persistent
volume, wire REDIS_URL=redis://redis:6379 and make kener depend on
redis being healthy
- Remove the unused postgres and mysql services plus their env vars
and generated passwords; keep SQLite (upstream default) persisted
in the kener_db volume
- Set ORIGIN to https://<domain> instead of http://localhost:3000 so
CSRF protection works behind the generated domain
- Drop the stale /app/uploads bind mount (kener v4 only persists
/app/database) and the obsolete compose version key
Deploy-tested on a Dokploy instance: migrations and seed complete,
schedulers start, "Kener version 4.1.2 is running!", HTTP 200 on the
generated domain, both containers stable.
Closes#976Closes#282
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(homarr): use named volume for /appdata and hex encryption key
- Replace the relative bind mount `../homarr/appdata:/appdata` with a
named volume `homarr_appdata:/appdata` so the data survives cleanups
and can be backed up through Dokploy volume backups.
- Generate SECRET_ENCRYPTION_KEY with `${hash:64}` instead of
`${password:64}`: homarr requires a 64-character hex string
(`openssl rand -hex 32`) and the password helper emits non-hex
characters (g-z).
Closes#738
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(logto): fix postgres role error and update to 1.41.0
The postgres healthcheck ran pg_isready without -U while POSTGRES_USER
was set to logto, so every probe attempted to connect as role
"postgres" and spammed FATAL: role "postgres" does not exist.
Pass -U logto -d logto explicitly and set POSTGRES_DB.
Also fix LOGTO_ENDPOINT pointing at the admin domain instead of the
main domain, update Logto 1.27.0 -> 1.41.0, use ${password:32} for the
generated password, drop the ephemeral host port publishing and add
restart policies.
Closes#130
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(gitlab-ce): serve on the generated domain (remove removed unicorn config, pin omnibus)
The template set unicorn['worker_processes'] / unicorn['worker_timeout'] in
GITLAB_OMNIBUS_CONFIG. Unicorn was removed in GitLab 14.0, so on current
gitlab-ce images `gitlab-ctl reconfigure` aborts with "Removed configurations
found in gitlab.rb" and GitLab never starts serving — the generated domain
returned 502 Bad Gateway (issue #380).
Rewrite the template as the official all-in-one Omnibus setup:
- pin gitlab/gitlab-ce:19.1.2-ce.0 instead of :latest
- external_url http://<domain> with nginx listen_port 80 / listen_https false
(TLS terminates at Traefik)
- set gitlab_rails['initial_root_password'] from a generated template password
- puma single mode + prometheus monitoring off to keep memory reasonable
- drop the external postgres/redis containers (Omnibus bundles and manages
its own) and the broken ports entries ("2224" published a random host port
while sshd listens on 22)
Verified on a live Dokploy instance: domain serves the GitLab sign-in page
and root login with the generated password works.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(zitadel): wire EXTERNALDOMAIN/PORT/SECURE to the generated domain
Zitadel resolves its instance from the external domain/port/scheme, so the
template's ZITADEL_EXTERNALPORT=8080 made every generated URL (OIDC issuer,
login redirects) point at http://<domain>:8080 instead of the domain served
by Traefik, ending in {"code":5,"message":"Not Found"} (#516).
- Expose ZITADEL_EXTERNALDOMAIN / ZITADEL_EXTERNALPORT / ZITADEL_EXTERNALSECURE
as template env vars, defaulting to the generated domain over HTTP
(port 80, secure=false) so the routed domain and Zitadel's external config
always match; HTTPS users flip them to 443/true in the Env tab.
- Pin image to v4.16.0 (was latest) and keep the built-in login v1 via
ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED=false so no separate
login-v2 container is needed.
- Add the official readiness healthcheck, drop the unused /app/data volume,
bogus SMTP env keys, published port and obsolete compose version key.
Closes#516
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(immich): update to v3.0.2
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(automatisch): switch to official image and wire up DOMAIN to fix Bad Gateway
- Replace unofficial dockeriddonuts/automatisch:2.0 mirror (stale since Nov 2024)
with the official automatischio/automatisch:0.15.0 image
- Define DOMAIN in template.toml [config.env]: the compose referenced ${DOMAIN}
but it was never provided, so HOST resolved empty and the app generated
localhost URLs for the web app and webhooks
- Set API_URL/WEB_APP_URL so generated URLs don't carry the internal :3000 port
behind Traefik
- Add postgres healthcheck and gate the app on service_healthy to avoid the
boot-time migration race; worker now starts after main (official compose order)
- Drop unnecessary published port and no-op REDIS_* env on the redis service
- Bump meta.json version to 0.15.0
Closes#97
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(signoz): fix ClickHouse hostname resolution and IPv6 binding
- Override the ClickHouse image's config.d/docker_related_config.xml,
which listens on the IPv6 wildcard address ([::]) first and fails to
bind on hosts without IPv6 support; listen on 0.0.0.0 (IPv4) only and
disable the internal DNS cache so transient startup DNS failures for
zookeeper-1/clickhouse are not cached (issue #534).
- Set hostname: clickhouse (instead of container_name) so the server
identifies itself as the cluster host declared in cluster.xml.
- Remove the explicit signoz-net network: Dokploy attaches its own
networks automatically and the repo validator rejects explicit
networks; a fixed-name shared network also breaks service DNS across
deployments.
- Fix mount mismatch: template.toml created files/signoz/prometheus.xml
while the compose mounts ../files/signoz/prometheus.yml, so Docker
silently mounted a directory as the signoz prometheus config.
- Give the otel-collector domain its own generated host: both domains
previously shared the same host and path "/", creating two conflicting
Traefik routers where one service randomly won.
Closes#534
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(infisical): update to v0.162.6
- Bump image from v0.135.0-postgres to v0.162.6 (upstream dropped the
-postgres tag suffix after v0.146.0; plain tags are the postgres build)
- Remove the db-migration service: the standalone image runs database
migrations automatically on boot (auto-start-migrations), matching the
official docker-compose.prod.yml which no longer ships that service
- Generate ENCRYPTION_KEY (${hash:32}) and AUTH_SECRET (${base64:32})
per deployment instead of shipping hardcoded example secrets
- Fix SITE_URL to http://${main_domain} (no :8080; the domain is proxied)
- Refresh SMTP env names (SMTP_FROM_ADDRESS/SMTP_FROM_NAME; SMTP_SECURE
was removed upstream) and drop unused CLIENT_* env placeholders that
were never passed to the container
Closes#215
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: add databasus (postgresus renamed upstream)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(evolutionapi): enable integration flags and update version
Adds the integration enable env flags introduced in Evolution API v2.3.x
(N8N_ENABLED, OPENAI_ENABLED, EVOAI_ENABLED, DIFY_ENABLED, TYPEBOT_ENABLED,
CHATWOOT_ENABLED) so integrations no longer fail with 'N8n is disabled',
and pins the image to v2.3.7 instead of latest.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(rybbit): update to v2.7.0
The template shipped rybbit v1.5.1, which is no longer supported and is
vulnerable to known React2Shell exploits (see #659). Update to the
latest stable release v2.7.0 and align the stack with the upstream
docker-compose:
- Pin ghcr.io/rybbit-io/rybbit-backend and rybbit-client to v2.7.0
- Add the redis service now required by the backend (session tracking
and BullMQ queues), with password auth, AOF persistence and
noeviction policy per upstream
- Drop the DOMAIN_NAME env var (only used by the upstream Caddy
webserver, which Dokploy replaces with Traefik)
- Add DISABLE_TELEMETRY env and generate BETTER_AUTH_SECRET as base64
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(phpmyadmin): raise PHP upload limit so SQL imports over 2MB work
Without UPLOAD_LIMIT the phpMyAdmin image keeps PHP's default 2M
post_max_size/upload_max_filesize, so importing any SQL file larger
than 2MB fails with 'POST Content-Length exceeds the limit of
2097152 bytes' followed by a session_start error page.
- Add UPLOAD_LIMIT (512M) and MAX_EXECUTION_TIME (600) env vars,
configurable from the template env
- Wire the previously unused MYSQL_DATABASE env var into the compose
file, replacing the hardcoded 'tu_base_de_datos' placeholder, and
default it to 'phpmyadmin' instead of the system 'mysql' schema
Closes#236
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(openpanel): pin verified 2.2.1 images and fix ClickHouse interserver host
- Pin lindesvard/openpanel-api|dashboard|worker to 2.2.1 (verified working
end-to-end on a Dokploy instance) instead of the mutable :2 tag, so a
future broken 2.x release cannot silently break the template again —
which is how #615 originated when 2.0.0 shipped.
- Fix interserver_http_host to match the actual service name (op-ch),
aligning with upstream self-hosting config.
- Set meta.json version to the pinned 2.2.1.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(wordpress): route loopback requests through Traefik to fix cURL error 28
WordPress resolves its own public domain to the server's public IP from
inside the container, so REST API / WP-Cron / Site Health loopback
requests depend on hairpin NAT, which times out (cURL error 28) on many
hosts. Pin the site domain to the dokploy-traefik container IP in
/etc/hosts at startup (with retries, since Traefik joins the compose
network shortly after the container starts) so loopback traffic stays
inside the Docker network for both HTTP and HTTPS. No-op fallback when
dokploy-traefik is not resolvable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(minio): migrate to pgsty/minio community fork (upstream is source-only and archived)
MinIO Inc. stopped publishing Docker images and pre-built binaries in
October 2025 and archived the minio/minio repository in February 2026.
The official minio/minio image is frozen at RELEASE.2025-09-07T16-13-09Z
and no longer receives security fixes (the fix for CVE-2025-62506 was
never published as an image).
- Switch image to pgsty/minio:RELEASE.2026-06-18T00-00-00Z, the actively
maintained community fork (drop-in replacement, AGPLv3, same env vars,
same /data on-disk format, restores the full web console)
- Route the S3 API (port 9000) through its own generated domain instead
of publishing host port 9000, per repo conventions
- Update meta.json links/description to point at the maintained fork
Closes#469
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(nextcloud-aio): drop AIO branding, keep template id, pin nextcloud 33.0.6
The template ships plain nextcloud + mariadb + redis + cron, not the
nextcloud/all-in-one mastercontainer. Display name and description no
longer claim AIO; folder id is kept as nextcloud-aio to avoid breaking
existing installs. Image pinned to the current stable tag (33.0.6).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add MailCatcher NG template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: add per-template setup instructions (supabase, trigger.dev)
Adds instructions.md files for the Supabase and Trigger.dev templates and
renders them in the template browser as a new Instructions tab in the
template dialog (fetched from blueprints/<id>/instructions.md, rendered
with a small dependency-free markdown component).
Also removes the placeholder blueprints/ackee/instructions.md so it does
not surface as an empty Instructions tab.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Weblate template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Synapse (Matrix homeserver) template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Dify template
Dify 1.15.0 (open-source LLM app development platform): api + worker +
worker_beat + web + pgvector PostgreSQL (also used as the vector store) +
redis + sandbox + ssrf_proxy (squid) + plugin_daemon, fronted by an
internal nginx gateway that mirrors the upstream path routing.
Closes#88
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Sim Studio template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Steedos template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Silex template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add SpacetimeDB template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add CertMate template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add PostHog template
Based on the official hobby deployment, trimmed to run on a single
server: Django web + Celery worker, Node plugin-server (CDP, ingestion,
session replay, recording API), Rust capture/replay-capture/
feature-flags/hypercache, livestream, Caddy path router, Postgres,
Redis, Redpanda (Kafka), ZooKeeper, ClickHouse and MinIO.
Images are pinned to a tested master commit (PostHog no longer
publishes tagged releases); an init container fetches the matching
ClickHouse configuration, Kafka table schemas, funnel UDF binaries and
the GeoIP database at the same pinned ref.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Markup template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Frappe LMS template
Adds a Frappe LMS (Frappe Learning) template based on the erpnext-v16
blueprint pattern (configurator + create-site + workers + scheduler +
websocket + mariadb + 3x redis).
Pins ghcr.io/frappe/lms:v2.52.0, the latest upstream image that ships
the lms app (v2.52.1+ images are currently published without any apps
baked in). The image does not bundle the payments app, so create-site
clears lms's required_apps before install; paid-course checkout is
unavailable, everything else works. The backend is gated on a
create-site completion marker so gunicorn workers never serve (and
cache) a half-installed site during the 3-6 minute first boot.
Closes#517
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add TREK template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Oryx (SRS) media streaming template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: stop plugins service crash loop (logs-redis TLS default)
In production images LOGS_REDIS_TLS/TRACES_REDIS_TLS default to true, so
the logs-ingestion consumer (part of the plugin-server default mode) kept
attempting a TLS handshake against the plaintext Redis, timed out every
~11s and killed the process after 10 errors (restart loop every ~2.5 min).
Constrain the plugins service to the capability groups this template
ships (cdp_workflows, realtime_cohorts, feature_flags) and pin the redis
TLS flags to false as belt-and-braces.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add n8n queue mode template
n8n running in queue mode (EXECUTIONS_MODE=queue): main instance for the
editor/webhooks, a scalable pool of workers (deploy.replicas driven by the
N8N_WORKER_REPLICAS env var), Redis (Bull) as the queue broker and
PostgreSQL as the database. Pinned to the current stable n8nio/n8n:2.30.4.
Closes#455
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add bonfire template
Bonfire (social flavour) — federated social networking toolkit.
App + PostGIS + Meilisearch, mirroring upstream's reference deployments.
Closes#125
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add dagu blueprint
Dagu is a self-contained workflow engine with a Web UI for scheduling and
orchestrating jobs as DAGs defined in declarative YAML.
- Pin ghcr.io/dagucloud/dagu:2.10.7 and expose the Web UI on port 8080
- Set DAGU_HOST=0.0.0.0 so the service is reachable through the proxy
- Enable basic auth with a generated per-deploy admin password
- Persist /var/lib/dagu (DAGs, logs, run history) in a named volume
Claude-Session: https://claude.ai/code/session_01CRNT6sa2q2P9rUTokeoGhQ
* feat: add OneUptime template
Adds OneUptime (open-source observability platform: uptime monitoring,
status pages, incident management, on-call, logs/traces/metrics) as a
template, following upstream's current single-app architecture
(app + nginx ingress + postgres + redis + clickhouse + probe).
Closes#514
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Mailu template
Mailu 2024.06 mail server: front (nginx), admin, imap (dovecot),
smtp (postfix), antispam (rspamd), Roundcube webmail and redis.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(templates): add systemprompt (#1032)
* feat(templates): add systemprompt
* fix header comment: accurate in both repos
* chore: normalize template tags to kebab-case (#987)
* feat: adds `check-links.js` to find broken links (#983)
* feat: add struxa template (#1037)
* feat: add struxa template
Adds a Dokploy blueprint for Struxa (github.com/struxadotcloud/struxa),
a self-hosted, open-source server management panel. Deploys the
published GHCR images (dashboard, watchkeeper, migrate) plus MySQL
and MinIO sidecars. The web service generates its RS256 JWT keypair
at startup via Node's built-in crypto module, since no Dokploy
template helper covers RSA key generation.
* fix: pin struxa images to latest floating tag
struxa's release workflow pushes a latest floating tag alongside
version tags on every stable release, matching the convention used
by ~44% of existing blueprints (version: "latest" in meta.json).
* fix: generate a 64-char DATABASE_ENCRYPTION_KEY
Dokploy's runtime \${hash:N} helper produces N hex characters, not N
bytes (the templates repo's local preview helpers.ts models it as
byte count, which is inconsistent with the platform). struxa's env
schema requires DATABASE_ENCRYPTION_KEY to be >=64 chars (it's hex
decoded to a 32-byte AES-256 key), so \${hash:32} only produced half
the required length. Confirmed against other blueprints (sim,
chatwoot, outline) which all use \${hash:64} for 64-char secrets.
* fix: address Copilot review comments
- Add explicit \`version: "3.8"\` to docker-compose.yml, matching the
documented template format.
- Pin minio/minio to a specific RELEASE tag (used elsewhere in the
repo: plane, posthog) instead of the floating latest tag.
- Default BETTER_AUTH_URL/APP_URL/CORS_ORIGIN to http://, matching
repo convention for Dokploy-fronted apps (TLS terminates at the
proxy).
* fix: rename web service to struxa
AGENTS.md convention: the primary Docker service name should match
the blueprint folder name. Renamed the web/dashboard service from
"web" to "struxa" in docker-compose.yml and updated
template.toml's config.domains.serviceName to match.
* Add PodFetch template (#1035)
* Add PodFetch template
* Use env array syntax in template.toml
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Address review: match version to image tag, expose admin_username variable, dark-mode friendly logo
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix(docker): share plugins and themes volumes across containers (#990)
* feat(directus): upgrade template to Directus 12.1.1 (#986)
* feat(directus): upgrade template to Directus 12.1.1
* feat(directus): add commented S3 env variables to template.toml
---------
Co-authored-by: Zakher Masri <46135573+zaaakher@users.noreply.github.com>
Co-authored-by: zakher <zakhermasri@gmail.com>
Co-authored-by: Jinjinov <dzindzinovic@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Stephan Fitzpatrick <stephan@knowsuchagency.com>
Co-authored-by: Mauricio Siu <mauricio@dokploy.com>
Co-authored-by: Edward Burton <ejb503@gmail.com>
Co-authored-by: Marko Kostich <markokosticdev@gmail.com>
Co-authored-by: Jakub Krzyżanowski <jakubkrzyz.kontakt@gmail.com>
Co-authored-by: SamTV12345 <40429738+SamTV12345@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Mafly <110502739+Nekoplii@users.noreply.github.com>
2026-07-20 01:20:53 -06:00
392 changed files with 14008 additions and 2561 deletions
# dokploy: allow-host-ports — DNS (53/tcp+udp), DHCP (67/68) and DNS-over-TLS/QUIC (853) are not HTTP protocols; clients must reach them directly on the host, Traefik cannot route them.
version:"3.8"
services:
adguardhome:
@@ -10,7 +11,8 @@ services:
- "68:68/tcp"# DHCP Client
- "853:853/tcp"# DNS over TLS, DNS-over-QUIC
- "853:853/udp"# DNS over TLS, DNS-over-QUIC
- "6060:6060/tcp"# HTTP (pprof)
expose:
- 6060# HTTP (pprof) — debug endpoint, no need to publish it on the host
# dokploy: allow-host-ports — Anytype clients speak the any-sync protocol (TCP 33010, UDP/QUIC 33020) directly against the server; it is not HTTP, so Traefik cannot route it.
# Example: Any-Sync-Bundle with embedded MongoDB and Redis (all-in-one image)
"description":"Appwrite is an end-to-end platform for building Web, Mobile, Native, or Backend apps, packaged as a set of Docker microservices. It includes both a backend server and a fully integrated hosting solution for deploying static and server-side rendered frontends. Appwrite abstracts the complexity and repetitiveness required to build modern apps from scratch and allows you to build secure, full-stack applications faster.\nUsing Appwrite, you can easily integrate your app with user authentication and multiple sign-in methods, a database for storing and querying users and team data, storage and file management, image manipulation, Cloud Functions, messaging, and more services.",
Dokploy creates independent database, storage, JWT, encryption, and scheduler secrets during import. Only the `web` service receives a public domain; the API, scheduler, PostgreSQL, and MinIO remain private.
## First administrator
1. Open the Compose service's environment settings and copy the generated `ADMIN_EMAILS` value.
2. Open the generated BlogFactory domain and register with that exact email address.
3. Return to the Compose environment settings, change `BLOGFACTORY_ALLOW_SIGNUP` to `false`, and redeploy.
4. Add OpenRouter, CMS, or Google Search Console credentials from BlogFactory only when you need those optional integrations.
BlogFactory sends reviewed content to connected CMS providers as drafts. The template does not grant live-publish or delete authority.
This template deploys the Corsfix dashboard and proxy with MongoDB and Redis.
The dashboard image requires an **x86-64 / amd64 server**.
## Before deploying
1. Dokploy imports template domains without a certificate configuration, so `AUTH_URL` defaults to `http://` followed by the generated dashboard hostname. When enabling **HTTPS** and **Let's Encrypt** in the **Domains** tab, also change `AUTH_URL` in **Environment** to `https://` followed by that hostname and redeploy. This URL must match the public dashboard address, even though Dokploy terminates TLS at the edge. Enable HTTPS for **both** domains before using the playground, which uses HTTPS proxy URLs.
2. If using custom domains, point both DNS records to your server, update the domain entries, and set `APP_DOMAIN` and `PROXY_DOMAIN` in **Environment** to the matching hostnames, without `https://` or a trailing slash. Update `AUTH_URL` to the full public dashboard URL, including its `http://` or `https://` scheme.
3. Deploy, then open the dashboard domain (the `corsfix` service on port `3000`) and create your account with an email address and password. Self-hosted signup does not require an email server.
4. Set `DISABLE_SIGNUP=true` in **Environment** and redeploy after creating the accounts you need.
## Using the proxy
The second domain routes to `corsfix-proxy` on port `80`. Use the dashboard to register your application's origin and permitted target domains, manage secrets, and try requests in the playground.
`RPM` sets the self-hosted rate limit (default: `180` requests per minute). Optional `ALLOWED_ORIGINS` and `ALLOWED_TARGETS` accept comma-separated hostnames for environment-based allowlists; leave them empty to manage applications through the dashboard.
## Persistent data and upgrades
MongoDB stores users, applications, and encrypted secrets in named volumes. Redis uses a named volume with append-only persistence. Preserve these volumes and the generated environment values when upgrading.
Keep a backup of `KEK_VERSION_1`: changing or losing this encryption key makes existing saved secrets unreadable. Do not re-import the template to upgrade an existing installation, because imports generate new credentials and keys. Update the image tags in the existing Compose configuration instead. Changing `MONGODB_PASSWORD` alone does not change the password already stored in MongoDB.
The Corsfix images are pinned to the same upstream commit because the project publishes commit tags rather than numbered releases.
See the [Corsfix self-hosting documentation](https://corsfix.com/docs/open-source/self-hosting) for more information.
"description":"Corsfix is an open source CORS proxy platform for fetching APIs from browser applications, with origin and target allowlists, encrypted API secrets, response caching, and a management dashboard.",
"description":"One personal context file every AI agent reads before answering and proposes updates to as it learns about you. Requires an external Supabase project (see instructions).",
"description":"Self-hosted database backup manager with a web UI. Schedule, backup, and restore MySQL, PostgreSQL, MariaDB, Microsoft SQL Server, MongoDB, SQLite, Firebird and Redis to S3, SFTP, Samba or local storage. SSH tunnel support.",
"description":"One wiki for all your agents. AI agents read and write linked markdown pages over MCP from any machine, and people see what they know in a web app: the link graph, every page and its history.",
"description":"Didacta is a fair-code, self-hosted learning platform (LMS) with multi-tenant isolation, a public course catalog, enrollment flows, gamification and a module marketplace.",
"description":"External-DNS for plain Docker hosts: watches container labels and reconciles DNS records and Cloudflare Tunnel routes, never touching records it cannot prove it manages.",
"description":"Self-hosted chat and messaging server: API, web chat and admin panel, XMPP server (ejabberd) and file storage, with SDKs for web, iOS, Android and React Native.",
"description":"Evolution API is a robust platform dedicated to empowering small businesses with limited resources, going beyond a simple messaging solution via WhatsApp.",
"description":"A high-performance graph database for knowledge graphs, GraphRAG, agent memory, fraud detection and other relationship-heavy workloads. Includes the FalkorDB Browser interface.",
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Mauricio SiuandClaude Opus 5.5
Mauricio SiuandGitHub
xob0tandGitHub
Yusuf Gundogdu
Ragil Burhanudin Pamungkas
Yusuf Gündoğdu
Forrest Zhang
Suyog Dixit
Taras Filatov
Daan Seegers
Florent ClairambaultandClaude Opus 4.8
spacewaterbear
Reynaldi Chernando
Chirag Aggarwal
Skender
Tiziano Zonta
Furox-Art
Release
Alexandre Blause
Abdullah A
Douglas RamírezandGitHub
Web Artisan
lilsnibbi
Carlos Dorneles
Jeremie
Yusuf Gundogdu
Vitaliy Kukharik
Stefan Ernst
Kacper Wyczawski
William HollacsekandClaude Opus 5
Tekena Solomon
Guido Esser
Andrés Sarrazola
xob0t
juancho
moskoweb
BryanFRD
Ghazi Ben DahmaneandGitHub
Steven TranandGitHub
egedemirkaranandGitHub
JavierandGitHub
Bora GökçeandGitHub
Manan SantokiandGitHub
Abbas AgaandGitHub
Vitaliy KukharikandGitHub
Sadiq Al-AboudiandGitHub
Torikul IslamandGitHub
Benjamin NussbaumandGitHub
Abian SuarezandGitHub
Zakher MasriandGitHub
jmaxdev
zakher
Loan TALVATandGitHub
VA360 LABS S.L.andGitHub
taqinandGitHub
Szymon BludnikandGitHub
