Repository navigation
New Version - #1205
Merged
Merged
New Version#1205
Conversation
- Force the MySQL healthcheck over TCP: with --host=localhost it pings the unix socket, which answers during MySQL's temporary init phase before networking is up, so db-import started too early and failed with connect error 111. - Serialize the SOAP bootstrap after the admin bootstrap: both jobs insert into acore_auth.account concurrently and hit a MySQL deadlock (Error 1213) that bootstrap-account does not retry. - Default REQUIRE_EMAIL_VERIFICATION to false via a new PORTAL_REQUIRE_EMAIL_VERIFICATION variable: the template ships empty SMTP settings, so the portal crash-looped on first deploy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Changes based on: - nktnet1/airbyte-compose#2 Hopefully addresses: - #1119 (comment)
Official Supabase made Envoy the default API gateway on 2026-08-11 (PR #48153, self-hosted release 0.8.0) and shipped a CORS fix for /pg/ routes on 2026-08-17 (PR #49136) that only Envoy carries. This blueprint still shipped Kong. Changes: - docker-compose.yml: rename `kong` to `api-gw`, on envoyproxy/envoy:v1.39.0. TCP healthcheck because the image has no curl or wget. Expose 8000 only — Envoy has no 8443 listener. Env vars follow official: ANON_KEY / SERVICE_ROLE_KEY replace SUPABASE_ANON_KEY / SUPABASE_SERVICE_KEY, every KONG_* is dropped, and SUPABASE_PUBLIC_URL is added for #49136. Rename the three internal references to the gateway, and add official's `functions` healthcheck. - template.toml: swap the two Kong mounts for the four envoy ones, copied from supabase/supabase@master. serviceName becomes `api-gw`; KONG_HTTP_PORT becomes API_GW_HTTP_PORT and KONG_HTTPS_PORT is dropped. - meta.json: version marker names the Envoy switch. - instructions.md: Kong replaced by Envoy in all four places, plus a note that Studio's basic-auth credential is a SHA1+base64 hash of DASHBOARD_PASSWORD computed by Envoy's entrypoint at startup. Two Dokploy adaptations, deliberate and both needed: - No `networks:` aliases block and no `ports:` mapping — validate-docker-compose rejects both. The alias exists upstream only for backwards compatibility, and nothing here still points at `kong`. - cds.yaml points the realtime cluster at `realtime`, not at official's `realtime-dev.supabase-realtime` container_name, because this blueprint sets no container_name. lds.template.yaml is byte-identical to official, so the Host header realtime uses for tenant resolution is unchanged. Verified locally against Docker 29.4.0 / Compose v5.1.2, rendering the template the way Dokploy does. All 11 services healthy; legacy keys work; sb_publishable_ is blocked by RLS while sb_secret_ reads the row; Studio basic auth challenges and accepts; /realtime/v1/api/tenants and /realtime/v1/api/openapi return 403 and the /rest/v1/ root stays service-role only; an OPTIONS to /pg/ returns access-control-allow-origin matching SUPABASE_PUBLIC_URL; a realtime channel join over ?apikey=sb_publishable_… replies status ok; and the sample edge function returns its response. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A multi-agent audit of the Envoy port compared the blueprint against
supabase/supabase@master, against Dokploy's own source, and against the repo's
conventions. Three findings survived an adversarial refute pass and two more
were traced to the same cause. All five are divergences from official that
predate this branch, but they sit on the surface this branch touches.
- template.toml: API_EXTERNAL_URL gains /auth/v1, matching official
docker/.env.example:101 since supabase e7abda8d (PR #47640, 2026-07-07).
Without it GoTrue advertises https://<domain>/callback for every OAuth and
SAML flow, and Envoy's lds routes bare /callback to the `/` catch-all — that
is Studio, not auth. Measured: /auth/v1/authorize returns GoTrue's 400, while
/callback returns Studio's 401 basic-auth challenge.
- template.toml: add the /volumes/functions/deno.jsonc import map and point
main/index.ts at it, and take official's `hello` sample. Upstream shipped
these in 9ef9f1b8 (2026-08-14) and f5f897a2 (2026-08-28); the blueprint's
functions volume was still at the 2023-era deno.land/std sample with
importMapPath = null, so no function written against current Supabase docs
could resolve @supabase/server. Also injects SUPABASE_FUNCTION_SLUG.
- docker-compose.yml: restore official's SELinux flags on the shared functions
directory — `:z` not `:Z`, and `:ro` back on Studio's copy. `:Z` applies a
private MCS label, so mounting one host directory into two containers with
it revokes the first container's access on an SELinux host. Every other bind
flag in the file already matched official; these three were the only drift.
- meta.json: version becomes 2026.08.03-3. The images are unchanged from
official's 2026.08.03 snapshot, so 2026.08.17 advertised a state the template
does not ship.
- template.toml: API_GW_HTTP_PORT is inert, because the port is pinned by
`expose` and by the domain block. The comment above it said the opposite.
- instructions.md: two operational gaps the audit surfaced. Renaming kong to
api-gw makes Dokploy reject a redeploy of an existing service until the
domain's Service Name is edited. And the Postgres data directory is a bind
mount, so Dokploy's Volume Backups cannot see it, deleting the service
destroys it regardless of the delete-volumes toggle, and "redeploy with fresh
volumes" does not reset the database.
Re-verified end to end on Docker 29.4.0: all three repo validators pass, all 11
services healthy, and the eight original checks still pass. Two new ones: the
hello sample returns 200 {"message":"Hello from Edge Functions!"} for both
sb_publishable_ and sb_secret_ keys — proving the import map resolves — and
/auth/v1/settings and /auth/v1/authorize reach GoTrue.
Note a deliberate behaviour change from official: the new sample declares
auth: ["publishable","secret"], so a legacy anon JWT now gets a 401 with an
explanatory INVALID_API_KEY body where the old sample accepted it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The template generates SUPABASE_PUBLIC_URL, API_EXTERNAL_URL and ADDITIONAL_REDIRECT_URLS with https://, which is right for a public domain with a certificate. Dokploy creates the template's domain with none, so until one is enabled the domain answers on http only and those three values point at a scheme that does not respond. Measured on a live deploy: the stack reports 11/11 healthy and the gateway answers http with Studio's 401 basic-auth challenge, while https returns 404 — so nothing looks broken, but Studio's own calls fail, Envoy's CORS check compares Origin against the https string and refuses, and GoTrue builds its issuer, OAuth redirects and email links from the dead scheme. Also records that Let's Encrypt cannot rescue a private address: an sslip.io name pointing at a Tailscale 100.x or a LAN address cannot be validated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Appwrite 2.0 replaces the engine, ships the new root-path console and defaults new installs to PostgreSQL, so the template is rebuilt from the stock 2.0.0 installer output rather than bumped: - PostgreSQL (appwrite/postgres) is the database; MariaDB/MongoDB and their init mounts are dropped. - Combined worker/scheduler topology (appwrite-worker, appwrite-task-scheduler) replaces the per-queue worker containers. - New services: orchestrator (builds), clickhouse (usage/executions), appwrite-geo; executor bumped to 0.29.0, console to appwrite/new. - Console is served at / with the API on /v1 and /.well-known and the realtime server on /v1/realtime. - Runtime and build containers join the stack's own Compose network and the builds volume is pinned per project via COMPOSE_PROJECT_NAME.
Three fixes found by deploying this blueprint and testing it surface by surface. The functions service sets SUPABASE_URL to the internal gateway address, while Auth signs tokens with API_EXTERNAL_URL as the issuer. Supabase's own edge function JWT helper (_shared/jwt/default.ts) derives its expected issuer from SUPABASE_URL unless SB_JWT_ISSUER is set, so it rejects every valid token with an issuer mismatch. Passing SB_JWT_ISSUER through fixes that, and is inert for functions that do not read it. The ES256 procedure had three problems. It told you to clone supabase/supabase, which is a very large monorepo, for one 7 KB script; fetching that file is enough and node is its only requirement. It omitted --update-env, without which only four of the six values are printed at all — ANON_KEY_ASYMMETRIC and SERVICE_ROLE_KEY_ASYMMETRIC reach .env alone, so "replace all six with the ones it prints" could not be followed. And the script exits 1 after writing the keys, because it then looks for a docker-compose.yml to patch that is not there and need not be, since this blueprint already wires all four variables; that made a successful run look like a failure. Also documents that pg_graphql is not installed on a fresh database, so the /graphql/v1 route the gateway already exposes answers with an error until one statement is run. The hosted platform ships it enabled, so this is a real difference for code moving across. Verified against a live deployment: the documented steps run as written, all six values land, and the issuer now matches so edge-function JWT verification succeeds. Blueprint validators and generate-meta --check all pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017DjX4ai6xiixeV8knW9Hpa
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
built with Refined Cloudflare Pages Action⚡ Cloudflare Pages Deployment
|
reloopsh/* images only publish a moving 'latest' tag (fe-dashboard also has commit tags, the rest don't), so every image is pinned to the digest of the 2026-10-06 build. meta.json version reflects that build date. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… branch Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
As offered by the author: the portal depends on a new, unpinned image of the author's own; the base template uses only official images. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
minio/minio images are no longer pullable. Run chrislusf/seaweedfs:4.48 as the 'minio' service with S3 on port 9000 and the same credentials, so MINIO_ENDPOINT and the k3s ExternalName stay unchanged. Buckets are created with weed shell in minio-init. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
create-heyo-docs@0.2.3 writes "@heyo-sh/heyo-docs": "latest", which now resolves to 3.4.1 and no longer exports heyoDocs, so astro build fails. Scaffold with create-heyo-docs@3.1.0, pin @heyo-sh/heyo-docs@3.4.1, and set meta version. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…(canary) Port of #1191 (which targets main) onto canary: - app/ and build-scripts/ dependency bumps from #1191 - signoz, timescaledb, valkey template.toml fixes from #1191 - supabase: kept canary's version (already parses under toml 4 after #1131/#1149) - appwrite-2 (merged after #1191 was opened): escape the backslash in the mongo entrypoint (\! -> \\!), which toml 4 rejects as an invalid escape All 559 blueprints/*/template.toml parse with toml@4.2.0. Co-authored-by: narcisonunez <narcisonunez@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Resolves the conflicts with canary and removes the top-level version key from the templates added since this PR was opened. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The template mounted the host's /var/run/tailscale, which does not exist on a standard Dokploy server, so DockTail could never reach tailscaled. Use the upstream sidecar setup: a pinned tailscale/tailscale container (userspace networking, state and socket in named volumes) authenticated with TAILSCALE_AUTH_KEY, sharing its socket with DockTail. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Build from CopilotKit/OpenDots commit 625452e (package.json 0.1.0, upstream has no tags yet) instead of the moving main branch, and set meta.json version to 0.1.0-625452e instead of "latest". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add Nebulynk Template
Deploying canary-templates with
|
| Latest commit: |
c28bfff
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://eaf00ee8.canary-templates.pages.dev |
feat: add AzerothCore and AzerothCore Portal templates
Add heyo docs template
feat(blueprint): airbyte template v2 (no hardcoded networks aliases/IPs)
…olete fix: remove obsolete docker-compose version property
feat: add DockTail template
feat: add Puppetflow template
Use waxum latest tag instead of specific version
fix(kaneo): use single bundled image and require AUTH_SECRET
fix: resolve dependabot alerts and make templates parse under toml 4 (canary)
feat: add reloop template
feat: add OpenDots template
feat: add Orbit by Noveum (with storage fix)
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this PR about?
New PR of [Template Name]
Checklist
Before submitting this PR, please make sure that:
Issues related (if applicable)
Close automatically the related issues using the keywords:
closes #ISSUE_NUMBERScreenshots or Videos