* fix: meta.json of Poke blueprint
The current github/docs links was broken
before:
https://codeberg.org/ashley/poke
after:
https://codeberg.org/ashleyirispuppy/poke
* fix: broken links in some blueprints
* Add openhabittracker blueprint
* fix(affinepro): update to current AFFiNE images
The template pinned ghcr.io/toeverything/affine-graphql:stable-780dd83,
an ephemeral per-commit tag on the old image name that has since been
removed from GHCR, so the template could no longer pull and deploy.
- Switch both app and migration services to ghcr.io/toeverything/affine:stable,
the rolling stable tag recommended by the official self-host compose,
so the template no longer rots when per-commit tags are garbage-collected
- Move postgres to pgvector/pgvector:pg16 and set AFFINE_INDEXER_ENABLED=false,
matching the current upstream self-host compose requirements
- Add postgres/redis healthchecks and proper depends_on conditions so the
self-host-predeploy migration job runs only once the database is ready,
and the server starts only after migrations complete successfully
Closes#777
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(cockpit): persist config and storage volumes per upstream docs
The template mounted `html:/var/www/html` (freezing the app code from the
first deploy) and `data:/var/www/html/storage/data`, which misses uploaded
assets (stored under `storage/uploads`) and cache. Per the official Cockpit
persistent-storage docs, mount `config:/var/www/html/config` and
`storage:/var/www/html/storage` instead.
Closes#549
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(kener): define REDIS_URL and drop unused databases
Kener v4 requires Redis for its BullMQ queues, caching and scheduler,
so the app crashed on startup with "REDIS_URL is not defined in
environment variables" right after printing that it was running
(issue #976). The template also spun up both a postgres and a mariadb
container while DATABASE_URL pointed at SQLite, so neither database
was ever used (issue #282).
Changes, aligned with the upstream docker-compose.yml
(rajnandan1/kener):
- Add a redis:7-alpine service with a healthcheck and persistent
volume, wire REDIS_URL=redis://redis:6379 and make kener depend on
redis being healthy
- Remove the unused postgres and mysql services plus their env vars
and generated passwords; keep SQLite (upstream default) persisted
in the kener_db volume
- Set ORIGIN to https://<domain> instead of http://localhost:3000 so
CSRF protection works behind the generated domain
- Drop the stale /app/uploads bind mount (kener v4 only persists
/app/database) and the obsolete compose version key
Deploy-tested on a Dokploy instance: migrations and seed complete,
schedulers start, "Kener version 4.1.2 is running!", HTTP 200 on the
generated domain, both containers stable.
Closes#976Closes#282
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(homarr): use named volume for /appdata and hex encryption key
- Replace the relative bind mount `../homarr/appdata:/appdata` with a
named volume `homarr_appdata:/appdata` so the data survives cleanups
and can be backed up through Dokploy volume backups.
- Generate SECRET_ENCRYPTION_KEY with `${hash:64}` instead of
`${password:64}`: homarr requires a 64-character hex string
(`openssl rand -hex 32`) and the password helper emits non-hex
characters (g-z).
Closes#738
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(logto): fix postgres role error and update to 1.41.0
The postgres healthcheck ran pg_isready without -U while POSTGRES_USER
was set to logto, so every probe attempted to connect as role
"postgres" and spammed FATAL: role "postgres" does not exist.
Pass -U logto -d logto explicitly and set POSTGRES_DB.
Also fix LOGTO_ENDPOINT pointing at the admin domain instead of the
main domain, update Logto 1.27.0 -> 1.41.0, use ${password:32} for the
generated password, drop the ephemeral host port publishing and add
restart policies.
Closes#130
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(gitlab-ce): serve on the generated domain (remove removed unicorn config, pin omnibus)
The template set unicorn['worker_processes'] / unicorn['worker_timeout'] in
GITLAB_OMNIBUS_CONFIG. Unicorn was removed in GitLab 14.0, so on current
gitlab-ce images `gitlab-ctl reconfigure` aborts with "Removed configurations
found in gitlab.rb" and GitLab never starts serving — the generated domain
returned 502 Bad Gateway (issue #380).
Rewrite the template as the official all-in-one Omnibus setup:
- pin gitlab/gitlab-ce:19.1.2-ce.0 instead of :latest
- external_url http://<domain> with nginx listen_port 80 / listen_https false
(TLS terminates at Traefik)
- set gitlab_rails['initial_root_password'] from a generated template password
- puma single mode + prometheus monitoring off to keep memory reasonable
- drop the external postgres/redis containers (Omnibus bundles and manages
its own) and the broken ports entries ("2224" published a random host port
while sshd listens on 22)
Verified on a live Dokploy instance: domain serves the GitLab sign-in page
and root login with the generated password works.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(zitadel): wire EXTERNALDOMAIN/PORT/SECURE to the generated domain
Zitadel resolves its instance from the external domain/port/scheme, so the
template's ZITADEL_EXTERNALPORT=8080 made every generated URL (OIDC issuer,
login redirects) point at http://<domain>:8080 instead of the domain served
by Traefik, ending in {"code":5,"message":"Not Found"} (#516).
- Expose ZITADEL_EXTERNALDOMAIN / ZITADEL_EXTERNALPORT / ZITADEL_EXTERNALSECURE
as template env vars, defaulting to the generated domain over HTTP
(port 80, secure=false) so the routed domain and Zitadel's external config
always match; HTTPS users flip them to 443/true in the Env tab.
- Pin image to v4.16.0 (was latest) and keep the built-in login v1 via
ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED=false so no separate
login-v2 container is needed.
- Add the official readiness healthcheck, drop the unused /app/data volume,
bogus SMTP env keys, published port and obsolete compose version key.
Closes#516
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(immich): update to v3.0.2
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(automatisch): switch to official image and wire up DOMAIN to fix Bad Gateway
- Replace unofficial dockeriddonuts/automatisch:2.0 mirror (stale since Nov 2024)
with the official automatischio/automatisch:0.15.0 image
- Define DOMAIN in template.toml [config.env]: the compose referenced ${DOMAIN}
but it was never provided, so HOST resolved empty and the app generated
localhost URLs for the web app and webhooks
- Set API_URL/WEB_APP_URL so generated URLs don't carry the internal :3000 port
behind Traefik
- Add postgres healthcheck and gate the app on service_healthy to avoid the
boot-time migration race; worker now starts after main (official compose order)
- Drop unnecessary published port and no-op REDIS_* env on the redis service
- Bump meta.json version to 0.15.0
Closes#97
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(signoz): fix ClickHouse hostname resolution and IPv6 binding
- Override the ClickHouse image's config.d/docker_related_config.xml,
which listens on the IPv6 wildcard address ([::]) first and fails to
bind on hosts without IPv6 support; listen on 0.0.0.0 (IPv4) only and
disable the internal DNS cache so transient startup DNS failures for
zookeeper-1/clickhouse are not cached (issue #534).
- Set hostname: clickhouse (instead of container_name) so the server
identifies itself as the cluster host declared in cluster.xml.
- Remove the explicit signoz-net network: Dokploy attaches its own
networks automatically and the repo validator rejects explicit
networks; a fixed-name shared network also breaks service DNS across
deployments.
- Fix mount mismatch: template.toml created files/signoz/prometheus.xml
while the compose mounts ../files/signoz/prometheus.yml, so Docker
silently mounted a directory as the signoz prometheus config.
- Give the otel-collector domain its own generated host: both domains
previously shared the same host and path "/", creating two conflicting
Traefik routers where one service randomly won.
Closes#534
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(infisical): update to v0.162.6
- Bump image from v0.135.0-postgres to v0.162.6 (upstream dropped the
-postgres tag suffix after v0.146.0; plain tags are the postgres build)
- Remove the db-migration service: the standalone image runs database
migrations automatically on boot (auto-start-migrations), matching the
official docker-compose.prod.yml which no longer ships that service
- Generate ENCRYPTION_KEY (${hash:32}) and AUTH_SECRET (${base64:32})
per deployment instead of shipping hardcoded example secrets
- Fix SITE_URL to http://${main_domain} (no :8080; the domain is proxied)
- Refresh SMTP env names (SMTP_FROM_ADDRESS/SMTP_FROM_NAME; SMTP_SECURE
was removed upstream) and drop unused CLIENT_* env placeholders that
were never passed to the container
Closes#215
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: add databasus (postgresus renamed upstream)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(evolutionapi): enable integration flags and update version
Adds the integration enable env flags introduced in Evolution API v2.3.x
(N8N_ENABLED, OPENAI_ENABLED, EVOAI_ENABLED, DIFY_ENABLED, TYPEBOT_ENABLED,
CHATWOOT_ENABLED) so integrations no longer fail with 'N8n is disabled',
and pins the image to v2.3.7 instead of latest.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(rybbit): update to v2.7.0
The template shipped rybbit v1.5.1, which is no longer supported and is
vulnerable to known React2Shell exploits (see #659). Update to the
latest stable release v2.7.0 and align the stack with the upstream
docker-compose:
- Pin ghcr.io/rybbit-io/rybbit-backend and rybbit-client to v2.7.0
- Add the redis service now required by the backend (session tracking
and BullMQ queues), with password auth, AOF persistence and
noeviction policy per upstream
- Drop the DOMAIN_NAME env var (only used by the upstream Caddy
webserver, which Dokploy replaces with Traefik)
- Add DISABLE_TELEMETRY env and generate BETTER_AUTH_SECRET as base64
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(phpmyadmin): raise PHP upload limit so SQL imports over 2MB work
Without UPLOAD_LIMIT the phpMyAdmin image keeps PHP's default 2M
post_max_size/upload_max_filesize, so importing any SQL file larger
than 2MB fails with 'POST Content-Length exceeds the limit of
2097152 bytes' followed by a session_start error page.
- Add UPLOAD_LIMIT (512M) and MAX_EXECUTION_TIME (600) env vars,
configurable from the template env
- Wire the previously unused MYSQL_DATABASE env var into the compose
file, replacing the hardcoded 'tu_base_de_datos' placeholder, and
default it to 'phpmyadmin' instead of the system 'mysql' schema
Closes#236
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(openpanel): pin verified 2.2.1 images and fix ClickHouse interserver host
- Pin lindesvard/openpanel-api|dashboard|worker to 2.2.1 (verified working
end-to-end on a Dokploy instance) instead of the mutable :2 tag, so a
future broken 2.x release cannot silently break the template again —
which is how #615 originated when 2.0.0 shipped.
- Fix interserver_http_host to match the actual service name (op-ch),
aligning with upstream self-hosting config.
- Set meta.json version to the pinned 2.2.1.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(wordpress): route loopback requests through Traefik to fix cURL error 28
WordPress resolves its own public domain to the server's public IP from
inside the container, so REST API / WP-Cron / Site Health loopback
requests depend on hairpin NAT, which times out (cURL error 28) on many
hosts. Pin the site domain to the dokploy-traefik container IP in
/etc/hosts at startup (with retries, since Traefik joins the compose
network shortly after the container starts) so loopback traffic stays
inside the Docker network for both HTTP and HTTPS. No-op fallback when
dokploy-traefik is not resolvable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(minio): migrate to pgsty/minio community fork (upstream is source-only and archived)
MinIO Inc. stopped publishing Docker images and pre-built binaries in
October 2025 and archived the minio/minio repository in February 2026.
The official minio/minio image is frozen at RELEASE.2025-09-07T16-13-09Z
and no longer receives security fixes (the fix for CVE-2025-62506 was
never published as an image).
- Switch image to pgsty/minio:RELEASE.2026-06-18T00-00-00Z, the actively
maintained community fork (drop-in replacement, AGPLv3, same env vars,
same /data on-disk format, restores the full web console)
- Route the S3 API (port 9000) through its own generated domain instead
of publishing host port 9000, per repo conventions
- Update meta.json links/description to point at the maintained fork
Closes#469
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(nextcloud-aio): drop AIO branding, keep template id, pin nextcloud 33.0.6
The template ships plain nextcloud + mariadb + redis + cron, not the
nextcloud/all-in-one mastercontainer. Display name and description no
longer claim AIO; folder id is kept as nextcloud-aio to avoid breaking
existing installs. Image pinned to the current stable tag (33.0.6).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add MailCatcher NG template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: add per-template setup instructions (supabase, trigger.dev)
Adds instructions.md files for the Supabase and Trigger.dev templates and
renders them in the template browser as a new Instructions tab in the
template dialog (fetched from blueprints/<id>/instructions.md, rendered
with a small dependency-free markdown component).
Also removes the placeholder blueprints/ackee/instructions.md so it does
not surface as an empty Instructions tab.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Weblate template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Synapse (Matrix homeserver) template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Dify template
Dify 1.15.0 (open-source LLM app development platform): api + worker +
worker_beat + web + pgvector PostgreSQL (also used as the vector store) +
redis + sandbox + ssrf_proxy (squid) + plugin_daemon, fronted by an
internal nginx gateway that mirrors the upstream path routing.
Closes#88
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Sim Studio template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Steedos template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Silex template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add SpacetimeDB template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add CertMate template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add PostHog template
Based on the official hobby deployment, trimmed to run on a single
server: Django web + Celery worker, Node plugin-server (CDP, ingestion,
session replay, recording API), Rust capture/replay-capture/
feature-flags/hypercache, livestream, Caddy path router, Postgres,
Redis, Redpanda (Kafka), ZooKeeper, ClickHouse and MinIO.
Images are pinned to a tested master commit (PostHog no longer
publishes tagged releases); an init container fetches the matching
ClickHouse configuration, Kafka table schemas, funnel UDF binaries and
the GeoIP database at the same pinned ref.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Markup template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Frappe LMS template
Adds a Frappe LMS (Frappe Learning) template based on the erpnext-v16
blueprint pattern (configurator + create-site + workers + scheduler +
websocket + mariadb + 3x redis).
Pins ghcr.io/frappe/lms:v2.52.0, the latest upstream image that ships
the lms app (v2.52.1+ images are currently published without any apps
baked in). The image does not bundle the payments app, so create-site
clears lms's required_apps before install; paid-course checkout is
unavailable, everything else works. The backend is gated on a
create-site completion marker so gunicorn workers never serve (and
cache) a half-installed site during the 3-6 minute first boot.
Closes#517
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add TREK template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Oryx (SRS) media streaming template
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix: stop plugins service crash loop (logs-redis TLS default)
In production images LOGS_REDIS_TLS/TRACES_REDIS_TLS default to true, so
the logs-ingestion consumer (part of the plugin-server default mode) kept
attempting a TLS handshake against the plaintext Redis, timed out every
~11s and killed the process after 10 errors (restart loop every ~2.5 min).
Constrain the plugins service to the capability groups this template
ships (cdp_workflows, realtime_cohorts, feature_flags) and pin the redis
TLS flags to false as belt-and-braces.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add n8n queue mode template
n8n running in queue mode (EXECUTIONS_MODE=queue): main instance for the
editor/webhooks, a scalable pool of workers (deploy.replicas driven by the
N8N_WORKER_REPLICAS env var), Redis (Bull) as the queue broker and
PostgreSQL as the database. Pinned to the current stable n8nio/n8n:2.30.4.
Closes#455
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add bonfire template
Bonfire (social flavour) — federated social networking toolkit.
App + PostGIS + Meilisearch, mirroring upstream's reference deployments.
Closes#125
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add dagu blueprint
Dagu is a self-contained workflow engine with a Web UI for scheduling and
orchestrating jobs as DAGs defined in declarative YAML.
- Pin ghcr.io/dagucloud/dagu:2.10.7 and expose the Web UI on port 8080
- Set DAGU_HOST=0.0.0.0 so the service is reachable through the proxy
- Enable basic auth with a generated per-deploy admin password
- Persist /var/lib/dagu (DAGs, logs, run history) in a named volume
Claude-Session: https://claude.ai/code/session_01CRNT6sa2q2P9rUTokeoGhQ
* feat: add OneUptime template
Adds OneUptime (open-source observability platform: uptime monitoring,
status pages, incident management, on-call, logs/traces/metrics) as a
template, following upstream's current single-app architecture
(app + nginx ingress + postgres + redis + clickhouse + probe).
Closes#514
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat: add Mailu template
Mailu 2024.06 mail server: front (nginx), admin, imap (dovecot),
smtp (postfix), antispam (rspamd), Roundcube webmail and redis.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(templates): add systemprompt (#1032)
* feat(templates): add systemprompt
* fix header comment: accurate in both repos
* chore: normalize template tags to kebab-case (#987)
* feat: adds `check-links.js` to find broken links (#983)
* feat: add struxa template (#1037)
* feat: add struxa template
Adds a Dokploy blueprint for Struxa (github.com/struxadotcloud/struxa),
a self-hosted, open-source server management panel. Deploys the
published GHCR images (dashboard, watchkeeper, migrate) plus MySQL
and MinIO sidecars. The web service generates its RS256 JWT keypair
at startup via Node's built-in crypto module, since no Dokploy
template helper covers RSA key generation.
* fix: pin struxa images to latest floating tag
struxa's release workflow pushes a latest floating tag alongside
version tags on every stable release, matching the convention used
by ~44% of existing blueprints (version: "latest" in meta.json).
* fix: generate a 64-char DATABASE_ENCRYPTION_KEY
Dokploy's runtime \${hash:N} helper produces N hex characters, not N
bytes (the templates repo's local preview helpers.ts models it as
byte count, which is inconsistent with the platform). struxa's env
schema requires DATABASE_ENCRYPTION_KEY to be >=64 chars (it's hex
decoded to a 32-byte AES-256 key), so \${hash:32} only produced half
the required length. Confirmed against other blueprints (sim,
chatwoot, outline) which all use \${hash:64} for 64-char secrets.
* fix: address Copilot review comments
- Add explicit \`version: "3.8"\` to docker-compose.yml, matching the
documented template format.
- Pin minio/minio to a specific RELEASE tag (used elsewhere in the
repo: plane, posthog) instead of the floating latest tag.
- Default BETTER_AUTH_URL/APP_URL/CORS_ORIGIN to http://, matching
repo convention for Dokploy-fronted apps (TLS terminates at the
proxy).
* fix: rename web service to struxa
AGENTS.md convention: the primary Docker service name should match
the blueprint folder name. Renamed the web/dashboard service from
"web" to "struxa" in docker-compose.yml and updated
template.toml's config.domains.serviceName to match.
* Add PodFetch template (#1035)
* Add PodFetch template
* Use env array syntax in template.toml
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Address review: match version to image tag, expose admin_username variable, dark-mode friendly logo
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix(docker): share plugins and themes volumes across containers (#990)
* feat(directus): upgrade template to Directus 12.1.1 (#986)
* feat(directus): upgrade template to Directus 12.1.1
* feat(directus): add commented S3 env variables to template.toml
---------
Co-authored-by: Zakher Masri <46135573+zaaakher@users.noreply.github.com>
Co-authored-by: zakher <zakhermasri@gmail.com>
Co-authored-by: Jinjinov <dzindzinovic@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Stephan Fitzpatrick <stephan@knowsuchagency.com>
Co-authored-by: Mauricio Siu <mauricio@dokploy.com>
Co-authored-by: Edward Burton <ejb503@gmail.com>
Co-authored-by: Marko Kostich <markokosticdev@gmail.com>
Co-authored-by: Jakub Krzyżanowski <jakubkrzyz.kontakt@gmail.com>
Co-authored-by: SamTV12345 <40429738+SamTV12345@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Mafly <110502739+Nekoplii@users.noreply.github.com>
Kener v4 requires Redis for BullMQ background queues. Without it, the
application crashes on startup with 'REDIS_URL is not defined' error.
Changes:
- Add Redis 7 Alpine service with healthcheck
- Pin Kener image to v4.1.1 (was 'latest')
- Add REDIS_URL env var pointing to redis://redis:6379
- Remove unused postgres and mysql services (SQLite is the default)
- Remove unused env vars for removed DB services
- Use expose instead of ports (Dokploy convention)
- Add depends_on with service_healthy condition for Redis
Fixes https://github.com/Dokploy/templates/issues/976
Lines 11 and 65 still told contributors to add their entry to the root
meta.json, which was removed in #978 (metadata now lives in
blueprints/<id>/meta.json and the aggregate is generated at build time).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- gel: allow plain HTTP for the reverse proxy (GEL_SERVER_HTTP_ENDPOINT_SECURITY=optional), enable admin UI and point the domain at /ui
- keydb: remove HTTP domain and published port — pure Redis-protocol DB reachable via internal network
- leantime: image serves on 8080 (non-root nginx), add required LEAN_APP_URL and LEAN_SESSION_PASSWORD, use utf8mb4
- matomo: removed from this PR, already fixed in #765
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- chroma: mount volume at /data (chromadb 1.x data dir), drop legacy 0.x
env vars (IS_PERSISTENT/PERSIST_DIRECTORY) and point the domain to
/api/v2/heartbeat so the API-only service verifies with HTTP 200
- homebox: newer images panic on boot without HBOX_AUTH_API_KEY_PEPPER
(>=32 bytes); generate it via ${password:64} in template.toml
- languagetool: point the domain to /v2/languages (the API returns 400
on "/"), which responds HTTP 200
- restore gotify/jellyseerr/privatebin/speedtest-tracker meta.json to
canary so this PR no longer touches templates that already exist
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The Multica backend is an API-only chi server with no route registered
at "/", so the generated backend domain (path "/") permanently answered
HTTP 404 even though the container was healthy. The web frontend already
proxies /api/*, /ws, /auth/* and /uploads/* to http://backend:8080 via
Next.js rewrites, and when NEXT_PUBLIC_WS_URL is unset the browser
derives the WebSocket URL from the page origin, so the backend never
needs to be exposed publicly.
- drop the backend [[config.domains]] entry and api_domain variable
- drop NEXT_PUBLIC_WS_URL so the WS URL falls back to the page origin
and goes through the frontend's /ws rewrite
- remove ephemeral host port publications (ports: "8080"/"3000");
Traefik reaches the containers over the docker network
Verified on a Dokploy instance: deploy done, frontend / -> 200 and
backend reachable through the proxy (/api/config -> 200).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The deploy failed with 'dependency failed to start: container db-1 is
unhealthy'. Root cause: the MariaDB 11.8 healthcheck allowed only ~40s
(start_period 10s + 3x10s retries) before flagging the container
unhealthy, which is not enough for the first-boot datadir
initialization on a modest VPS. Since create-site depended on
db:service_healthy, docker compose up -d aborted the whole deploy.
Fixes, following the pattern of the existing working erpnext template:
- Extend the db healthcheck window (start_period 120s, 30 retries) so
first-boot initialization does not mark the container unhealthy.
- Drop depends_on from the one-shot create-site and migration jobs and
gate create-site with wait-for-it (db/redis) inside its command, so
docker compose up -d returns without blocking on the multi-minute
site creation and cannot fail on transient health states.
Verified on a fresh deploy: all services up, create-site installed
frappe + erpnext and enabled the scheduler, frontend serves the
ERPNext login page with HTTP 200.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Bootstrap died with exit 2 because Composer >= 2.9 enables
audit.block-insecure by default: shopware/core v6.7.8.2 is now affected
by 9 security advisories (all fixed in 6.7.10.1+), so
'composer create-project shopware/production:6.7.8.2' failed to resolve
dependencies and the whole stack never started.
- Bump the pinned Shopware version to 6.7.12.1 (latest, advisory-free).
- Disable audit.block-insecure in the bootstrap's global composer config
so advisories published after a version is pinned cannot brick fresh
one-click deploys.
- Use APP_URL=http://${main_domain} per template conventions; an https
APP_URL breaks storefront sales-channel matching when the Dokploy
domain is served over plain http.
Verified on a Dokploy instance: full bootstrap + deployment-helper
install completed in ~4 min, storefront and /admin both return HTTP 200.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The --password flag makes Glances prompt for a password interactively
via getpass, which fails in a non-TTY container. The container kept
crash-looping, so Traefik returned 404 for the domain. Glances also
does not read GLANCES_USERNAME/GLANCES_PASSWORD env vars, so the auth
setup was ineffective. Run the web server with GLANCES_OPT=-w and drop
the unused password env vars from the compose file and template.toml.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
FORCE_SSL=true + FRONTEND_URL=https:// made Rails 301-redirect every
request to https, which Traefik answered with a sustained 404 because
Dokploy-generated template domains are http-only. Default to
FORCE_SSL=false and FRONTEND_URL=http://${main_domain} (matching the
repo convention); users who terminate TLS can flip these afterwards.
Verified on a Dokploy instance: fresh deploy of chatwoot/chatwoot:v4.12.1
migrates and answers HTTP 200 with the onboarding page.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The official postgres:18 image moved PGDATA from /var/lib/postgresql/data
to /var/lib/postgresql. Mounting the volume at the old path made the
entrypoint abort and the postgresql container restart-loop, failing the
deploy with "dependency postgresql failed to start". Mounting the volume
at /var/lib/postgresql fixes the deploy; server responds 200 on
/if/flow/initial-setup/.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The compose file referenced ${SERVICE_PASSWORD_ENCRYPT} and
${SERVICE_PASSWORD_WEB}, but template.toml defines the variables as
SETTINGS_ENCRYPTION_KEY and DUPLICATI__WEBSERVICE_PASSWORD, so both
values rendered empty at deploy time. Also removed the leftover
SERVICE_URL_DUPLICATI_8200 passthrough entry and added
DUPLICATI__WEBSERVICE_ALLOWED_HOSTNAMES=* so the Duplicati web server
(2.0.8+) accepts requests forwarded by Traefik for the configured
domain instead of rejecting unknown Host headers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The template pointed PS_DATA_SOURCE_URI at a placeholder connection
string (postgresql://user:password@host:5432/db), so the PowerSync
service could never connect and crash-looped, leaving the domain
returning Traefik 404s.
Changes:
- Add a bundled Postgres 17 service with wal_level=logical, a
healthcheck, and a persistent volume; powersync waits for it to be
healthy before starting.
- Replace the base64-encoded config env var with a readable
powersync.yaml mounted via [[config.mounts]]. Replication reads from
the powersync database and bucket storage uses a separate
powersync_storage database (Postgres storage requires a database
distinct from the replication source).
- Add an init SQL mount that creates the storage database, a demo
"lists" table synced by the default sync rules, and the powersync
publication required for logical replication.
- Replace the unsupported sync_config block with standard sync_rules,
and add an HS256 dev key so client auth works out of the box.
- Remove host port mapping (Traefik routes to the container port) and
point the template domain at /probes/liveness since PowerSync has no
route on "/".
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The postgres:18-alpine image moved PGDATA from /var/lib/postgresql/data
to /var/lib/postgresql, so mounting the volume at the old path made the
entrypoint abort and the db container restart forever, failing the
service_healthy dependency for dash and status-page.
- Mount db_data at /var/lib/postgresql (postgres 18 layout)
- Remove host port mappings (Dokploy routes via domains/Traefik)
- Generate POSTGRES_PASSWORD and CLICKHOUSE_PASSWORD with ${password:32}
instead of hardcoded credentials
- Drop unused DASH_PORT/STATUS_PAGE_PORT env and dangling empty
[[config.mounts]] section in template.toml
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The tb-node image runs as the non-root "thingsboard" user (uid 799), but
the freshly created /data named volume is owned by root, so
"touch /data/.thingsboard-installed" failed with permission denied after
every successful install. Combined with "set -e" and "restart: on-failure",
the init container kept re-running the installer forever and the main
thingsboard service (gated on service_completed_successfully) never
started, leaving the domain returning 404.
Running the init service as root lets the marker be written so the init
completes and stays idempotent across redeploys. Also widened the main
service healthcheck start window (start_period 300s, retries 10) so the
slow first boot on modest VPS hardware is not marked unhealthy while
docker compose up --wait is in progress.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The postgres:18 image moved its data directory from
/var/lib/postgresql/data to /var/lib/postgresql, and its entrypoint
now fails hard when a volume is mounted at the old path. This made
paperless-ngx-db restart-loop and never reach healthy, so the deploy
errored with 'dependency paperless-ngx-db failed to start'.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The container was restart-looping because the built-in IdP fatals with
"invalid iss value, URL must start with https://" when OCIS_URL uses
plain http, which caused the sustained 502.
- Set owncloud_url to https://${main_domain} so the IdP issuer is valid
and ocis server stays up.
- oCIS 8.x unconditionally answers 308 -> https:// whenever it receives
X-Forwarded-Proto: http (services/proxy https_redirect middleware), so
the domain check then died on a redirect loop into a non-existent 443
router. Add a small nginx gateway in front of oCIS that forwards
requests with X-Forwarded-Proto: https (what a TLS-terminating proxy
sends) and point the Dokploy domain at gateway:8080.
- Update the README notes accordingly.
Verified on a live Dokploy instance: deploy done, GET / returns
HTTP 200 with title "ownCloud".
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
NodeLink requires the Authorization header on every API route,
including /version, so the healthcheck's unauthenticated fetch always
got a 401 and the container stayed permanently unhealthy. Traefik
skips unhealthy containers, so the assigned domain returned a
sustained 404 even though the deploy finished successfully.
Pass the container's NODELINK_SERVER_PASSWORD as the Authorization
header in the healthcheck fetch; the container now reaches a healthy
state and the domain routes to the server (401 on / without
credentials, 200 on /version with the password), as expected for a
Lavalink-compatible server.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
evolutioncrm:
- Point the evo-crm-frontend domain at port 80 instead of 5173: the
community frontend image serves the built app via nginx on port 80
(5173 is the vite dev port), so the domain returned 502.
- Set EVOLUTION_API_ONLY_SERVER=true on evo-crm: the community image
ships without the Rails dashboard views (the UI lives in the separate
evo-crm-frontend service), so the default root route (dashboard#index)
can never render and returned 406 for every request. With the flag the
root serves the API status JSON; all /api routes are unaffected.
- Drop the evolution-go-* volumes that were left over from the other
template.
evolutiongo:
- Evolution GO has no route on "/" and answers 503 (LICENSE_REQUIRED)
on API routes until a license is activated through the bundled
manager UI, so the single domain never responded. Add a small nginx
gateway that redirects "/" to /manager/login and proxies everything
else (WebSockets included) 1:1 to evolution-go:8080, and point the
domain at it.
- Persist /app/dbdata and /app/logs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
