From 9c16ad19c6b7d5f36533cf770b0c1aa04d602652 Mon Sep 17 00:00:00 2001 From: Nikolas Trochalakis Date: Sun, 25 Oct 2026 14:07:34 -0700 Subject: [PATCH 01/13] Add supernote/docker-compose.yml --- supernote/docker-compose.yml | 89 ++++++++++++++++++++++++++++++++++++ 1 file changed, 89 insertions(+) create mode 100644 supernote/docker-compose.yml diff --git a/supernote/docker-compose.yml b/supernote/docker-compose.yml new file mode 100644 index 0000000..4c6c9c2 --- /dev/null +++ b/supernote/docker-compose.yml @@ -0,0 +1,89 @@ +services: + mariadb: + image: mariadb:10.6.24 + container_name: mariadb + environment: + MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD} + MYSQL_DATABASE: supernotedb + MYSQL_USER: ${MYSQL_USER} + MYSQL_PASSWORD: ${MYSQL_PASSWORD} + TZ: ${TZ:-UTC} + command: --skip-name-resolve --bind-address=0.0.0.0 + volumes: + - ./sndata/db_data:/var/lib/mysql + - ./sndata/config/mysql/conf.d:/etc/mysql/conf.d:ro + - ./supernotedb.sql:/docker-entrypoint-initdb.d/00-supernotedb.sql:ro + - ./supernote-email-init.sql:/docker-entrypoint-initdb.d/01-supernote-email-init.sql:ro + - /etc/localtime:/etc/localtime:ro + healthcheck: + test: ["CMD-SHELL", "mysqladmin ping -h localhost -u root -p$$MYSQL_ROOT_PASSWORD || exit 1"] + interval: 10s + timeout: 5s + retries: 10 + start_period: 30s + restart: unless-stopped + + redis: + image: redis:7.4.7 + container_name: redis + environment: + TZ: ${TZ:-UTC} + command: ["redis-server", "--requirepass", "${REDIS_PASSWORD}"] + volumes: + - ./sndata/redis_data:/data + - /etc/localtime:/etc/localtime:ro + restart: unless-stopped + healthcheck: + test: ["CMD", "redis-cli", "ping"] + interval: 10s + timeout: 3s + retries: 3 + + notelib: + image: docker.io/supernote/notelib:6.9.3 + container_name: notelib + environment: + TZ: ${TZ:-UTC} + volumes: + - /etc/localtime:/etc/localtime:ro + restart: unless-stopped + + supernote-service: + image: docker.io/supernote/supernote-service:26.06.04 + container_name: supernote-service + depends_on: + mariadb: + condition: service_healthy + redis: + condition: service_healthy + ports: + - "19071:19071" + - "18072:18072" + - "${FRONTEND_PORT:-19072}:8080" + - "${DOMAIN_PORT:-8199}:8080" + environment: + EXTERNAL_PORT_BACKEND: "19071" + EXTERNAL_PORT_FRONTEND: ${FRONTEND_PORT:-19072} + EXTERNAL_PORT_DOMAIN: ${DOMAIN_PORT:-8199} + TZ: ${TZ:-UTC} + DB_HOSTNAME: mariadb + MYSQL_DATABASE: supernotedb + MYSQL_USER: ${MYSQL_USER} + MYSQL_PASSWORD: ${MYSQL_PASSWORD} + REDIS_HOST: redis + REDIS_PORT: 6379 + REDIS_PASSWORD: ${REDIS_PASSWORD} + volumes: + - ./sndata/recycle:/home/supernote/recycle + - ./supernote_data:/home/supernote/data + - ./sndata/logs/cloud:/home/supernote/cloud/logs + - ./sndata/logs/app:/home/supernote/logs + - ./sndata/logs/web:/var/log/nginx + - ./sndata/convert:/home/supernote/convert + - /etc/localtime:/etc/localtime:ro + restart: unless-stopped + logging: + driver: "json-file" + options: + max-size: "10m" + max-file: "3" -- 2.54.0 From 172721a36b9226491759f37ad8490eb8df6c7374 Mon Sep 17 00:00:00 2001 From: Nikolas Trochalakis Date: Sun, 25 Oct 2026 14:11:42 -0700 Subject: [PATCH 02/13] Add domain-watchdog/docker-compose.yml --- domain-watchdog/docker-compose.yml | 86 ++++++++++++++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 domain-watchdog/docker-compose.yml diff --git a/domain-watchdog/docker-compose.yml b/domain-watchdog/docker-compose.yml new file mode 100644 index 0000000..d79ff4f --- /dev/null +++ b/domain-watchdog/docker-compose.yml @@ -0,0 +1,86 @@ +# Please see https://github.com/maelgangloff/domain-watchdog + +services: + domainwatchdog: + image: maelgangloff/domain-watchdog:latest + container_name: domainwatchdog_app + restart: unless-stopped + env_file: + - .env.local + environment: + APP_ENV: prod + SERVER_NAME: ${SERVER_NAME:-:80} + DATABASE_URL: postgresql://${POSTGRES_USER:-app}:${POSTGRES_PASSWORD:-!ChangeMe!}@database:${POSTGRES_PORT:-5432}/${POSTGRES_DB:-app}?serverVersion=${POSTGRES_VERSION:-15}&charset=${POSTGRES_CHARSET:-utf8} + MESSENGER_ASYNC_TRANSPORT_DSN: redis://valkey:6379/messages + MESSENGER_RDAP_LOW_TRANSPORT_DSN: redis://valkey:6379/messages-rdap-low + MESSENGER_RDAP_HIGH_TRANSPORT_DSN: redis://valkey:6379/messages-rdap-high + LOCK_DSN: redis://valkey:6379 + HTTP_SECURE_COOKIE: true # Change to "false" if you are using HTTP + volumes: + - caddy_data:/data + - caddy_config:/config + - ./public/content:/app/public/content + ports: + - "127.0.0.1:8080:80" + depends_on: + - database + + php-worker: + image: maelgangloff/domain-watchdog:latest + container_name: domainwatchdog_worker + restart: always + command: php /app/bin/console messenger:consume --all --time-limit=3600 -vvv + env_file: + - .env.local + environment: + APP_ENV: prod + DATABASE_URL: postgresql://${POSTGRES_USER:-app}:${POSTGRES_PASSWORD:-!ChangeMe!}@database:${POSTGRES_PORT:-5432}/${POSTGRES_DB:-app}?serverVersion=${POSTGRES_VERSION:-15}&charset=${POSTGRES_CHARSET:-utf8} + LOCK_DSN: redis://valkey:6379 + MESSENGER_ASYNC_TRANSPORT_DSN: redis://valkey:6379/messages + MESSENGER_RDAP_LOW_TRANSPORT_DSN: redis://valkey:6379/messages-rdap-low + MESSENGER_RDAP_HIGH_TRANSPORT_DSN: redis://valkey:6379/messages-rdap-high + MESSENGER_CONSUMER_NAME: worker + depends_on: + - database + healthcheck: + test: [ ] + disable: true + + database: + image: postgres:${POSTGRES_VERSION:-16}-alpine + container_name: domainwatchdog_db + restart: unless-stopped + environment: + POSTGRES_DB: ${POSTGRES_DB:-app} + POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-!ChangeMe!} + POSTGRES_USER: ${POSTGRES_USER:-app} + healthcheck: + test: [ "CMD", "pg_isready", "-d", "${POSTGRES_DB:-app}", "-U", "${POSTGRES_USER:-app}" ] + timeout: 5s + retries: 5 + start_period: 60s + volumes: + - database_data:/var/lib/postgresql/data:rw + + valkey: + image: valkey/valkey + container_name: valkey + restart: always + +# influxdb2: +# image: influxdb:2 +# ports: +# - "127.0.0.1:8086:8086" +# environment: +# DOCKER_INFLUXDB_INIT_MODE: setup +# DOCKER_INFLUXDB_INIT_USERNAME: USERNAME # Please modify +# DOCKER_INFLUXDB_INIT_PASSWORD: PASSWORD # Please modify +# DOCKER_INFLUXDB_INIT_ADMIN_TOKEN: my-super-secret-auth-token # Please modify +# DOCKER_INFLUXDB_INIT_RETENTION: 0 +# DOCKER_INFLUXDB_INIT_ORG: domainwatchdog +# DOCKER_INFLUXDB_INIT_BUCKET: domainwatchdog + +volumes: + caddy_data: + caddy_config: + database_data: \ No newline at end of file -- 2.54.0 From 41d88b2a3050ffca39721f27c50550789f95fc03 Mon Sep 17 00:00:00 2001 From: Nikolas Trochalakis Date: Sun, 25 Oct 2026 14:12:46 -0700 Subject: [PATCH 03/13] Add nametag/docker-compose.yml --- nametag/docker-compose.yml | 133 +++++++++++++++++++++++++++++++++++++ 1 file changed, 133 insertions(+) create mode 100644 nametag/docker-compose.yml diff --git a/nametag/docker-compose.yml b/nametag/docker-compose.yml new file mode 100644 index 0000000..b476251 --- /dev/null +++ b/nametag/docker-compose.yml @@ -0,0 +1,133 @@ +# Production Docker Compose Configuration +# Use this for production and self-hosted deployments with proper secrets management + +services: + db: + image: postgres:16-alpine + container_name: nametag-db + restart: always + environment: + POSTGRES_USER: ${DB_USER} + POSTGRES_PASSWORD: ${DB_PASSWORD} + POSTGRES_DB: ${DB_NAME} + ports: + - "${DB_PORT:-5432}:5432" + volumes: + - postgres_data:/var/lib/postgresql/data + healthcheck: + test: [CMD-SHELL, "pg_isready -U ${DB_USER} -d ${DB_NAME}"] + interval: 10s + timeout: 5s + retries: 5 + networks: + - nametag-network + + redis: # Optional. Comment out to disable Redis. See README.md for more details. + image: redis:7-alpine + container_name: nametag-redis + restart: always + command: redis-server --requirepass ${REDIS_PASSWORD:?Redis password required} + ports: + - "${REDIS_PORT:-6379}:6379" + volumes: + - redis_data:/data + healthcheck: + test: [CMD, redis-cli, --raw, incr, ping] + interval: 10s + timeout: 5s + retries: 5 + networks: + - nametag-network + + app: + image: ghcr.io/mattogodoy/nametag:latest + container_name: nametag-app + restart: unless-stopped + labels: + com.datadoghq.ad.logs: '[{"source": "nodejs", "service": "nametag"}]' + ports: + - 3000:3000 + # TRUSTED_PROXY_HEADER / TRUSTED_PROXY_COUNT (see .env.example / + # docs/self-hosting/reverse-proxy.md) only protect rate limiting if + # this port cannot be reached except through your reverse proxy. + # Publishing it on all interfaces, as above, lets anyone who can reach + # the host bypass the proxy (and the header it sets) entirely. If you + # run a reverse proxy in front of Nametag (recommended for any + # instance reachable from outside your own network), bind this to + # localhost instead so only the proxy on the same host can reach it: + # - "127.0.0.1:3000:3000" + env_file: + - .env + volumes: + - photo_data:/app/data/photos + depends_on: + db: + condition: service_healthy + redis: # Optional. Comment out to disable Redis. See README.md for more details. + condition: service_healthy + healthcheck: + test: [CMD, wget, -q, --spider, http://localhost:3000/api/health] + interval: 30s + timeout: 10s + retries: 3 + start_period: 40s + networks: + - nametag-network + - proxy + + # Database backup service + backup: + image: prodrigestivill/postgres-backup-local + container_name: nametag-backup + restart: always + environment: + - POSTGRES_HOST=db + - POSTGRES_DB=${DB_NAME} + - POSTGRES_USER=${DB_USER} + - POSTGRES_PASSWORD=${DB_PASSWORD} + - SCHEDULE=@daily + - BACKUP_KEEP_DAYS=7 + - BACKUP_KEEP_WEEKS=4 + - BACKUP_KEEP_MONTHS=6 + - HEALTHCHECK_PORT=8080 + volumes: + - ./backups:/backups + depends_on: + - db + networks: + - nametag-network + + # Cron service for scheduled jobs + cron: + image: alpine:3.19 + container_name: nametag-cron + restart: always + environment: + - CRON_SECRET=${CRON_SECRET} + depends_on: + - app + command: > + sh -c " + echo '0 8 * * * wget -q -O - --header=\"Authorization: Bearer '\"$$CRON_SECRET\"'\" http://app:3000/api/cron/send-reminders > /proc/1/fd/1 2>&1' > /etc/crontabs/root && + echo '0 3 * * * wget -q -O - --header=\"Authorization: Bearer '\"$$CRON_SECRET\"'\" http://app:3000/api/cron/purge-deleted > /proc/1/fd/1 2>&1' >> /etc/crontabs/root && + echo '0 2,10,18 * * * wget -q -O - --header=\"Authorization: Bearer '\"$$CRON_SECRET\"'\" http://app:3000/api/cron/carddav-sync > /proc/1/fd/1 2>&1' >> /etc/crontabs/root && + echo '*/5 * * * * wget -q -O - --header=\"Authorization: Bearer '\"$$CRON_SECRET\"'\" http://app:3000/api/cron/geocode > /proc/1/fd/1 2>&1' >> /etc/crontabs/root && + crond -f -l 2 + " + networks: + - nametag-network + +volumes: + postgres_data: + driver: local + redis_data: # Optional. Comment out to disable Redis. See README.md for more details. + driver: local + photo_data: + driver: local + +networks: + nametag-network: + external: true + name: nametag-network + proxy: # for reverse proxy (e.g., Nginx Proxy Manager) to access the app without exposing ports to the outside world + external: true \ No newline at end of file -- 2.54.0 From fd188df6f5994c57e63e2bc6f4bb7bb0f4536ff5 Mon Sep 17 00:00:00 2001 From: Nikolas Trochalakis Date: Sun, 25 Oct 2026 14:16:15 -0700 Subject: [PATCH 04/13] Add supernote/README.md --- supernote/README.md | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 supernote/README.md diff --git a/supernote/README.md b/supernote/README.md new file mode 100644 index 0000000..ac79691 --- /dev/null +++ b/supernote/README.md @@ -0,0 +1,30 @@ +# Supernote Private Cloud + +Copied from Supernote's official +[docker-compose.yml](https://supernote-private-cloud.supernote.com/cloud/docker-compose.yml), +with these changes: + +- **Database init scripts are mounted.** The official file doesn't mount + anything into `docker-entrypoint-initdb.d`, so `supernotedb.sql` never + loads into a new database. This file mounts: + - `supernotedb.sql` → `00-supernotedb.sql` (the schema) + - `supernote-email-init.sql` → `01-supernote-email-init.sql` +- **SMTP settings are pre-loaded.** `supernote-email-init.sql` fills in + `u_email_config`. Registration and password-reset emails then work without + a manual trip to the web UI's "Email Settings" dialog. +- **Database and Redis settings are inline.** The official file loads + `supernote-service`'s `DB_HOSTNAME`, `MYSQL_*` and `REDIS_*` variables from + a separate `.dbenv` file. Here they're set directly in the compose file, + from the same `.env` that mariadb and redis use. + +## Notes + +- **Init scripts only run once.** They run only against an empty + `sndata/db_data`. The playbook re-applies the SMTP settings with + `docker compose exec` on every run, so changing them in Infisical still + takes effect. +- **Image versions are pinned** (`mariadb:10.6.24`, `redis:7.4.7`, + `notelib:6.9.3`, `supernote-service:26.06.04`). To upgrade, change the tags + here and push to `stable`. +- **Check Supernote's file when upgrading.** Compare against the official + file in case they've added services or variables. -- 2.54.0 From fc31a95a4a27d35bcc36b9d637aea30e20781e86 Mon Sep 17 00:00:00 2001 From: Nikolas Trochalakis Date: Sun, 25 Oct 2026 14:35:35 -0700 Subject: [PATCH 05/13] Add versions.env --- versions.env | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 versions.env diff --git a/versions.env b/versions.env new file mode 100644 index 0000000..71c6bcc --- /dev/null +++ b/versions.env @@ -0,0 +1,29 @@ +# Central image versions for AtlasHorizon/compose. +# Each compose file reads its images from here via ${VAR:?}; Ansible +# downloads this next to docker-compose.yml and passes it as a second +# --env-file. One variable per service+component, so e.g. each Postgres +# can be upgraded independently (major bumps need a dump/restore). + +# --- grist --- +GRIST_IMAGE=gristlabs/grist:1.7.21 + +# --- domain-watchdog --- +# App and worker must stay on the same version. +DOMAIN_WATCHDOG_IMAGE=maelgangloff/domain-watchdog:v1.4.6 +# Major must match POSTGRES_VERSION in domain-watchdog's .env (used in DATABASE_URL). +DOMAIN_WATCHDOG_POSTGRES_IMAGE=postgres:16.15-alpine +DOMAIN_WATCHDOG_VALKEY_IMAGE=valkey/valkey:9.1.2 + +# --- nametag --- +NAMETAG_IMAGE=ghcr.io/mattogodoy/nametag:0.66.0 +NAMETAG_POSTGRES_IMAGE=postgres:16.15-alpine +NAMETAG_REDIS_IMAGE=redis:7.4.11-alpine +# Keep the major in line with NAMETAG_POSTGRES_IMAGE. +NAMETAG_BACKUP_IMAGE=prodrigestivill/postgres-backup-local:16-alpine +NAMETAG_CRON_IMAGE=alpine:3.24.3 + +# --- supernote --- +SUPERNOTE_MARIADB_IMAGE=mariadb:10.6.24 +SUPERNOTE_REDIS_IMAGE=redis:7.4.7 +SUPERNOTE_NOTELIB_IMAGE=docker.io/supernote/notelib:6.9.3 +SUPERNOTE_SERVICE_IMAGE=docker.io/supernote/supernote-service:26.06.04 -- 2.54.0 From 521103a956e8d31bb92773e8bd5100c58aae523a Mon Sep 17 00:00:00 2001 From: Nikolas Trochalakis Date: Sun, 25 Oct 2026 14:37:35 -0700 Subject: [PATCH 06/13] Update domain-watchdog/docker-compose.yml --- domain-watchdog/docker-compose.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/domain-watchdog/docker-compose.yml b/domain-watchdog/docker-compose.yml index d79ff4f..fb30124 100644 --- a/domain-watchdog/docker-compose.yml +++ b/domain-watchdog/docker-compose.yml @@ -2,7 +2,7 @@ services: domainwatchdog: - image: maelgangloff/domain-watchdog:latest + image: ${DOMAIN_WATCHDOG_IMAGE:?set in versions.env} container_name: domainwatchdog_app restart: unless-stopped env_file: @@ -26,7 +26,7 @@ services: - database php-worker: - image: maelgangloff/domain-watchdog:latest + image: ${DOMAIN_WATCHDOG_IMAGE:?set in versions.env} container_name: domainwatchdog_worker restart: always command: php /app/bin/console messenger:consume --all --time-limit=3600 -vvv @@ -47,7 +47,7 @@ services: disable: true database: - image: postgres:${POSTGRES_VERSION:-16}-alpine + image: ${DOMAIN_WATCHDOG_POSTGRES_IMAGE:?set in versions.env} container_name: domainwatchdog_db restart: unless-stopped environment: @@ -63,7 +63,7 @@ services: - database_data:/var/lib/postgresql/data:rw valkey: - image: valkey/valkey + image: ${DOMAIN_WATCHDOG_VALKEY_IMAGE:?set in versions.env} container_name: valkey restart: always -- 2.54.0 From 124d08c0fdded49fd0649e037b7abaf0f0e0622a Mon Sep 17 00:00:00 2001 From: Nikolas Trochalakis Date: Sun, 25 Oct 2026 14:37:57 -0700 Subject: [PATCH 07/13] Update grist/docker-compose.yml --- grist/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/grist/docker-compose.yml b/grist/docker-compose.yml index b93b99d..69ae46f 100644 --- a/grist/docker-compose.yml +++ b/grist/docker-compose.yml @@ -1,6 +1,6 @@ services: grist: - image: gristlabs/grist:latest + image: ${GRIST_IMAGE:?set in versions.env} restart: unless-stopped ports: - "8484:8484" -- 2.54.0 From 85de5b7c1824f6fbbcf45b31491d3e640d484e69 Mon Sep 17 00:00:00 2001 From: Nikolas Trochalakis Date: Sun, 25 Oct 2026 14:38:55 -0700 Subject: [PATCH 08/13] Update nametag/docker-compose.yml --- nametag/docker-compose.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/nametag/docker-compose.yml b/nametag/docker-compose.yml index b476251..e9c434a 100644 --- a/nametag/docker-compose.yml +++ b/nametag/docker-compose.yml @@ -3,7 +3,7 @@ services: db: - image: postgres:16-alpine + image: ${NAMETAG_POSTGRES_IMAGE:?set in versions.env} container_name: nametag-db restart: always environment: @@ -23,7 +23,7 @@ services: - nametag-network redis: # Optional. Comment out to disable Redis. See README.md for more details. - image: redis:7-alpine + image: ${NAMETAG_REDIS_IMAGE:?set in versions.env} container_name: nametag-redis restart: always command: redis-server --requirepass ${REDIS_PASSWORD:?Redis password required} @@ -40,7 +40,7 @@ services: - nametag-network app: - image: ghcr.io/mattogodoy/nametag:latest + image: ${NAMETAG_IMAGE:?set in versions.env} container_name: nametag-app restart: unless-stopped labels: @@ -77,7 +77,7 @@ services: # Database backup service backup: - image: prodrigestivill/postgres-backup-local + image: ${NAMETAG_BACKUP_IMAGE:?set in versions.env} container_name: nametag-backup restart: always environment: @@ -99,7 +99,7 @@ services: # Cron service for scheduled jobs cron: - image: alpine:3.19 + image: ${NAMETAG_CRON_IMAGE:?set in versions.env} container_name: nametag-cron restart: always environment: -- 2.54.0 From ea49bdf4021c2bd3eedc2bcf723ba9468e4f32e8 Mon Sep 17 00:00:00 2001 From: Nikolas Trochalakis Date: Sun, 25 Oct 2026 14:39:46 -0700 Subject: [PATCH 09/13] Update supernote/docker-compose.yml --- supernote/docker-compose.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/supernote/docker-compose.yml b/supernote/docker-compose.yml index 4c6c9c2..70b271d 100644 --- a/supernote/docker-compose.yml +++ b/supernote/docker-compose.yml @@ -1,6 +1,6 @@ services: mariadb: - image: mariadb:10.6.24 + image: ${SUPERNOTE_MARIADB_IMAGE:?set in versions.env} container_name: mariadb environment: MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD} @@ -24,7 +24,7 @@ services: restart: unless-stopped redis: - image: redis:7.4.7 + image: ${SUPERNOTE_REDIS_IMAGE:?set in versions.env} container_name: redis environment: TZ: ${TZ:-UTC} @@ -40,7 +40,7 @@ services: retries: 3 notelib: - image: docker.io/supernote/notelib:6.9.3 + image: ${SUPERNOTE_NOTELIB_IMAGE:?set in versions.env} container_name: notelib environment: TZ: ${TZ:-UTC} @@ -49,7 +49,7 @@ services: restart: unless-stopped supernote-service: - image: docker.io/supernote/supernote-service:26.06.04 + image: ${SUPERNOTE_SERVICE_IMAGE:?set in versions.env} container_name: supernote-service depends_on: mariadb: -- 2.54.0 From ef621bcc7be0216dfef7c9d843ff089116afdcb9 Mon Sep 17 00:00:00 2001 From: Nikolas Trochalakis Date: Sun, 25 Oct 2026 14:47:52 -0700 Subject: [PATCH 10/13] Update versions.env --- versions.env | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/versions.env b/versions.env index 71c6bcc..e9f93d9 100644 --- a/versions.env +++ b/versions.env @@ -27,3 +27,9 @@ SUPERNOTE_MARIADB_IMAGE=mariadb:10.6.24 SUPERNOTE_REDIS_IMAGE=redis:7.4.7 SUPERNOTE_NOTELIB_IMAGE=docker.io/supernote/notelib:6.9.3 SUPERNOTE_SERVICE_IMAGE=docker.io/supernote/supernote-service:26.06.04 + +# --- monitor (Flatcar) --- +# The hub and agents share the TLS pair baked into the image, so this must +# match the agent tag on ai, oswald_runner, oswl_connector and the TrueNAS hosts. +DOZZLE_IMAGE=amir20/dozzle:v11.1.1 +ALERTA_IMAGE=alerta/alerta-web:9.1.0 \ No newline at end of file -- 2.54.0 From 74d41a4f497a8cf5e0efca57b783e4aaa46443a3 Mon Sep 17 00:00:00 2001 From: Nikolas Trochalakis Date: Sun, 25 Oct 2026 15:23:53 -0700 Subject: [PATCH 11/13] Update versions.env --- versions.env | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/versions.env b/versions.env index e9f93d9..19b2a60 100644 --- a/versions.env +++ b/versions.env @@ -32,4 +32,22 @@ SUPERNOTE_SERVICE_IMAGE=docker.io/supernote/supernote-service:26.06.04 # The hub and agents share the TLS pair baked into the image, so this must # match the agent tag on ai, oswald_runner, oswl_connector and the TrueNAS hosts. DOZZLE_IMAGE=amir20/dozzle:v11.1.1 -ALERTA_IMAGE=alerta/alerta-web:9.1.0 \ No newline at end of file +ALERTA_IMAGE=alerta/alerta-web:9.1.0 + +# --- ai (Flatcar) --- +GITEA_MCP_IMAGE=docker.gitea.com/gitea-mcp-server:1.11.0 +LITELLM_IMAGE=docker.litellm.ai/berriai/litellm:v1.106.4 +QDRANT_IMAGE=qdrant/qdrant:v1.19.1 +OPEN_TERMINAL_IMAGE=ghcr.io/open-webui/open-terminal:0.14.0 +OPEN_WEBUI_IMAGE=ghcr.io/open-webui/open-webui:v0.11.4 +OPENCODE_IMAGE=ghcr.io/anomalyco/opencode:1.18.32 + +# --- oswald_runner (Flatcar) --- +GITEA_RUNNER_IMAGE=docker.io/gitea/runner:3.5.0 +N8N_IMAGE=docker.n8n.io/n8nio/n8n:2.40.5 +CISA_KEV_RSS_IMAGE=ghcr.io/xsaveopt/cisa-kev-rss:0.0.5 +# Domain Watchdog here shares DOMAIN_WATCHDOG_IMAGE and +# DOMAIN_WATCHDOG_VALKEY_IMAGE with the compose deployment. + +# --- oswl_connector (Flatcar) --- +TAILSCALE_IMAGE=docker.io/tailscale/tailscale:v1.104.2 -- 2.54.0 From 995f247b9be567dabe7bfdcc0f6b294cb062bffd Mon Sep 17 00:00:00 2001 From: Nikolas Trochalakis Date: Sun, 25 Oct 2026 15:53:08 -0700 Subject: [PATCH 12/13] Add renovate.json --- renovate.json | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 renovate.json diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..b4ac99e --- /dev/null +++ b/renovate.json @@ -0,0 +1,34 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": ["config:recommended"], + "customManagers": [ + { + "customType": "regex", + "description": "Image tags in versions.env", + "managerFilePatterns": ["/^versions\\.env$/"], + "matchStrings": [ + "(?:^|\\n)[A-Z0-9_]+_IMAGE=(?[^:\\s]+):(?[^\\s@]+)" + ], + "datasourceTemplate": "docker" + } + ], + "packageRules": [ + { + "description": "Database majors need a dump/restore, so never propose them", + "matchDepNames": ["postgres", "prodrigestivill/postgres-backup-local"], + "matchUpdateTypes": ["major"], + "enabled": false + }, + { + "description": "Stay on the 10.6 LTS line; 10.11 is effectively a major upgrade", + "matchDepNames": ["mariadb"], + "allowedVersions": "/^10\\.6\\./" + }, + { + "matchDepNames": ["amir20/dozzle"], + "prBodyNotes": [ + "Also bump the Dozzle agents on the TrueNAS hosts to the same tag. The hub and agents share the TLS pair baked into the image." + ] + } + ] +} -- 2.54.0 From ab513c2de67a770514958d94dd9a13daa2d82387 Mon Sep 17 00:00:00 2001 From: Nikolas Trochalakis Date: Sun, 25 Oct 2026 15:53:50 -0700 Subject: [PATCH 13/13] Add .gitea/workflows/renovate.yml --- .gitea/workflows/renovate.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .gitea/workflows/renovate.yml diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml new file mode 100644 index 0000000..20ec423 --- /dev/null +++ b/.gitea/workflows/renovate.yml @@ -0,0 +1,23 @@ +name: renovate + +on: + schedule: + - cron: "0 */6 * * *" + workflow_dispatch: + +jobs: + renovate: + runs-on: ubuntu-latest + container: + image: ghcr.io/renovatebot/renovate:44.181.6 + steps: + - name: Run Renovate + run: renovate + env: + RENOVATE_PLATFORM: gitea + RENOVATE_ENDPOINT: https://git.atlashorizon.net/api/v1 + RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }} + RENOVATE_REPOSITORIES: AtlasHorizon/compose + RENOVATE_GIT_AUTHOR: "Renovate Bot " + GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }} + LOG_LEVEL: info -- 2.54.0