[PR #1008] [MERGED] fix(rybbit): update to current version (v2.7.0) #16316

New Issue

GiteaMirror · 2026-07-14T23:19:02-05:00

GiteaMirror commented

2026-07-14 23:19:02 -05:00

📋 Pull Request Information

Original PR: https://github.com/Dokploy/templates/pull/1008
Author: @Siumauricio
Created: 7/14/2026
Status: ✅ Merged
Merged: 7/14/2026
Merged by: @Siumauricio

Base: canary ← Head: fix/rybbit-update

📝 Commits (1)

2556321 fix(rybbit): update to v2.7.0

📊 Changes

3 files changed (+50 additions, -10 deletions)

View changed files

📝 blueprints/rybbit/docker-compose.yml (+45 -7)
📝 blueprints/rybbit/meta.json (+1 -1)
📝 blueprints/rybbit/template.toml (+4 -2)

📄 Description

Summary

The rybbit template was pinned to v1.5.1, which is no longer supported and is vulnerable to known React2Shell exploits — the "unexpected activity" reported in the client containers in #659. This updates the template to the latest stable upstream release, v2.7.0 (2026-07-07), and aligns the stack with the current official docker-compose:

Pin ghcr.io/rybbit-io/rybbit-backend and ghcr.io/rybbit-io/rybbit-client to v2.7.0 (kept pinned rather than latest, per repo convention; both tags verified on ghcr).
Add the redis service now required by the backend (session tracking and BullMQ queues), configured per upstream: password auth, AOF everysec persistence, noeviction policy, healthcheck, and a dedicated redis_data volume. Backend now depends on redis being healthy.
Drop DOMAIN_NAME from backend/client env — in v2.x it is only consumed by the upstream Caddy webserver, which Dokploy replaces with Traefik.
Add DISABLE_TELEMETRY (default false) and generate BETTER_AUTH_SECRET with the base64 generator.
ClickHouse config mounts, domains (backend :3001 at /api, client :3002 at /) and DB credentials unchanged.

Test evidence (deployed on a Dokploy instance)

Deploy: done in 62s, logs show Image ghcr.io/rybbit-io/rybbit-backend:v2.7.0 Pulling / rybbit-client:v2.7.0 Pulling.
GET /api/health → 200 OK (backend up, connected to postgres/clickhouse/redis).
GET / → 200, Rybbit client renders (Next.js app).
GET /signup → 200.
GET /api/script.js → 200 (31.9 KB tracking script served through the /api domain route).
node build-scripts/generate-meta.js --check → 476 templates validated.

Closes #659

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Dokploy/templates/pull/1008 **Author:** [@Siumauricio](https://github.com/Siumauricio) **Created:** 7/14/2026 **Status:** ✅ Merged **Merged:** 7/14/2026 **Merged by:** [@Siumauricio](https://github.com/Siumauricio) **Base:** `canary` ← **Head:** `fix/rybbit-update` --- ### 📝 Commits (1) - [`2556321`](https://github.com/Dokploy/templates/commit/25563213f247feb819a9c48567ef95e702d6f507) fix(rybbit): update to v2.7.0 ### 📊 Changes **3 files changed** (+50 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `blueprints/rybbit/docker-compose.yml` (+45 -7) 📝 `blueprints/rybbit/meta.json` (+1 -1) 📝 `blueprints/rybbit/template.toml` (+4 -2) </details> ### 📄 Description ## Summary The rybbit template was pinned to **v1.5.1**, which is no longer supported and is vulnerable to known React2Shell exploits — the "unexpected activity" reported in the client containers in #659. This updates the template to the latest stable upstream release, **v2.7.0** (2026-07-07), and aligns the stack with the current official docker-compose: - Pin `ghcr.io/rybbit-io/rybbit-backend` and `ghcr.io/rybbit-io/rybbit-client` to `v2.7.0` (kept pinned rather than `latest`, per repo convention; both tags verified on ghcr). - Add the **redis** service now required by the backend (session tracking and BullMQ queues), configured per upstream: password auth, AOF `everysec` persistence, `noeviction` policy, healthcheck, and a dedicated `redis_data` volume. Backend now depends on redis being healthy. - Drop `DOMAIN_NAME` from backend/client env — in v2.x it is only consumed by the upstream Caddy webserver, which Dokploy replaces with Traefik. - Add `DISABLE_TELEMETRY` (default `false`) and generate `BETTER_AUTH_SECRET` with the `base64` generator. - ClickHouse config mounts, domains (backend `:3001` at `/api`, client `:3002` at `/`) and DB credentials unchanged. ## Test evidence (deployed on a Dokploy instance) - Deploy: `done` in 62s, logs show `Image ghcr.io/rybbit-io/rybbit-backend:v2.7.0 Pulling` / `rybbit-client:v2.7.0 Pulling`. - `GET /api/health` → `200 OK` (backend up, connected to postgres/clickhouse/redis). - `GET /` → `200`, Rybbit client renders (Next.js app). - `GET /signup` → `200`. - `GET /api/script.js` → `200` (31.9 KB tracking script served through the `/api` domain route). - `node build-scripts/generate-meta.js --check` → 476 templates validated. Closes #659 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-07-14 23:19:02 -05:00

GiteaMirror closed this issue

2026-07-14 23:19:03 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/templates#16316