Mosquitto 2.1 opens the file for `mosquitto_passwd -c` with O_EXCL, so
the template failed with "File exists" after `touch`. Delete the file
before `-c`, so each start writes a new file with only the current user.
Closes#11691
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop chrome, minio, and redis, which v6 no longer uses. Switch to the
v6 variables (APP_URL, AUTH_SECRET, ENCRYPTION_SECRET, FLAG_*), store
uploads in a volume at /app/data, use Postgres 18, and check /api/health.
Closes#12282
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Remove the ignore flag from 38 PHP-based service templates whose
current images ship a PHP release fixed for CVE-2026-109618 and
CVE-2026-109619 (8.5.12, 8.4.27, 8.3.36, 8.2.35, or the patched
Debian and Ubuntu packages).
Remove the 58 PHP-based services that #12268 marked as ignored, and
include template changes merged from main in #12192.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Database variants: use the same database name in Forgejo and the database
container (`forgejo` by default); Postgres stayed unhealthy and MySQL/MariaDB
installs failed with access denied.
- SSH: publish ${FORGEJO_SSH_PORT:-22222} and set SSH_PORT, DOMAIN and
SSH_DOMAIN, so clone URLs are correct and several instances fit on a server.
- Runner variants: start Forgejo from /usr/bin/s6-svscan, lock the install
with a generated admin, register runner 13.2.0 with a generated shared
secret, and enable the templates.
Closes#11924
The template port 3003 sent API and realtime traffic to a port that the
containers do not listen on (502). Use port 80 as upstream does, update
images and env to the official 2.5.0 compose, drop the removed assistant
service, and default _APP_OPTIONS_FORCE_HTTPS to disabled (upstream
default) so installs on http domains reach the API.
Hatchet leaves new signups unverified unless SMTP is set up, which
blocked users after signup. Default SERVER_AUTH_SET_EMAIL_VERIFIED to
true so operators can still opt out.
DATABASE_URL used $POSTGRES_DB without a default, so fresh deploys
connected to a database named after the user and the migration failed.
Also align setup-config volume names with the other services.
Closes#12106
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
rabbitmq-diagnostics ping succeeds before the AMQP listener on 5672
is open, so dependent services started too early and failed with
connection refused. Use check_port_connectivity with a start period
in the hatchet, plane, rabbitmq and mautic5 templates.
Closes#12105
Allow validated host file and directory mounts outside resource directories
while protecting external paths from deletion.
Clean up cancelled deployment containers and clear tracked process IDs.
Preserve legacy KeyDB and Dragonfly password parsing, accept server backup
paths without extension restrictions, and allow Compose variable proxy ports.
Homarr set SECRET_ENCRYPTION_KEY twice; only the
SERVICE_HEX_64_HOMARR line was ever used, so the duplicate is removed
and existing keys do not change. Bulwark quoted list-syntax values, so
the quotes reached the container and JMAP_SERVER_URL was never created
as a required variable. Existing services keep their stored compose.
Provision Docker once in a prepared image and use a seed ISO for new VMs. Switch development examples to the main branch and refresh service template timestamps.
Andras Bacsai