From 6683685dae0db9bb02e2165b97ec61ab96e7f719 Mon Sep 17 00:00:00 2001
From: Mauricio Siu <mauricio@dokploy.com>
Date: Tue, 14 Jul 2026 16:45:24 -0600
Subject: [PATCH] feat: add OneUptime template

Adds OneUptime (open-source observability platform: uptime monitoring,
status pages, incident management, on-call, logs/traces/metrics) as a
template, following upstream's current single-app architecture
(app + nginx ingress + postgres + redis + clickhouse + probe).

Closes #514

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 blueprints/oneuptime/docker-compose.yml | 158 ++++++++++++++++++++++++
 blueprints/oneuptime/meta.json          |  20 +++
 blueprints/oneuptime/oneuptime.svg      |  10 ++
 blueprints/oneuptime/template.toml      | 109 ++++++++++++++++
 4 files changed, 297 insertions(+)
 create mode 100644 blueprints/oneuptime/docker-compose.yml
 create mode 100644 blueprints/oneuptime/meta.json
 create mode 100644 blueprints/oneuptime/oneuptime.svg
 create mode 100644 blueprints/oneuptime/template.toml

diff --git a/blueprints/oneuptime/docker-compose.yml b/blueprints/oneuptime/docker-compose.yml
new file mode 100644
index 00000000..7bd82327
--- /dev/null
+++ b/blueprints/oneuptime/docker-compose.yml
@@ -0,0 +1,158 @@
+services:
+  oneuptime:
+    image: oneuptime/app:11.5.6
+    restart: unless-stopped
+    environment:
+      - PORT=3002
+      - NODE_ENV=production
+      - BILLING_ENABLED=false
+      - IS_ENTERPRISE_EDITION=false
+      - LOG_LEVEL=ERROR
+      - DISABLE_TELEMETRY=true
+      # Public host (domain) and protocol used to build links.
+      - HOST=${HOST}
+      - HTTP_PROTOCOL=${HTTP_PROTOCOL}
+      - ONEUPTIME_SECRET=${ONEUPTIME_SECRET}
+      - ENCRYPTION_SECRET=${ENCRYPTION_SECRET}
+      # Probes that present this key are allowed to self-register.
+      - REGISTER_PROBE_KEY=${REGISTER_PROBE_KEY}
+      - DATABASE_HOST=postgres
+      - DATABASE_PORT=5432
+      - DATABASE_USERNAME=postgres
+      - DATABASE_PASSWORD=${DATABASE_PASSWORD}
+      - DATABASE_NAME=oneuptimedb
+      - REDIS_HOST=redis
+      - REDIS_PORT=6379
+      - REDIS_USERNAME=default
+      - REDIS_PASSWORD=${REDIS_PASSWORD}
+      - REDIS_DB=0
+      - CLICKHOUSE_HOST=clickhouse
+      - CLICKHOUSE_PORT=8123
+      - CLICKHOUSE_USER=default
+      - CLICKHOUSE_PASSWORD=${CLICKHOUSE_PASSWORD}
+      - CLICKHOUSE_DATABASE=oneuptime
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      clickhouse:
+        condition: service_healthy
+
+  ingress:
+    image: oneuptime/nginx:11.5.6
+    restart: unless-stopped
+    environment:
+      - NODE_ENV=production
+      - BILLING_ENABLED=false
+      - LOG_LEVEL=ERROR
+      - DISABLE_TELEMETRY=true
+      - HOST=${HOST}
+      - NGINX_LISTEN_ADDRESS=
+      - NGINX_LISTEN_OPTIONS=
+      - PROVISION_SSL=
+      # Long domains (e.g. generated *.sslip.io hosts) overflow nginx's
+      # default server_names_hash_bucket_size of 64.
+      - SERVER_NAMES_HASH_BUCKET_SIZE=128
+      # Where nginx proxies the UI/API to.
+      - SERVER_APP_HOSTNAME=oneuptime
+      - APP_PORT=3002
+      # The marketing "home" app is not deployed (only used when billing is
+      # enabled), but nginx needs the vars to render its config.
+      - SERVER_HOME_HOSTNAME=home
+      - HOME_PORT=1444
+      # The ingress sidecar (custom-domain certificate writer) connects to
+      # Postgres and Redis.
+      - ONEUPTIME_SECRET=${ONEUPTIME_SECRET}
+      - ENCRYPTION_SECRET=${ENCRYPTION_SECRET}
+      - DATABASE_HOST=postgres
+      - DATABASE_PORT=5432
+      - DATABASE_USERNAME=postgres
+      - DATABASE_PASSWORD=${DATABASE_PASSWORD}
+      - DATABASE_NAME=oneuptimedb
+      - REDIS_HOST=redis
+      - REDIS_PORT=6379
+      - REDIS_USERNAME=default
+      - REDIS_PASSWORD=${REDIS_PASSWORD}
+      - REDIS_DB=0
+    depends_on:
+      postgres:
+        condition: service_healthy
+      oneuptime:
+        condition: service_started
+
+  probe:
+    image: oneuptime/probe:11.5.6
+    restart: unless-stopped
+    environment:
+      - PORT=3874
+      - NODE_ENV=production
+      - LOG_LEVEL=ERROR
+      - DISABLE_TELEMETRY=true
+      # The probe reaches OneUptime through the ingress ("ingress" is part of
+      # nginx's server_name, so all API routes resolve correctly).
+      - ONEUPTIME_URL=http://ingress:7849
+      - PROBE_NAME=Probe-1
+      - PROBE_DESCRIPTION=Default probe for monitors
+      - PROBE_MONITORING_WORKERS=3
+      - PROBE_MONITOR_FETCH_LIMIT=10
+      - PROBE_KEY=${PROBE_KEY}
+      - REGISTER_PROBE_KEY=${REGISTER_PROBE_KEY}
+    depends_on:
+      ingress:
+        condition: service_started
+
+  postgres:
+    image: postgres:15
+    restart: unless-stopped
+    environment:
+      - POSTGRES_USER=postgres
+      - POSTGRES_PASSWORD=${DATABASE_PASSWORD}
+      - POSTGRES_DB=oneuptimedb
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d oneuptimedb"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 15s
+
+  redis:
+    image: redis:7.0.12
+    restart: unless-stopped
+    command: redis-server --requirepass "${REDIS_PASSWORD}" --save "" --appendonly no
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli -a \"$$REDIS_PASSWORD\" ping | grep PONG"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    environment:
+      - REDIS_PASSWORD=${REDIS_PASSWORD}
+
+  clickhouse:
+    image: clickhouse/clickhouse-server:25.7
+    restart: unless-stopped
+    environment:
+      - CLICKHOUSE_USER=default
+      - CLICKHOUSE_PASSWORD=${CLICKHOUSE_PASSWORD}
+      - CLICKHOUSE_DB=oneuptime
+      - CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1
+    volumes:
+      - clickhouse-data:/var/lib/clickhouse
+      # Single-node cluster + embedded Keeper (OneUptime's analytics schema is
+      # always ReplicatedMergeTree + Distributed) and Distributed-insert
+      # batching, as shipped by upstream.
+      - ../files/clickhouse/cluster.xml:/etc/clickhouse-server/config.d/cluster.xml
+      - ../files/clickhouse/distributed-insert-tuning.xml:/etc/clickhouse-server/users.d/distributed-insert-tuning.xml
+    healthcheck:
+      test: ["CMD-SHELL", "clickhouse-client --password \"$$CLICKHOUSE_PASSWORD\" --query 'SELECT 1'"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 15s
+
+volumes:
+  postgres-data:
+  clickhouse-data:
diff --git a/blueprints/oneuptime/meta.json b/blueprints/oneuptime/meta.json
new file mode 100644
index 00000000..c2108d5c
--- /dev/null
+++ b/blueprints/oneuptime/meta.json
@@ -0,0 +1,20 @@
+{
+  "id": "oneuptime",
+  "name": "OneUptime",
+  "version": "11.5.6",
+  "description": "OneUptime is an open-source observability platform: uptime monitoring, status pages, incident management, on-call rotations, logs, traces and metrics in one place.",
+  "logo": "oneuptime.svg",
+  "links": {
+    "github": "https://github.com/OneUptime/oneuptime",
+    "website": "https://oneuptime.com/",
+    "docs": "https://oneuptime.com/docs"
+  },
+  "tags": [
+    "monitoring",
+    "observability",
+    "status-page",
+    "incident-management",
+    "on-call",
+    "alerting"
+  ]
+}
diff --git a/blueprints/oneuptime/oneuptime.svg b/blueprints/oneuptime/oneuptime.svg
new file mode 100644
index 00000000..5f2eec13
--- /dev/null
+++ b/blueprints/oneuptime/oneuptime.svg
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" baseProfile="full" width="279.847" height="279.847" viewBox="0 0 279.85 279.85" enable-background="new 0 0 279.85 279.85" xml:space="preserve">
+	<rect x="0" y="-6.10352e-005" fill="#000000" fill-opacity="1" stroke-linejoin="round" width="279.847" height="279.847"/>
+	<path fill="#FFFFFF" fill-opacity="1" stroke-linejoin="round" d="M 210.649,103.501C 208.431,102.573 205.901,102.109 203.059,102.109C 195.085,102.109 191.097,106.408 191.097,115.006L 191.097,124.379L 207.865,124.379L 207.865,136.906L 191.163,136.906L 191.163,193.973L 175.852,193.973L 175.852,136.906L 163.325,136.906L 163.325,124.379L 175.852,124.379L 175.852,113.157C 175.852,105.865 178.277,100.112 183.127,95.9003C 187.977,91.6884 194.041,89.5826 201.319,89.5826C 205.248,89.5826 208.358,89.9958 210.649,90.8222L 210.649,103.501 Z "/>
+	<rect x="217.608" y="124.379" fill="#FFFFFF" fill-opacity="1" stroke-linejoin="round" width="15.3105" height="69.5934"/>
+	<path fill="#6CDB56" fill-opacity="1" stroke-linejoin="round" d="M 129.601,97.818L 144.1,97.818C 146.309,97.818 148.1,99.6088 148.1,101.818L 148.1,189.813C 148.1,192.022 146.309,193.813 144.1,193.813L 129.601,193.813C 127.392,193.813 125.601,192.022 125.601,189.813L 125.601,101.818C 125.601,99.6088 127.392,97.818 129.601,97.818 Z "/>
+	<path fill="#6CDB56" fill-opacity="1" stroke-linejoin="round" d="M 95.8531,98.5677L 110.352,98.5677C 112.561,98.5677 114.352,100.358 114.352,102.568L 114.352,190.563C 114.352,192.772 112.561,194.563 110.352,194.563L 95.8531,194.563C 93.644,194.563 91.8531,192.772 91.8531,190.563L 91.8531,102.568C 91.8531,100.358 93.644,98.5677 95.8531,98.5677 Z "/>
+	<path fill="#6CDB56" fill-opacity="1" stroke-linejoin="round" d="M 60.355,98.0674L 74.8539,98.0674C 77.063,98.0674 78.8539,99.8583 78.8539,102.067L 78.8539,190.063C 78.8539,192.272 77.063,194.063 74.8539,194.063L 60.355,194.063C 58.1458,194.063 56.355,192.272 56.355,190.063L 56.355,102.067C 56.355,99.8583 58.1458,98.0674 60.355,98.0674 Z "/>
+</svg>
diff --git a/blueprints/oneuptime/template.toml b/blueprints/oneuptime/template.toml
new file mode 100644
index 00000000..a674b269
--- /dev/null
+++ b/blueprints/oneuptime/template.toml
@@ -0,0 +1,109 @@
+[variables]
+main_domain = "${domain}"
+db_password = "${password:32}"
+redis_password = "${password:32}"
+clickhouse_password = "${password:32}"
+oneuptime_secret = "${password:64}"
+encryption_secret = "${password:64}"
+register_probe_key = "${password:32}"
+probe_key = "${password:32}"
+
+[config]
+[[config.domains]]
+serviceName = "ingress"
+port = 7849
+host = "${main_domain}"
+
+[config.env]
+# Public host OneUptime is served on. Must match the domain above.
+"HOST" = "${main_domain}"
+# Change to "https" once you serve the domain over SSL/TLS.
+"HTTP_PROTOCOL" = "http"
+"DATABASE_PASSWORD" = "${db_password}"
+"REDIS_PASSWORD" = "${redis_password}"
+"CLICKHOUSE_PASSWORD" = "${clickhouse_password}"
+"ONEUPTIME_SECRET" = "${oneuptime_secret}"
+"ENCRYPTION_SECRET" = "${encryption_secret}"
+# Shared key probes use to self-register with the server.
+"REGISTER_PROBE_KEY" = "${register_probe_key}"
+# Identity key of the bundled probe.
+"PROBE_KEY" = "${probe_key}"
+
+# Single-node ClickHouse cluster + embedded Keeper drop-in (from upstream:
+# OneUptime's analytics schema is always ReplicatedMergeTree + Distributed,
+# so a single node runs an embedded Keeper and a 1-node "oneuptime" cluster).
+[[config.mounts]]
+filePath = "/clickhouse/cluster.xml"
+content = """
+<?xml version="1.0"?>
+<clickhouse>
+    <!-- Embedded ClickHouse Keeper: coordinates ReplicatedMergeTree on this node. -->
+    <keeper_server>
+        <tcp_port>9181</tcp_port>
+        <server_id>1</server_id>
+        <log_storage_path>/var/lib/clickhouse/coordination/log</log_storage_path>
+        <snapshot_storage_path>/var/lib/clickhouse/coordination/snapshots</snapshot_storage_path>
+        <coordination_settings>
+            <operation_timeout_ms>10000</operation_timeout_ms>
+            <session_timeout_ms>30000</session_timeout_ms>
+            <raft_logs_level>warning</raft_logs_level>
+        </coordination_settings>
+        <raft_configuration>
+            <server>
+                <id>1</id>
+                <hostname>localhost</hostname>
+                <port>9234</port>
+            </server>
+        </raft_configuration>
+    </keeper_server>
+
+    <!-- Point this server at its own embedded Keeper for replication metadata. -->
+    <zookeeper>
+        <node>
+            <host>localhost</host>
+            <port>9181</port>
+        </node>
+    </zookeeper>
+
+    <!-- Replication macros. Single node => one shard, one replica. -->
+    <macros>
+        <shard>01</shard>
+        <replica>replica-1</replica>
+        <cluster>oneuptime</cluster>
+    </macros>
+
+    <!-- The cluster the app issues `ON CLUSTER 'oneuptime'` and
+         `Distributed('oneuptime', ...)` against. -->
+    <remote_servers>
+        <oneuptime>
+            <shard>
+                <internal_replication>true</internal_replication>
+                <replica>
+                    <host>localhost</host>
+                    <port>9000</port>
+                </replica>
+            </shard>
+        </oneuptime>
+    </remote_servers>
+</clickhouse>
+"""
+
+# Batches the background Distributed-insert sender so telemetry ingestion
+# keeps up with volume (from upstream Clickhouse/users.d).
+[[config.mounts]]
+filePath = "/clickhouse/distributed-insert-tuning.xml"
+content = """
+<?xml version="1.0"?>
+<clickhouse>
+    <profiles>
+        <default>
+            <!-- Coalesce many spooled files into one insert into the local table. -->
+            <distributed_background_insert_batch>1</distributed_background_insert_batch>
+            <!-- If a coalesced batch fails, retry its files individually. -->
+            <distributed_background_insert_split_batch_on_failure>1</distributed_background_insert_split_batch_on_failure>
+            <!-- Write to the local replica directly. -->
+            <prefer_localhost_replica>1</prefer_localhost_replica>
+        </default>
+    </profiles>
+</clickhouse>
+"""