- Add an albums service for public links, with its own domain
- Pull images from ghcr.io/ente (ghcr.io/ente-io denies pulls)
- Generate a URL-safe JWT secret, so Museum can decode it
- With S3: use the routed MINIO_SERVER_URL as the S3 endpoint, allow
all CORS origins, and drop the SMTP defaults
Closes#7405
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Rybbit template had a proxy route only for the client, so the
/api requests of the browser got a 404 from the client and sign-up
and login failed. The backend now declares SERVICE_URL_RYBBIT_3001=/api
on the same host and keeps the /api prefix. The backend is listed
before the client, so SERVICE_URL_RYBBIT (used in BASE_URL) stays the
root URL.
Closes#9055
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
New Outline versions run CREATE OR REPLACE TRIGGER in a migration,
which needs PostgreSQL 14 or later. On postgres:12-alpine the migration
failed and the Outline container restarted in a loop.
Closes#12345
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AppFlowy Web runs on its own domain and sends a Redirect_to header to
/gotrue/magiclink on the admin domain. GoTrue does not allow that
header by default, so the CORS preflight failed and email sign-in
showed "Network error". Set GOTRUE_CORS_ALLOWED_HEADERS=redirect_to.
Closes#10545
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The template used mysql:latest with binary logging on and no limit,
so the binary logs filled the disk and Bugsink stopped. Use
postgres:17-alpine and bugsink/bugsink:2, as the Bugsink Docker
Compose sample does. Existing services keep MySQL; the changelog
tells how to purge the logs and turn binary logging off.
Closes#10626
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Use usesend/usesend:v1.10.0 instead of latest, so servers do not keep
an old cached image without the v1.10.0 security updates. The template
never used MinIO, so the RustFS change of v1.10.0 does not apply.
Closes#12443
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Do not overwrite the WordPress site address from the Coolify domain.
WordPress owns this setting; the docs now explain how to change it.
This reverts commit dce02411a.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Define WP_HOME and WP_SITEURL from SERVICE_URL_WORDPRESS in the MariaDB
and MySQL templates, so a domain change no longer makes the login
redirect to the domain used at install time.
Closes#12406
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Mosquitto 2.1 opens the file for `mosquitto_passwd -c` with O_EXCL, so
the template failed with "File exists" after `touch`. Delete the file
before `-c`, so each start writes a new file with only the current user.
Closes#11691
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop chrome, minio, and redis, which v6 no longer uses. Switch to the
v6 variables (APP_URL, AUTH_SECRET, ENCRYPTION_SECRET, FLAG_*), store
uploads in a volume at /app/data, use Postgres 18, and check /api/health.
Closes#12282
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Remove the ignore flag from 38 PHP-based service templates whose
current images ship a PHP release fixed for CVE-2026-109618 and
CVE-2026-109619 (8.5.12, 8.4.27, 8.3.36, 8.2.35, or the patched
Debian and Ubuntu packages).
- Database variants: use the same database name in Forgejo and the database
container (`forgejo` by default); Postgres stayed unhealthy and MySQL/MariaDB
installs failed with access denied.
- SSH: publish ${FORGEJO_SSH_PORT:-22222} and set SSH_PORT, DOMAIN and
SSH_DOMAIN, so clone URLs are correct and several instances fit on a server.
- Runner variants: start Forgejo from /usr/bin/s6-svscan, lock the install
with a generated admin, register runner 13.2.0 with a generated shared
secret, and enable the templates.
Closes#11924
The template port 3003 sent API and realtime traffic to a port that the
containers do not listen on (502). Use port 80 as upstream does, update
images and env to the official 2.5.0 compose, drop the removed assistant
service, and default _APP_OPTIONS_FORCE_HTTPS to disabled (upstream
default) so installs on http domains reach the API.
Hatchet leaves new signups unverified unless SMTP is set up, which
blocked users after signup. Default SERVER_AUTH_SET_EMAIL_VERIFIED to
true so operators can still opt out.
DATABASE_URL used $POSTGRES_DB without a default, so fresh deploys
connected to a database named after the user and the migration failed.
Also align setup-config volume names with the other services.
Closes#12106
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
rabbitmq-diagnostics ping succeeds before the AMQP listener on 5672
is open, so dependent services started too early and failed with
connection refused. Use check_port_connectivity with a start period
in the hatchet, plane, rabbitmq and mautic5 templates.
Closes#12105
Allow validated host file and directory mounts outside resource directories
while protecting external paths from deletion.
Clean up cancelled deployment containers and clear tracked process IDs.
Preserve legacy KeyDB and Dragonfly password parsing, accept server backup
paths without extension restrictions, and allow Compose variable proxy ports.
Homarr set SECRET_ENCRYPTION_KEY twice; only the
SERVICE_HEX_64_HOMARR line was ever used, so the duplicate is removed
and existing keys do not change. Bulwark quoted list-syntax values, so
the quotes reached the container and JMAP_SERVER_URL was never created
as a required variable. Existing services keep their stored compose.
Andras Bacsai
ShadowArcanist
João Cruz
Victor Gonçalves de Andradeandpeaklabs-dev
Joshua Anderson
Vitaliy Kukharik
Schenier Lopez
Immanuel Rajandpeaklabs-dev
Chirag Aggarwalandpeaklabs-dev
Julián Paredes
Maj Plenjšek
Florian