v0.8.12-beta - image-controle van twaalf minuten naar seconden

Gemeten: 709 seconden voor 318 images, terwijl de netwerktijd zo'n 48 seconden
is. Twee oorzaken.

- het aantal tegelijk gold in totaal in plaats van per registry. Registries
  knijpen per host af en tweederde staat op Docker Hub, dus ghcr, lscr en quay
  stonden daarachter te wachten zonder dat dat iets oploste. Nu vier per
  registry, registries naast elkaar
- elke ronde controleerde alles opnieuw. Geslaagde controles blijven een week
  staan, met spreiding per image zodat niet alles op dezelfde dag verloopt. De
  sleutel is de naam met tag, dus een gewijzigde tag wordt altijd
  gecontroleerd; mislukkingen komen nooit in de cache

Gemeten na de wijziging: koude cache 43s, warme cache 0s.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Q9eqpADJSRs49SoGGr4NAy

.env.example

@@ -31,10 +31,26 @@ PORT=5000
 
 # ── Overig ───────────────────────────────────────────────────────────────────
 
-# Waar de stacks, appdata en backups komen te staan. Dit pad wordt in de
+# De hoofdmap voor stacks, appdata en backups. Dit pad wordt in de container op
-# container op hetzelfde pad gemount, zodat compose-bestanden kloppen.
+# hetzelfde pad gemount, zodat compose-bestanden kloppen, én meegegeven aan de
+# app, zodat de standaarden eronder vallen:
+#   <BASE_DIR>/stacks    <BASE_DIR>/appdata    <BASE_DIR>/backups
+#
+# Wijzig je dit ná de installatie, dan moet je ook de bestaande data verplaatsen.
+# Doe dat via Instellingen → Paden; die knop kopieert eerst, controleert, en
+# ruimt het oude pas daarna op. Alleen deze regel aanpassen laat je data staan
+# waar hij stond.
 #BASE_DIR=/opt/serverup
 
+# Onder welk account Server Up draait. install.sh vult dit in; 0 (of leeg) is
+# root, zoals vóór v0.7.93. De container start altijd als root — dat moet, want
+# het docker-volume is van root — en zakt daarna af naar deze uid/gid.
+#
+# Loop je ergens tegenaan, zet ze dan allebei op 0 en draai `docker compose up -d`.
+# Zie docs/beveiliging.md voor wat dit wel en niet oplevert.
+#SU_UID=0
+#SU_GID=0
+
 # Zet op 1 zodra alles via HTTPS loopt: de sessiecookie krijgt dan de
 # Secure-vlag.
 #SU_HTTPS=1

.forgejo/workflows/build.yml

@@ -69,6 +69,54 @@ jobs:
             sh -c "pip install -q -r server-up/requirements.txt pytest \
                    && python -m pytest tests -q -p no:cacheprovider"
 
+      - name: Compose-bestanden valideren
+        run: |
+          set -euo pipefail
+          # De testsuite controleert of de sjablonen geldige YAML opleveren.
+          # Of `docker compose` ze ook accepteert is een andere vraag: een
+          # depends_on in de verkeerde vorm of network_mode naast networks is
+          # prima YAML en een kapotte stack. Dat merk je anders pas als iemand
+          # de app installeert.
+          #
+          # Renderen kan alleen waar Python staat (in de container), valideren
+          # alleen waar Docker staat (op de runner). Vandaar twee helften.
+          docker run --rm \
+            -v "$PWD:/w" -w /w \
+            -v su-pip-cache:/root/.cache/pip \
+            -e PYTHONDONTWRITEBYTECODE=1 \
+            python:3.12-slim \
+            sh -c "pip install -q -r server-up/requirements.txt \
+                   && python tools/render_voor_validatie.py .compose-check \
+                   && chown -R $(id -u):$(id -g) .compose-check"
+          fouten=0
+          for f in .compose-check/*/docker-compose.yml; do
+            if ! uitvoer=$(docker compose -f "$f" config -q 2>&1); then
+              echo "✖ $(basename "$(dirname "$f")")"
+              echo "$uitvoer" | sed 's/^/    /'
+              fouten=$((fouten + 1))
+            fi
+          done
+          rm -rf .compose-check
+          if [ "$fouten" -ne 0 ]; then
+            echo "$fouten sjablo(o)n(en) leveren een compose-bestand op dat docker weigert"
+            exit 1
+          fi
+          echo "Alle compose-bestanden zijn geldig"
+
+      - name: Images controleren
+        run: |
+          set -euo pipefail
+          # Een image dat niet meer bestaat merk je anders pas als iemand op
+          # installeren drukt. Zo verdween Huntarr nadat dat project offline
+          # ging, en wezen Forgejo, Planka en Baby Buddy naar tags die er niet
+          # zijn. Draait bewust rustig: registries knijpen af, en een afgeknepen
+          # verzoek is niet te onderscheiden van een ontbrekend image.
+          docker run --rm \
+            -v "$PWD:/w" -w /w \
+            -e PYTHONDONTWRITEBYTECODE=1 \
+            python:3.12-slim \
+            python tools/controleer_images.py
+
       - name: Inloggen op de registry
         run: |
           set -euo pipefail

.forgejo/workflows/deploy-prod.yml

@@ -57,6 +57,54 @@ jobs:
             sh -c "pip install -q -r server-up/requirements.txt pytest \
                    && python -m pytest tests -q -p no:cacheprovider"
 
+      - name: Compose-bestanden valideren
+        run: |
+          set -euo pipefail
+          # De testsuite controleert of de sjablonen geldige YAML opleveren.
+          # Of `docker compose` ze ook accepteert is een andere vraag: een
+          # depends_on in de verkeerde vorm of network_mode naast networks is
+          # prima YAML en een kapotte stack. Dat merk je anders pas als iemand
+          # de app installeert.
+          #
+          # Renderen kan alleen waar Python staat (in de container), valideren
+          # alleen waar Docker staat (op de runner). Vandaar twee helften.
+          docker run --rm \
+            -v "$PWD:/w" -w /w \
+            -v su-pip-cache:/root/.cache/pip \
+            -e PYTHONDONTWRITEBYTECODE=1 \
+            python:3.12-slim \
+            sh -c "pip install -q -r server-up/requirements.txt \
+                   && python tools/render_voor_validatie.py .compose-check \
+                   && chown -R $(id -u):$(id -g) .compose-check"
+          fouten=0
+          for f in .compose-check/*/docker-compose.yml; do
+            if ! uitvoer=$(docker compose -f "$f" config -q 2>&1); then
+              echo "✖ $(basename "$(dirname "$f")")"
+              echo "$uitvoer" | sed 's/^/    /'
+              fouten=$((fouten + 1))
+            fi
+          done
+          rm -rf .compose-check
+          if [ "$fouten" -ne 0 ]; then
+            echo "$fouten sjablo(o)n(en) leveren een compose-bestand op dat docker weigert"
+            exit 1
+          fi
+          echo "Alle compose-bestanden zijn geldig"
+
+      - name: Images controleren
+        run: |
+          set -euo pipefail
+          # Een image dat niet meer bestaat merk je anders pas als iemand op
+          # installeren drukt. Zo verdween Huntarr nadat dat project offline
+          # ging, en wezen Forgejo, Planka en Baby Buddy naar tags die er niet
+          # zijn. Draait bewust rustig: registries knijpen af, en een afgeknepen
+          # verzoek is niet te onderscheiden van een ontbrekend image.
+          docker run --rm \
+            -v "$PWD:/w" -w /w \
+            -e PYTHONDONTWRITEBYTECODE=1 \
+            python:3.12-slim \
+            python tools/controleer_images.py
+
       - name: Sync code naar deploy-directory
         run: |
           set -euo pipefail

.forgejo/workflows/deploy.yml

@@ -57,6 +57,61 @@ jobs:
             sh -c "pip install -q -r server-up/requirements.txt pytest \
                    && python -m pytest tests -q -p no:cacheprovider"
 
+      - name: Compose-bestanden valideren
+        run: |
+          set -euo pipefail
+          # De testsuite controleert of de sjablonen geldige YAML opleveren.
+          # Of `docker compose` ze ook accepteert is een andere vraag: een
+          # depends_on in de verkeerde vorm of network_mode naast networks is
+          # prima YAML en een kapotte stack. Dat merk je anders pas als iemand
+          # de app installeert.
+          #
+          # Renderen kan alleen waar Python staat (in de container), valideren
+          # alleen waar Docker staat (op de runner). Vandaar twee helften.
+          docker run --rm \
+            -v "$PWD:/w" -w /w \
+            -v su-pip-cache:/root/.cache/pip \
+            -e PYTHONDONTWRITEBYTECODE=1 \
+            python:3.12-slim \
+            sh -c "pip install -q -r server-up/requirements.txt \
+                   && python tools/render_voor_validatie.py .compose-check \
+                   && chown -R $(id -u):$(id -g) .compose-check"
+          fouten=0
+          for f in .compose-check/*/docker-compose.yml; do
+            if ! uitvoer=$(docker compose -f "$f" config -q 2>&1); then
+              echo "✖ $(basename "$(dirname "$f")")"
+              echo "$uitvoer" | sed 's/^/    /'
+              fouten=$((fouten + 1))
+            fi
+          done
+          rm -rf .compose-check
+          if [ "$fouten" -ne 0 ]; then
+            echo "$fouten sjablo(o)n(en) leveren een compose-bestand op dat docker weigert"
+            exit 1
+          fi
+          echo "Alle compose-bestanden zijn geldig"
+
+      - name: Images controleren
+        run: |
+          set -euo pipefail
+          # Een image dat niet meer bestaat merk je anders pas als iemand op
+          # installeren drukt. Zo verdween Huntarr nadat dat project offline
+          # ging, en wezen Forgejo, Planka en Baby Buddy naar tags die er niet
+          # zijn. Draait bewust rustig: registries knijpen af, en een afgeknepen
+          # verzoek is niet te onderscheiden van een ontbrekend image.
+          #
+          # Geslaagde controles blijven een week staan in su-image-cache, met
+          # spreiding zodat niet alles op dezelfde dag verloopt. Een sjabloon
+          # dat naar een andere tag gaat wijzen levert een nieuwe sleutel op en
+          # wordt dus altijd gecontroleerd; mislukkingen komen nooit in de cache.
+          docker run --rm \
+            -v "$PWD:/w" -w /w \
+            -v su-image-cache:/cache \
+            -e PYTHONDONTWRITEBYTECODE=1 \
+            -e SU_IMAGE_CACHE=/cache/images.json \
+            python:3.12-slim \
+            python tools/controleer_images.py
+
       - name: Sync code naar deploy-directory
         run: |
           set -euo pipefail
@@ -114,6 +169,49 @@ jobs:
           docker compose build --pull
           docker tag "server-up:${VERSION}" "server-up:${CHANNEL}" || true
 
+      # Server Up draait niet meer als root. Dat hangt aan het entrypoint en aan
+      # `setpriv`, en beide zijn alleen in een echte container te toetsen — de
+      # pytest-suite kan er niet bij. Zonder deze stap merk je een regressie hier
+      # pas als iemands installatie niet meer opkomt.
+      - name: Niet-root modus controleren
+        run: |
+          set -euo pipefail
+          IMG="server-up:${VERSION}"
+
+          echo "1. setpriv aanwezig in het image"
+          docker run --rm --entrypoint setpriv "$IMG" --help >/dev/null
+          echo "   ok"
+
+          echo "2. zakt af naar de opgegeven gebruiker"
+          uit=$(docker run --rm -e SU_UID=1000 -e SU_GID=1000 \
+                  -v /var/run/docker.sock:/var/run/docker.sock "$IMG" id)
+          echo "   $uit"
+          case "$uit" in
+            uid=1000*) ;;
+            *) echo "FOUT: draait niet als uid 1000"; exit 1 ;;
+          esac
+
+          echo "3. zit in de groep van de docker-socket"
+          sok_gid=$(stat -c %g /var/run/docker.sock)
+          case "$uit" in
+            *"$sok_gid"*) echo "   gid $sok_gid aanwezig" ;;
+            *) echo "FOUT: gid $sok_gid van de socket ontbreekt"; exit 1 ;;
+          esac
+
+          echo "4. kan schrijven in /data"
+          docker run --rm -e SU_UID=1000 -e SU_GID=1000 \
+            -v "su-nietroot-proef-${VERSION}:/data" "$IMG" \
+            sh -c 'touch /data/proef && echo "   ok"'
+          docker volume rm "su-nietroot-proef-${VERSION}" >/dev/null
+
+          echo "5. zonder SU_UID blijft het root — de ontsnappingsklep"
+          uit0=$(docker run --rm "$IMG" id)
+          echo "   $uit0"
+          case "$uit0" in
+            uid=0*) ;;
+            *) echo "FOUT: SU_UID=0 hoort root te blijven"; exit 1 ;;
+          esac
+
       - name: Deploy
         run: |
           set -euo pipefail
@@ -145,6 +243,62 @@ jobs:
           cd "$DEPLOY_DIR" && docker compose logs --tail=200
           exit 1
 
+      # De backuptests vervangen Docker allemaal door een nepversie. Dat toetst
+      # de logica maar niet de keten: pg_dump via `docker exec`, het archief,
+      # het terugzetten, en of de database daarna nog schrijft. Juist daar
+      # betekent fout zijn gegevensverlies.
+      #
+      # Draait op het zojuist gebouwde image — dus met exact de Python en de
+      # docker-CLI van productie. De werkmap wordt op hetzelfde pad gemount,
+      # want de bind mount van de postgres-container wordt door de daemon op de
+      # host opgezocht, niet in deze container.
+      - name: Backup en terugzetten met echte Docker
+        run: |
+          set -uo pipefail
+          PROEF="$DEPLOY_DIR/.backup-rondgang"
+          rm -rf "$PROEF"; mkdir -p "$PROEF"
+          docker run --rm \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            -v "$PROEF:$PROEF" \
+            -v "$PWD:/w" -w /w \
+            -e PYTHONDONTWRITEBYTECODE=1 \
+            "server-up:${VERSION}" \
+            python tools/backup_rondgang.py "$PROEF"
+          code=$?
+          # De exitcode expliciet tonen. Een run die "Rondgang geslaagd" op het
+          # scherm zette en tóch rood werd, liet nergens zien waar dat vandaan
+          # kwam — en zonder dit getal is dat niet te achterhalen.
+          echo "rondgang exitcode: $code"
+          rm -rf "$PROEF" || true
+          [ "$code" -eq 0 ] || exit 1
+
+      # `--doctor` is ruim honderd regels shell die alleen tegen een échte
+      # installatie draaien. De pytest-suite komt niet verder dan "er is geen
+      # Docker"; hier wel.
+      - name: install.sh --doctor doorlichten
+        if: success()
+        run: |
+          set -uo pipefail
+          uit="$(sh "$DEPLOY_DIR/install.sh" --doctor --dir "$DEPLOY_DIR" 2>&1)"
+          code=$?
+          printf '%s\n' "$uit"
+
+          # Alle secties moeten gedraaid hebben: een shell-fout halverwege zou
+          # anders als "niets aan de hand" langskomen.
+          for kop in "Installatie" "Docker" "Container" "Bereikbaarheid" \
+                     "Account" "Mappen" "Bijwerken vanuit de interface"; do
+            printf '%s\n' "$uit" | grep -q "^$kop$" || {
+              echo "FOUT: --doctor kwam niet tot de sectie '$kop'"; exit 1; }
+          done
+
+          # En de uitslag telt mee. Waarschuwingen mogen (deze deploy draait
+          # bewust nog als root), fouten niet.
+          if [ "$code" -ne 0 ]; then
+            echo "FOUT: --doctor meldt problemen met de deploy"
+            exit 1
+          fi
+          echo "--doctor liep van begin tot eind, zonder fouten"
+
       - name: Oude images opruimen (behoud laatste 5)
         if: success()
         run: |

.gitignore

@@ -4,3 +4,6 @@ __pycache__/
 .env
 .pytest_cache/
 venv/
+node_modules/
+.compose-check/
+venv/

Dockerfile

@@ -11,9 +11,14 @@ ARG SU_VERSION=dev
 LABEL org.opencontainers.image.title="Server Up" \
       org.opencontainers.image.version="${SU_VERSION}" \
       org.opencontainers.image.source="https://git.example.com/bes-r/server-up"
+# util-linux levert `setpriv`, waarmee het entrypoint naar een gewone gebruiker
+# afzakt zonder de capabilities te verliezen die Server Up nodig heeft. Het is
+# een Essential-pakket en dus al aanwezig, maar expliciet noemen zorgt dat een
+# uitgeklede basis-image het niet stilletjes wegbezuinigt.
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    git openssh-client curl tar gzip ca-certificates \
+    git openssh-client curl tar gzip ca-certificates util-linux passwd \
-    && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/* \
+    && setpriv --help >/dev/null
 
 # Install Docker CLI + docker-compose inside container
 RUN DPKG_ARCH=$(dpkg --print-architecture) \
@@ -69,6 +74,12 @@ ENV PYTHONUNBUFFERED=1 PORT=5000 HOME=/root \
     SU_CONFIG=/data/config.json SU_AUDIT=/data/audit.db SU_GIT_CACHE=/data/git \
     SU_SECRET=/data/secret.key \
     GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/data/known_hosts"
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN chmod +x /usr/local/bin/docker-entrypoint.sh
+
 EXPOSE 5000
 HEALTHCHECK --interval=30s --timeout=8s --start-period=15s CMD curl -fs http://localhost:5000/healthz || exit 1
+# Het entrypoint start als root, zet /data klaar en zakt daarna af naar
+# SU_UID:SU_GID. Zonder die variabelen verandert er niets: dan blijft het root.
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 CMD ["python","app.py"]

README.md

@@ -16,7 +16,7 @@ IP-adres in je netwerk geven.
 
 | | |
 |---|---|
-| **App-catalogus** | 96 kant-en-klare apps, ingedeeld in categorieën met kleur. Zoeken, filteren en installeren met een formulier in plaats van YAML. |
+| **App-catalogus** | 286 kant-en-klare apps, ingedeeld in categorieën met kleur. Zoeken, filteren en installeren met een formulier in plaats van YAML. |
 | **Stacks beheren** | Starten, stoppen, bijwerken en herstarten — per stack of per losse container, met logs en live CPU-/geheugengebruik. |
 | **Apps koppelen** | Stacks komen op een gedeeld netwerk, zodat ze elkaar op naam bereiken. Een veld dat naar een andere app verwijst toont een keuzelijst met wat je al draait. |
 | **Eigen IP per stack** | Met macvlan of ipvlan krijgt een app een eigen adres in je LAN in plaats van poorten op de host. |

VERSION

@@ -1 +1 @@
-0.7.40-beta
+0.8.12-beta

apps/2fauth/files/compose.yaml

@@ -0,0 +1,15 @@
+services:
+  << service_name >>:
+    image: 2fauth/2fauth:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+      - APP_KEY=<< app_key >>
+      - APP_URL=<< app_url >>
+      - IS_DEMO_APP=false
+      - TRUSTED_PROXIES=*
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/2fauth
+    ports:
+      - "<< port >>:8000"
+    restart: unless-stopped

apps/2fauth/template.json

@@ -0,0 +1,88 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "2FAuth",
+    "description": "Bewaart je tweestapscodes op je eigen server, zodat je ze niet kwijt bent met je telefoon. Naast Vaultwarden, niet erin — dan liggen wachtwoord en code niet op dezelfde plek.",
+    "tags": [
+      "2fa",
+      "totp",
+      "beveiliging"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "2fauth"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "beveiliging"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "2fauth",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8230,
+          "required": true,
+          "description": "Standaard 8000; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Instellingen",
+      "items": [
+        {
+          "name": "app_url",
+          "type": "str",
+          "title": "Publiek adres",
+          "default": "http://localhost:8230",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Toegang",
+      "items": [
+        {
+          "name": "app_key",
+          "type": "str",
+          "title": "Applicatiesleutel",
+          "default": "",
+          "required": true,
+          "secret": true,
+          "generate": "auto",
+          "secret_format": "laravel",
+          "secret_bytes": 32,
+          "description": "Laravel-formaat; wordt automatisch in de juiste vorm gemaakt"
+        }
+      ]
+    }
+  ]
+}

apps/actual-budget/files/compose.yaml

@@ -5,5 +5,5 @@ services:
     ports:
       - "<< port >>:5006"
     volumes:
-      - << data_dir >>/<< service_name >>/data:/data
+      - << appdata_dir >>/<< service_name >>/data:/data
     restart: unless-stopped

apps/actual-budget/template.json

@@ -39,9 +39,9 @@
           "required": true
         },
         {
-          "name": "data_dir",
+          "name": "appdata_dir",
           "type": "str",
-          "title": "Data directory",
+          "title": "Appdata-map",
           "default": "/opt/serverup/appdata",
           "required": true
         }

apps/adguard-home/files/compose.yaml

@@ -7,6 +7,6 @@ services:
       - "<< port_dns >>:53/tcp"
       - "<< port_dns >>:53/udp"
     volumes:
-      - << data_dir >>/<< service_name >>/work:/opt/adguardhome/work
+      - << appdata_dir >>/<< service_name >>/work:/opt/adguardhome/work
-      - << data_dir >>/<< service_name >>/conf:/opt/adguardhome/conf
+      - << appdata_dir >>/<< service_name >>/conf:/opt/adguardhome/conf
     restart: unless-stopped

apps/adguard-home/template.json

@@ -33,9 +33,9 @@
           "required": true
         },
         {
-          "name": "data_dir",
+          "name": "appdata_dir",
           "type": "str",
-          "title": "Data directory",
+          "title": "Appdata-map",
           "default": "/opt/serverup/appdata",
           "required": true
         }

apps/adminer/files/compose.yaml

@@ -0,0 +1,9 @@
+services:
+  << service_name >>:
+    image: adminer:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+    ports:
+      - "<< port >>:8080"
+    restart: unless-stopped

apps/adminer/template.json

@@ -0,0 +1,51 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Adminer",
+    "description": "Databasebeheer in één bestand: MySQL, PostgreSQL, SQLite en meer, zonder installatie per database. Let op: Adminer geeft volledige toegang tot elke database die hij kan bereiken. Zet hem niet zomaar op internet.",
+    "tags": [
+      "database",
+      "beheer",
+      "ontwikkeling"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "adminer"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "ontwikkeling"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "adminer",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8160,
+          "required": true,
+          "description": "Standaard 8080; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    }
+  ]
+}

apps/alertmanager/files/alertmanager.yml

@@ -0,0 +1,13 @@
+# Startconfiguratie. Zonder dit bestand weigert Alertmanager te starten.
+route:
+  receiver: standaard
+  group_by: [alertname]
+  group_wait: 30s
+  repeat_interval: 4h
+
+receivers:
+  - name: standaard
+<%- if webhook_url %>
+    webhook_configs:
+      - url: "<< webhook_url >>"
+<%- endif %>

apps/alertmanager/files/compose.yaml

@@ -0,0 +1,13 @@
+services:
+  << service_name >>:
+    image: quay.io/prometheus/alertmanager:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/etc/alertmanager
+      - ./alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
+    command: --config.file=/etc/alertmanager/alertmanager.yml --storage.path=/alertmanager
+    ports:
+      - "<< port >>:9093"
+    restart: unless-stopped

apps/alertmanager/template.json

@@ -0,0 +1,83 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Alertmanager",
+    "description": "Neemt de alarmen van Prometheus aan, bundelt ze en stuurt ze door naar e-mail, ntfy of Discord. Onderdrukt herhalingen.",
+    "tags": [
+      "monitoring",
+      "meldingen",
+      "prometheus"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "prometheus"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "monitoring",
+      "communicatie"
+    ],
+    "depends_on": [
+      {
+        "app": "prometheus",
+        "reason": "Alertmanager verwerkt de alarmen die Prometheus opwerpt; los draaiend krijgt hij er nooit een."
+      }
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "alertmanager",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 9093,
+          "required": true
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Instellingen",
+      "items": [
+        {
+          "name": "webhook_url",
+          "type": "str",
+          "title": "Webhook",
+          "default": "",
+          "required": false,
+          "connect": {
+            "app": "ntfy",
+            "scheme": "http",
+            "port": 80
+          },
+          "help": "Waar de alarmen naartoe gaan. Wijs dit naar ntfy of Gotify, of laat het leeg en stel het later in het bestand in."
+        }
+      ]
+    }
+  ]
+}

apps/alloy/files/compose.yaml

@@ -0,0 +1,14 @@
+services:
+  << service_name >>:
+    image: grafana/alloy:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/var/lib/alloy/data
+      - ./config.alloy:/etc/alloy/config.alloy:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    command: run --server.http.listen-addr=0.0.0.0:12345 --storage.path=/var/lib/alloy/data /etc/alloy/config.alloy
+    ports:
+      - "<< port >>:12345"
+    restart: unless-stopped

apps/alloy/files/config.alloy

@@ -0,0 +1,16 @@
+// Leest de logs van elke draaiende container en stuurt ze naar Loki.
+discovery.docker "containers" {
+  host = "unix:///var/run/docker.sock"
+}
+
+loki.source.docker "containers" {
+  host       = "unix:///var/run/docker.sock"
+  targets    = discovery.docker.containers.targets
+  forward_to = [loki.write.opslag.receiver]
+}
+
+loki.write "opslag" {
+  endpoint {
+    url = "<< loki_url >>/loki/api/v1/push"
+  }
+}

apps/alloy/template.json

@@ -0,0 +1,82 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Grafana Alloy",
+    "description": "Verzamelt de logs van je containers en stuurt ze naar Loki. De opvolger van Promtail.",
+    "tags": [
+      "logs",
+      "monitoring",
+      "grafana"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "grafana"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "monitoring"
+    ],
+    "depends_on": [
+      {
+        "app": "loki",
+        "reason": "Alloy verzamelt logs en stuurt ze door. Zonder Loki om ze te bewaren gaan ze meteen weer verloren."
+      }
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "alloy",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 12345,
+          "required": true
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Instellingen",
+      "items": [
+        {
+          "name": "loki_url",
+          "type": "str",
+          "title": "Adres van Loki",
+          "default": "http://loki:3100",
+          "required": true,
+          "connect": {
+            "app": "loki",
+            "scheme": "http",
+            "port": 3100
+          },
+          "help": "Waar Alloy de logs naartoe stuurt. Draaien ze op hetzelfde gedeelde netwerk, dan is de containernaam genoeg."
+        }
+      ]
+    }
+  ]
+}

apps/anythingllm/files/compose.yaml

@@ -0,0 +1,14 @@
+services:
+  << service_name >>:
+    image: mintplexlabs/anythingllm:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+      - STORAGE_DIR=/app/server/storage
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/app/server/storage
+    ports:
+      - "<< port >>:3001"
+    cap_add:
+      - SYS_ADMIN
+    restart: unless-stopped

apps/anythingllm/template.json

@@ -0,0 +1,61 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "AnythingLLM",
+    "description": "Praat met je eigen documenten: laadt bestanden in een vectordatabase en gebruikt die als context. Werkt met Ollama.",
+    "tags": [
+      "ai",
+      "llm",
+      "rag",
+      "documenten"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "anythingllm"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "ai",
+      "documenten"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "anythingllm",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8142,
+          "required": true,
+          "description": "Standaard 3001; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    }
+  ]
+}

apps/appdaemon/files/compose.yaml

@@ -0,0 +1,14 @@
+services:
+  << service_name >>:
+    image: acockburn/appdaemon:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+      - HA_URL=<< ha_url >>
+      - TOKEN=<< ha_token >>
+      - DASH_URL=<< dash_url >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/conf
+    ports:
+      - "<< port >>:5050"
+    restart: unless-stopped

apps/appdaemon/template.json

@@ -0,0 +1,106 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "AppDaemon",
+    "description": "Automatiseringen voor Home Assistant in Python in plaats van YAML. Voor logica die met de ingebouwde automatiseringen onhandig wordt.",
+    "tags": [
+      "domotica",
+      "automatisering",
+      "python"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "appdaemon"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "domotica",
+      "ontwikkeling"
+    ],
+    "depends_on": [
+      {
+        "app": "home-assistant",
+        "reason": "Dit is een dienst die Home Assistant aanroept; los draaiend doet hij niets."
+      }
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "appdaemon",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 5050,
+          "required": true
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Instellingen",
+      "items": [
+        {
+          "name": "ha_url",
+          "type": "str",
+          "title": "Adres van Home Assistant",
+          "default": "http://homeassistant:8123",
+          "required": true,
+          "connect": {
+            "app": "home-assistant",
+            "scheme": "http",
+            "port": 8123
+          },
+          "help": "Waar AppDaemon Home Assistant bereikt."
+        },
+        {
+          "name": "dash_url",
+          "type": "str",
+          "title": "Eigen adres",
+          "default": "http://localhost:5050",
+          "required": true,
+          "description": "Waar het dashboard van AppDaemon zelf op staat"
+        }
+      ]
+    },
+    {
+      "title": "Toegang",
+      "items": [
+        {
+          "name": "ha_token",
+          "type": "str",
+          "title": "Toegangstoken van Home Assistant",
+          "default": "",
+          "required": true,
+          "secret": true,
+          "eigen_invoer": true,
+          "description": "Maak er een aan onder je profiel in Home Assistant"
+        }
+      ]
+    }
+  ]
+}

apps/apprise/files/compose.yaml

@@ -0,0 +1,13 @@
+services:
+  << service_name >>:
+    image: caronc/apprise:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+      - APPRISE_STATEFUL_MODE=simple
+      - APPRISE_WORKER_COUNT=1
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/config
+    ports:
+      - "<< port >>:8000"
+    restart: unless-stopped

apps/apprise/template.json

@@ -0,0 +1,59 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Apprise",
+    "description": "Eén API die je bericht doorstuurt naar honderd diensten: Discord, Telegram, ntfy, e-mail, Signal. Je apps hoeven maar één adres te kennen.",
+    "tags": [
+      "meldingen",
+      "api",
+      "notificaties"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "apprise"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "communicatie"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "apprise",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8251,
+          "required": true,
+          "description": "Standaard 8000; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    }
+  ]
+}

apps/arr-stack/files/compose.yaml

@@ -1,43 +1,29 @@
 # ARR-stack — kies per onderdeel of je het wilt.
 #
-# Aandachtspunten:
+# Alles deelt één map, gekoppeld als /data. Dat is geen smaakkwestie:
-#  * Zet de download- en mediamap op hetzelfde bestandssysteem, anders kopieert
+# staan je downloads en je bibliotheek op verschillende mounts, dan kan
-#    elke voltooide download in plaats van te verplaatsen (traag, dubbele opslag).
+# Sonarr geen hardlink maken en kopieert elke voltooide download naar je
-#  * Draai je met Gluetun, dan zitten de downloadclients in het netwerk van die
+# bibliotheek. Traag, en je hebt alles tijdelijk dubbel op de schijf.
-#    container en bereik je hun webinterface via de Gluetun-poorten.
+#
+#   /data/media/{films,series,muziek,boeken}   je bibliotheek
+#   /data/torrents/                            torrents (blijven seeden)
+#   /data/usenet/                              usenet-downloads
+#
+# Draai je met Gluetun, dan zitten de downloadclients in het netwerk van
+# die container en bereik je hun webinterface via de Gluetun-poorten.
 services:
 
-<%- if enable_sonarr %>
+<%- if enable_kapowarr %>
-  << service_name >>-sonarr:
+  << service_name >>-kapowarr:
-    image: lscr.io/linuxserver/sonarr:latest
+    image: mrcas/kapowarr:latest
-    container_name: << service_name >>-sonarr
+    container_name: << service_name >>-kapowarr
     environment:
-      - PUID=<< puid >>
-      - PGID=<< pgid >>
       - TZ=<< timezone >>
     volumes:
-      - << data_dir >>/<< service_name >>/sonarr:/config
+      - << appdata_dir >>/<< service_name >>/kapowarr:/app/db
-      - << media_dir >>/series:/tv
+      - << data_root >>:/data
-      - << downloads_dir >>:/downloads
     ports:
-      - "<< port_sonarr >>:8989"
+      - "<< port_kapowarr >>:5656"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_radarr %>
-  << service_name >>-radarr:
-    image: lscr.io/linuxserver/radarr:latest
-    container_name: << service_name >>-radarr
-    environment:
-      - PUID=<< puid >>
-      - PGID=<< pgid >>
-      - TZ=<< timezone >>
-    volumes:
-      - << data_dir >>/<< service_name >>/radarr:/config
-      - << media_dir >>/films:/movies
-      - << downloads_dir >>:/downloads
-    ports:
-      - "<< port_radarr >>:7878"
     restart: unless-stopped
 <%- endif %>
 
@@ -49,15 +35,49 @@ services:
       - PUID=<< puid >>
       - PGID=<< pgid >>
       - TZ=<< timezone >>
+      - UMASK=002
     volumes:
-      - << data_dir >>/<< service_name >>/lidarr:/config
+      - << appdata_dir >>/<< service_name >>/lidarr:/config
-      - << media_dir >>/muziek:/music
+      - << data_root >>:/data
-      - << downloads_dir >>:/downloads
     ports:
       - "<< port_lidarr >>:8686"
     restart: unless-stopped
 <%- endif %>
 
+<%- if enable_mylar3 %>
+  << service_name >>-mylar3:
+    image: lscr.io/linuxserver/mylar3:latest
+    container_name: << service_name >>-mylar3
+    environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
+      - TZ=<< timezone >>
+      - UMASK=002
+    volumes:
+      - << appdata_dir >>/<< service_name >>/mylar3:/config
+      - << data_root >>:/data
+    ports:
+      - "<< port_mylar3 >>:8090"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_radarr %>
+  << service_name >>-radarr:
+    image: lscr.io/linuxserver/radarr:latest
+    container_name: << service_name >>-radarr
+    environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
+      - TZ=<< timezone >>
+      - UMASK=002
+    volumes:
+      - << appdata_dir >>/<< service_name >>/radarr:/config
+      - << data_root >>:/data
+    ports:
+      - "<< port_radarr >>:7878"
+    restart: unless-stopped
+<%- endif %>
+
 <%- if enable_readarr %>
   << service_name >>-readarr:
     image: lscr.io/linuxserver/readarr:develop
@@ -66,15 +86,32 @@ services:
       - PUID=<< puid >>
       - PGID=<< pgid >>
       - TZ=<< timezone >>
+      - UMASK=002
     volumes:
-      - << data_dir >>/<< service_name >>/readarr:/config
+      - << appdata_dir >>/<< service_name >>/readarr:/config
-      - << media_dir >>/boeken:/books
+      - << data_root >>:/data
-      - << downloads_dir >>:/downloads
     ports:
       - "<< port_readarr >>:8787"
     restart: unless-stopped
 <%- endif %>
 
+<%- if enable_sonarr %>
+  << service_name >>-sonarr:
+    image: lscr.io/linuxserver/sonarr:latest
+    container_name: << service_name >>-sonarr
+    environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
+      - TZ=<< timezone >>
+      - UMASK=002
+    volumes:
+      - << appdata_dir >>/<< service_name >>/sonarr:/config
+      - << data_root >>:/data
+    ports:
+      - "<< port_sonarr >>:8989"
+    restart: unless-stopped
+<%- endif %>
+
 <%- if enable_whisparr %>
   << service_name >>-whisparr:
     image: ghcr.io/hotio/whisparr:latest
@@ -83,27 +120,39 @@ services:
       - PUID=<< puid >>
       - PGID=<< pgid >>
       - TZ=<< timezone >>
+      - UMASK=002
     volumes:
-      - << data_dir >>/<< service_name >>/whisparr:/config
+      - << appdata_dir >>/<< service_name >>/whisparr:/config
-      - << media_dir >>/volwassen:/adult
+      - << data_root >>:/data
-      - << downloads_dir >>:/downloads
     ports:
       - "<< port_whisparr >>:6969"
     restart: unless-stopped
 <%- endif %>
 
-<%- if enable_prowlarr %>
+<%- if enable_byparr %>
-  << service_name >>-prowlarr:
+  << service_name >>-byparr:
-    image: lscr.io/linuxserver/prowlarr:latest
+    image: ghcr.io/thephaseless/byparr:latest
-    container_name: << service_name >>-prowlarr
+    container_name: << service_name >>-byparr
     environment:
-      - PUID=<< puid >>
-      - PGID=<< pgid >>
       - TZ=<< timezone >>
     volumes:
-      - << data_dir >>/<< service_name >>/prowlarr:/config
+      - << appdata_dir >>/<< service_name >>/byparr:/config
     ports:
-      - "<< port_prowlarr >>:9696"
+      - "<< port_byparr >>:8191"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_flaresolverr %>
+  << service_name >>-flaresolverr:
+    image: ghcr.io/flaresolverr/flaresolverr:latest
+    container_name: << service_name >>-flaresolverr
+    environment:
+      - TZ=<< timezone >>
+      - LOG_LEVEL=info
+    volumes:
+      - << appdata_dir >>/<< service_name >>/flaresolverr:/config
+    ports:
+      - "<< port_flaresolverr >>:8191"
     restart: unless-stopped
 <%- endif %>
 
@@ -115,88 +164,58 @@ services:
       - PUID=<< puid >>
       - PGID=<< pgid >>
       - TZ=<< timezone >>
+      - UMASK=002
     volumes:
-      - << data_dir >>/<< service_name >>/jackett:/config
+      - << appdata_dir >>/<< service_name >>/jackett:/config
     ports:
       - "<< port_jackett >>:9117"
     restart: unless-stopped
 <%- endif %>
 
-<%- if enable_bazarr %>
+<%- if enable_nzbhydra2 %>
-  << service_name >>-bazarr:
+  << service_name >>-nzbhydra2:
-    image: lscr.io/linuxserver/bazarr:latest
+    image: lscr.io/linuxserver/nzbhydra2:latest
-    container_name: << service_name >>-bazarr
+    container_name: << service_name >>-nzbhydra2
     environment:
       - PUID=<< puid >>
       - PGID=<< pgid >>
       - TZ=<< timezone >>
+      - UMASK=002
     volumes:
-      - << data_dir >>/<< service_name >>/bazarr:/config
+      - << appdata_dir >>/<< service_name >>/nzbhydra2:/config
-      - << media_dir >>/films:/movies
-      - << media_dir >>/series:/tv
     ports:
-      - "<< port_bazarr >>:6767"
+      - "<< port_nzbhydra2 >>:5076"
     restart: unless-stopped
 <%- endif %>
 
-<%- if enable_flaresolverr %>
+<%- if enable_prowlarr %>
-  << service_name >>-flaresolverr:
+  << service_name >>-prowlarr:
-    image: ghcr.io/flaresolverr/flaresolverr:latest
+    image: lscr.io/linuxserver/prowlarr:latest
-    container_name: << service_name >>-flaresolverr
+    container_name: << service_name >>-prowlarr
-    environment:
-      - TZ=<< timezone >>
-      - LOG_LEVEL=info
-    ports:
-      - "<< port_flaresolverr >>:8191"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_gluetun %>
-  << service_name >>-gluetun:
-    image: qmcgaw/gluetun:latest
-    container_name: << service_name >>-gluetun
-    cap_add:
-      - NET_ADMIN
-    devices:
-      - /dev/net/tun:/dev/net/tun
-    environment:
-      - TZ=<< timezone >>
-      - VPN_SERVICE_PROVIDER=<< vpn_provider >>
-      - VPN_TYPE=<< vpn_type >>
-      - WIREGUARD_PRIVATE_KEY=<< wireguard_private_key >>
-      - WIREGUARD_ADDRESSES=<< wireguard_addresses >>
-      - OPENVPN_USER=<< openvpn_user >>
-      - OPENVPN_PASSWORD=<< openvpn_password >>
-    ports:
-      # De downloadclients delen dit netwerk, dus hun poorten staan hier.
-<%- if enable_qbittorrent %>
-      - "<< port_qbittorrent >>:8090"
-      - "<< port_qbittorrent_tcp >>:6881"
-      - "<< port_qbittorrent_tcp >>:6881/udp"
-<%- endif %>
-<%- if enable_sabnzbd %>
-      - "<< port_sabnzbd >>:8080"
-<%- endif %>
-<%- if enable_nzbget %>
-      - "<< port_nzbget >>:6789"
-<%- endif %>
-    volumes:
-      - << data_dir >>/<< service_name >>/gluetun:/gluetun
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_qbittorrent %>
-  << service_name >>-qbittorrent:
-    image: lscr.io/linuxserver/qbittorrent:latest
-    container_name: << service_name >>-qbittorrent
     environment:
       - PUID=<< puid >>
       - PGID=<< pgid >>
       - TZ=<< timezone >>
-      - WEBUI_PORT=8090
+      - UMASK=002
     volumes:
-      - << data_dir >>/<< service_name >>/qbittorrent:/config
+      - << appdata_dir >>/<< service_name >>/prowlarr:/config
-      - << downloads_dir >>:/downloads
+    ports:
+      - "<< port_prowlarr >>:9696"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_deluge %>
+  << service_name >>-deluge:
+    image: lscr.io/linuxserver/deluge:latest
+    container_name: << service_name >>-deluge
+    environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
+      - TZ=<< timezone >>
+      - UMASK=002
+    volumes:
+      - << appdata_dir >>/<< service_name >>/deluge:/config
+      - << data_root >>:/data
 <%- if enable_gluetun %>
     network_mode: "service:<< service_name >>-gluetun"
     depends_on:
@@ -204,32 +223,9 @@ services:
 <%- endif %>
 <%- if not enable_gluetun %>
     ports:
-      - "<< port_qbittorrent >>:8090"
+      - "<< port_deluge >>:8112"
-      - "<< port_qbittorrent_tcp >>:6881"
+      - "<< port_deluge_torrent >>:6881"
-      - "<< port_qbittorrent_tcp >>:6881/udp"
+      - "<< port_deluge_torrent >>:6881/udp"
-<%- endif %>
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_sabnzbd %>
-  << service_name >>-sabnzbd:
-    image: lscr.io/linuxserver/sabnzbd:latest
-    container_name: << service_name >>-sabnzbd
-    environment:
-      - PUID=<< puid >>
-      - PGID=<< pgid >>
-      - TZ=<< timezone >>
-    volumes:
-      - << data_dir >>/<< service_name >>/sabnzbd:/config
-      - << downloads_dir >>:/downloads
-<%- if enable_gluetun %>
-    network_mode: "service:<< service_name >>-gluetun"
-    depends_on:
-      - << service_name >>-gluetun
-<%- endif %>
-<%- if not enable_gluetun %>
-    ports:
-      - "<< port_sabnzbd >>:8080"
 <%- endif %>
     restart: unless-stopped
 <%- endif %>
@@ -242,9 +238,10 @@ services:
       - PUID=<< puid >>
       - PGID=<< pgid >>
       - TZ=<< timezone >>
+      - UMASK=002
     volumes:
-      - << data_dir >>/<< service_name >>/nzbget:/config
+      - << appdata_dir >>/<< service_name >>/nzbget:/config
-      - << downloads_dir >>:/downloads
+      - << data_root >>:/data
 <%- if enable_gluetun %>
     network_mode: "service:<< service_name >>-gluetun"
     depends_on:
@@ -257,44 +254,134 @@ services:
     restart: unless-stopped
 <%- endif %>
 
-<%- if enable_jellyseerr %>
+<%- if enable_qbittorrent %>
-  << service_name >>-jellyseerr:
+  << service_name >>-qbittorrent:
-    image: fallenbagel/jellyseerr:latest
+    image: lscr.io/linuxserver/qbittorrent:latest
-    container_name: << service_name >>-jellyseerr
+    container_name: << service_name >>-qbittorrent
     environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
       - TZ=<< timezone >>
-      - LOG_LEVEL=info
+      - UMASK=002
+      - WEBUI_PORT=8090
     volumes:
-      - << data_dir >>/<< service_name >>/jellyseerr:/app/config
+      - << appdata_dir >>/<< service_name >>/qbittorrent:/config
+      - << data_root >>:/data
+<%- if enable_gluetun %>
+    network_mode: "service:<< service_name >>-gluetun"
+    depends_on:
+      - << service_name >>-gluetun
+<%- endif %>
+<%- if not enable_gluetun %>
     ports:
-      - "<< port_jellyseerr >>:5055"
+      - "<< port_qbittorrent >>:8090"
+      - "<< port_qbittorrent_torrent >>:6881"
+      - "<< port_qbittorrent_torrent >>:6881/udp"
+<%- endif %>
     restart: unless-stopped
 <%- endif %>
 
-<%- if enable_recyclarr %>
+<%- if enable_sabnzbd %>
-  << service_name >>-recyclarr:
+  << service_name >>-sabnzbd:
-    image: ghcr.io/recyclarr/recyclarr:latest
+    image: lscr.io/linuxserver/sabnzbd:latest
-    container_name: << service_name >>-recyclarr
+    container_name: << service_name >>-sabnzbd
-    user: << puid >>:<< pgid >>
     environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
       - TZ=<< timezone >>
+      - UMASK=002
     volumes:
-      - << data_dir >>/<< service_name >>/recyclarr:/config
+      - << appdata_dir >>/<< service_name >>/sabnzbd:/config
+      - << data_root >>:/data
+<%- if enable_gluetun %>
+    network_mode: "service:<< service_name >>-gluetun"
+    depends_on:
+      - << service_name >>-gluetun
+<%- endif %>
+<%- if not enable_gluetun %>
+    ports:
+      - "<< port_sabnzbd >>:8080"
+<%- endif %>
     restart: unless-stopped
 <%- endif %>
 
-<%- if enable_unpackerr %>
+<%- if enable_slskd %>
-  << service_name >>-unpackerr:
+  << service_name >>-slskd:
-    image: ghcr.io/unpackerr/unpackerr:latest
+    image: slskd/slskd:latest
-    container_name: << service_name >>-unpackerr
+    container_name: << service_name >>-slskd
-    user: << puid >>:<< pgid >>
     environment:
       - TZ=<< timezone >>
-      - UN_SONARR_0_URL=http://<< service_name >>-sonarr:8989
+      - SLSKD_REMOTE_CONFIGURATION=true
-      - UN_RADARR_0_URL=http://<< service_name >>-radarr:7878
     volumes:
-      - << data_dir >>/<< service_name >>/unpackerr:/config
+      - << appdata_dir >>/<< service_name >>/slskd:/app
-      - << downloads_dir >>:/downloads
+      - << data_root >>:/data
+<%- if enable_gluetun %>
+    network_mode: "service:<< service_name >>-gluetun"
+    depends_on:
+      - << service_name >>-gluetun
+<%- endif %>
+<%- if not enable_gluetun %>
+    ports:
+      - "<< port_slskd >>:5030"
+      - "<< port_slskd_listen >>:50300"
+<%- endif %>
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_transmission %>
+  << service_name >>-transmission:
+    image: lscr.io/linuxserver/transmission:latest
+    container_name: << service_name >>-transmission
+    environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
+      - TZ=<< timezone >>
+      - UMASK=002
+    volumes:
+      - << appdata_dir >>/<< service_name >>/transmission:/config
+      - << data_root >>:/data
+<%- if enable_gluetun %>
+    network_mode: "service:<< service_name >>-gluetun"
+    depends_on:
+      - << service_name >>-gluetun
+<%- endif %>
+<%- if not enable_gluetun %>
+    ports:
+      - "<< port_transmission >>:9091"
+      - "<< port_transmission_torrent >>:51413"
+      - "<< port_transmission_torrent >>:51413/udp"
+<%- endif %>
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_bazarr %>
+  << service_name >>-bazarr:
+    image: lscr.io/linuxserver/bazarr:latest
+    container_name: << service_name >>-bazarr
+    environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
+      - TZ=<< timezone >>
+      - UMASK=002
+    volumes:
+      - << appdata_dir >>/<< service_name >>/bazarr:/config
+      - << data_root >>:/data
+    ports:
+      - "<< port_bazarr >>:6767"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_lingarr %>
+  << service_name >>-lingarr:
+    image: lingarr/lingarr:latest
+    container_name: << service_name >>-lingarr
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/lingarr:/app/config
+      - << data_root >>:/data
+    ports:
+      - "<< port_lingarr >>:9876"
     restart: unless-stopped
 <%- endif %>
 
@@ -306,57 +393,453 @@ services:
       - PUID=<< puid >>
       - PGID=<< pgid >>
       - TZ=<< timezone >>
+      - UMASK=002
       - serverIP=0.0.0.0
       - serverPort=8266
       - webUIPort=8265
       - internalNode=true
     volumes:
-      - << data_dir >>/<< service_name >>/tdarr/server:/app/server
+      - << appdata_dir >>/<< service_name >>/tdarr:/app/server
-      - << data_dir >>/<< service_name >>/tdarr/configs:/app/configs
+      - << data_root >>:/data
-      - << media_dir >>:/media
+      - << appdata_dir >>/<< service_name >>/tdarr-configs:/app/configs
-      - << downloads_dir >>/tdarr-cache:/temp
     ports:
       - "<< port_tdarr >>:8265"
       - "<< port_tdarr_server >>:8266"
     restart: unless-stopped
 <%- endif %>
 
-<%- if enable_autobrr %>
+<%- if enable_unpackerr %>
-  << service_name >>-autobrr:
+  << service_name >>-unpackerr:
-    image: ghcr.io/autobrr/autobrr:latest
+    image: ghcr.io/unpackerr/unpackerr:latest
-    container_name: << service_name >>-autobrr
+    container_name: << service_name >>-unpackerr
+    environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
+      - TZ=<< timezone >>
+      - UN_SONARR_0_URL=<< sonarr_url >>
+      - UN_SONARR_0_API_KEY=<< sonarr_apikey >>
+      - UN_RADARR_0_URL=<< radarr_url >>
+      - UN_RADARR_0_API_KEY=<< radarr_apikey >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/unpackerr:/config
+      - << data_root >>:/data
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_jellyseerr %>
+  << service_name >>-jellyseerr:
+    image: fallenbagel/jellyseerr:latest
+    container_name: << service_name >>-jellyseerr
+    environment:
+      - TZ=<< timezone >>
+      - LOG_LEVEL=info
+    volumes:
+      - << appdata_dir >>/<< service_name >>/jellyseerr:/app/config
+    ports:
+      - "<< port_jellyseerr >>:5055"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_overseerr %>
+  << service_name >>-overseerr:
+    image: sctx/overseerr:latest
+    container_name: << service_name >>-overseerr
+    environment:
+      - TZ=<< timezone >>
+      - LOG_LEVEL=info
+    volumes:
+      - << appdata_dir >>/<< service_name >>/overseerr:/app/config
+    ports:
+      - "<< port_overseerr >>:5055"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_prefetcharr %>
+  << service_name >>-prefetcharr:
+    image: phueber/prefetcharr:latest
+    container_name: << service_name >>-prefetcharr
     environment:
       - TZ=<< timezone >>
     volumes:
-      - << data_dir >>/<< service_name >>/autobrr:/config
+      - << appdata_dir >>/<< service_name >>/prefetcharr:/config
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_pulsarr %>
+  << service_name >>-pulsarr:
+    image: lakker/pulsarr:latest
+    container_name: << service_name >>-pulsarr
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/pulsarr:/app/data
     ports:
-      - "<< port_autobrr >>:7474"
+      - "<< port_pulsarr >>:3003"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_requestrr %>
+  << service_name >>-requestrr:
+    image: thomst08/requestrr:latest
+    container_name: << service_name >>-requestrr
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/requestrr:/root/config
+    ports:
+      - "<< port_requestrr >>:4545"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_suggestarr %>
+  << service_name >>-suggestarr:
+    image: ciuse99/suggestarr:latest
+    container_name: << service_name >>-suggestarr
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/suggestarr:/app/config
+    ports:
+      - "<< port_suggestarr >>:5000"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_wizarr %>
+  << service_name >>-wizarr:
+    image: ghcr.io/wizarrrr/wizarr:latest
+    container_name: << service_name >>-wizarr
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/wizarr:/data/database
+    ports:
+      - "<< port_wizarr >>:5690"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_cleanuparr %>
+  << service_name >>-cleanuparr:
+    image: ghcr.io/cleanuparr/cleanuparr:latest
+    container_name: << service_name >>-cleanuparr
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/cleanuparr:/config
+      - << data_root >>:/data
+    ports:
+      - "<< port_cleanuparr >>:11011"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_crossseed %>
+  << service_name >>-crossseed:
+    image: ghcr.io/cross-seed/cross-seed:latest
+    container_name: << service_name >>-crossseed
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/crossseed:/config
+      - << data_root >>:/data
+    command: daemon
+    ports:
+      - "<< port_crossseed >>:2468"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_decluttarr %>
+  << service_name >>-decluttarr:
+    image: ghcr.io/manimatter/decluttarr:latest
+    container_name: << service_name >>-decluttarr
+    environment:
+      - TZ=<< timezone >>
+      - SONARR_URL=<< sonarr_url >>
+      - SONARR_KEY=<< sonarr_apikey >>
+      - RADARR_URL=<< radarr_url >>
+      - RADARR_KEY=<< radarr_apikey >>
+      - LOG_LEVEL=INFO
+    volumes:
+      - << appdata_dir >>/<< service_name >>/decluttarr:/config
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_janitorr %>
+  << service_name >>-janitorr:
+    image: ghcr.io/schaka/janitorr:native-stable
+    container_name: << service_name >>-janitorr
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/janitorr:/config
+      - << data_root >>:/data
+    ports:
+      - "<< port_janitorr >>:8978"
     restart: unless-stopped
 <%- endif %>
 
 <%- if enable_maintainerr %>
   << service_name >>-maintainerr:
-    image: ghcr.io/jorenn92/maintainerr:latest
+    image: ghcr.io/maintainerr/maintainerr:latest
     container_name: << service_name >>-maintainerr
-    user: << puid >>:<< pgid >>
     environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
       - TZ=<< timezone >>
     volumes:
-      - << data_dir >>/<< service_name >>/maintainerr:/opt/data
+      - << appdata_dir >>/<< service_name >>/maintainerr:/opt/data
     ports:
       - "<< port_maintainerr >>:6246"
     restart: unless-stopped
 <%- endif %>
 
-<%- if enable_huntarr %>
+<%- if enable_neutarr %>
-  << service_name >>-huntarr:
+  << service_name >>-neutarr:
-    image: ghcr.io/plexguide/huntarr:latest
+    image: iampuid0/neutarr:latest
-    container_name: << service_name >>-huntarr
+    container_name: << service_name >>-neutarr
     environment:
       - TZ=<< timezone >>
     volumes:
-      - << data_dir >>/<< service_name >>/huntarr:/config
+      - << appdata_dir >>/<< service_name >>/neutarr:/config
     ports:
-      - "<< port_huntarr >>:9705"
+      - "<< port_neutarr >>:9705"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_configarr %>
+  << service_name >>-configarr:
+    image: ghcr.io/raydak-labs/configarr:latest
+    container_name: << service_name >>-configarr
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/configarr:/app/config
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_profilarr %>
+  << service_name >>-profilarr:
+    image: santiagosayshey/profilarr:latest
+    container_name: << service_name >>-profilarr
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/profilarr:/config
+    ports:
+      - "<< port_profilarr >>:6868"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_recyclarr %>
+  << service_name >>-recyclarr:
+    image: ghcr.io/recyclarr/recyclarr:latest
+    container_name: << service_name >>-recyclarr
+    environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/recyclarr:/config
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_kometa %>
+  << service_name >>-kometa:
+    image: kometateam/kometa:latest
+    container_name: << service_name >>-kometa
+    environment:
+      - TZ=<< timezone >>
+      - KOMETA_RUN=false
+    volumes:
+      - << appdata_dir >>/<< service_name >>/kometa:/config
+      - << data_root >>:/data
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_posterizarr %>
+  << service_name >>-posterizarr:
+    image: ghcr.io/fscorrupt/posterizarr:latest
+    container_name: << service_name >>-posterizarr
+    environment:
+      - TZ=<< timezone >>
+      - RUN_TIME=disabled
+    volumes:
+      - << appdata_dir >>/<< service_name >>/posterizarr:/config
+      - << data_root >>:/data
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_trailarr %>
+  << service_name >>-trailarr:
+    image: nandyalu/trailarr:latest
+    container_name: << service_name >>-trailarr
+    environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
+      - TZ=<< timezone >>
+      - UMASK=002
+    volumes:
+      - << appdata_dir >>/<< service_name >>/trailarr:/config
+      - << data_root >>:/data
+    ports:
+      - "<< port_trailarr >>:7889"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_autopulse %>
+  << service_name >>-autopulse:
+    image: ghcr.io/dan-online/autopulse:latest
+    container_name: << service_name >>-autopulse
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/autopulse:/app/config
+    ports:
+      - "<< port_autopulse >>:2875"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_exportarr %>
+  << service_name >>-exportarr:
+    image: ghcr.io/onedr0p/exportarr:latest
+    container_name: << service_name >>-exportarr
+    environment:
+      - TZ=<< timezone >>
+      - URL=<< arr_url >>
+      - APIKEY=<< arr_apikey >>
+      - PORT=<< port_exportarr >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/exportarr:/config
+    command: << arr_soort >>
+    ports:
+      - "<< port_exportarr >>:9707"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_homarr %>
+  << service_name >>-homarr:
+    image: ghcr.io/homarr-labs/homarr:latest
+    container_name: << service_name >>-homarr
+    environment:
+      - TZ=<< timezone >>
+      - SECRET_ENCRYPTION_KEY=<< homarr_encryption_key >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/homarr:/appdata
+    ports:
+      - "<< port_homarr >>:7575"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_jellystat %>
+  << service_name >>-jellystat:
+    image: cyfershepard/jellystat:latest
+    container_name: << service_name >>-jellystat
+    environment:
+      - TZ=<< timezone >>
+      - POSTGRES_USER=jellystat
+      - POSTGRES_PASSWORD=<< db_password >>
+      - POSTGRES_IP=<< service_name >>-jellystat-db
+      - POSTGRES_PORT=5432
+      - JWT_SECRET=<< jwt_secret >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/jellystat:/app/backend/backup-data
+    ports:
+      - "<< port_jellystat >>:3000"
+    depends_on:
+      - << service_name >>-jellystat-db
+    restart: unless-stopped
+  << service_name >>-jellystat-db:
+    image: postgres:16-alpine
+    container_name: << service_name >>-jellystat-db
+    environment:
+      - POSTGRES_USER=jellystat
+      - POSTGRES_PASSWORD=<< db_password >>
+      - POSTGRES_DB=jfstat
+    volumes:
+      - << appdata_dir >>/<< service_name >>-jellystat-db:/var/lib/postgresql/data
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_notifiarr %>
+  << service_name >>-notifiarr:
+    image: golift/notifiarr:latest
+    container_name: << service_name >>-notifiarr
+    environment:
+      - TZ=<< timezone >>
+      - DN_API_KEY=<< notifiarr_apikey >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/notifiarr:/config
+    ports:
+      - "<< port_notifiarr >>:5454"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_tautulli %>
+  << service_name >>-tautulli:
+    image: lscr.io/linuxserver/tautulli:latest
+    container_name: << service_name >>-tautulli
+    environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
+      - TZ=<< timezone >>
+      - UMASK=002
+    volumes:
+      - << appdata_dir >>/<< service_name >>/tautulli:/config
+    ports:
+      - "<< port_tautulli >>:8181"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_soularr %>
+  << service_name >>-soularr:
+    image: mrusse08/soularr:latest
+    container_name: << service_name >>-soularr
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/soularr:/data
+      - << data_root >>:/data
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_gluetun %>
+  << service_name >>-gluetun:
+    image: qmcgaw/gluetun:latest
+    container_name: << service_name >>-gluetun
+    environment:
+      - TZ=<< timezone >>
+      - VPN_SERVICE_PROVIDER=<< vpn_provider >>
+      - VPN_TYPE=<< vpn_type >>
+      - SERVER_COUNTRIES=<< vpn_landen >>
+      - WIREGUARD_PRIVATE_KEY=<< wireguard_private_key >>
+      - WIREGUARD_ADDRESSES=<< wireguard_addresses >>
+      - OPENVPN_USER=<< openvpn_user >>
+      - OPENVPN_PASSWORD=<< openvpn_password >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>/gluetun:/gluetun
+    cap_add:
+      - NET_ADMIN
+    devices:
+      - /dev/net/tun:/dev/net/tun
+    ports:
+      # De downloadclients delen dit netwerk, dus hun webinterfaces
+      # staan hier. Inkomende torrentpoorten niet: die regelt je
+      # VPN-aanbieder met port forwarding.
+<%- if enable_deluge %>
+      - "<< port_deluge >>:8112"
+<%- endif %>
+<%- if enable_nzbget %>
+      - "<< port_nzbget >>:6789"
+<%- endif %>
+<%- if enable_qbittorrent %>
+      - "<< port_qbittorrent >>:8090"
+<%- endif %>
+<%- if enable_sabnzbd %>
+      - "<< port_sabnzbd >>:8080"
+<%- endif %>
+<%- if enable_slskd %>
+      - "<< port_slskd >>:5030"
+<%- endif %>
+<%- if enable_transmission %>
+      - "<< port_transmission >>:9091"
+<%- endif %>
     restart: unless-stopped
 <%- endif %>

apps/audiobookshelf/files/compose.yaml

@@ -8,6 +8,6 @@ services:
       - TZ=<< timezone >>
     volumes:
       - << media_dir >>:/audiobooks
-      - << data_dir >>/<< service_name >>/config:/config
+      - << appdata_dir >>/<< service_name >>/config:/config
-      - << data_dir >>/<< service_name >>/metadata:/metadata
+      - << appdata_dir >>/<< service_name >>/metadata:/metadata
     restart: unless-stopped

apps/audiobookshelf/template.json

@@ -38,9 +38,9 @@
           "required": true
         },
         {
-          "name": "data_dir",
+          "name": "appdata_dir",
           "type": "str",
-          "title": "Data directory",
+          "title": "Appdata-map",
           "default": "/opt/serverup/appdata",
           "required": true
         },

apps/authelia/files/compose.yaml

@@ -11,5 +11,5 @@ services:
       - AUTHELIA_STORAGE_ENCRYPTION_KEY=<< storage_key >>
     volumes:
       # Zet hier configuration.yml en users_database.yml neer voor de eerste start.
-      - << data_dir >>/<< service_name >>/config:/config
+      - << appdata_dir >>/<< service_name >>/config:/config
     restart: unless-stopped

apps/authelia/template.json

@@ -38,9 +38,9 @@
           "required": true
         },
         {
-          "name": "data_dir",
+          "name": "appdata_dir",
           "type": "str",
-          "title": "Data directory",
+          "title": "Appdata-map",
           "default": "/opt/serverup/appdata",
           "required": true
         },
@@ -61,7 +61,9 @@
           "config": {
             "placeholder": "sterk-wachtwoord"
           },
-          "advanced": true
+          "advanced": true,
+          "generate": "auto",
+          "secret": true
         },
         {
           "name": "session_secret",
@@ -73,7 +75,9 @@
           "config": {
             "placeholder": "sterk-wachtwoord"
           },
-          "advanced": true
+          "advanced": true,
+          "generate": "auto",
+          "secret": true
         },
         {
           "name": "storage_key",
@@ -85,7 +89,9 @@
           "config": {
             "placeholder": "sterk-wachtwoord"
           },
-          "advanced": true
+          "advanced": true,
+          "generate": "auto",
+          "secret": true
         }
       ]
     }

apps/authentik/files/compose.yaml

@@ -0,0 +1,58 @@
+services:
+  << service_name >>:
+    image: ghcr.io/goauthentik/server:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+      - AUTHENTIK_SECRET_KEY=<< secret_key >>
+      - AUTHENTIK_POSTGRESQL__HOST=<< service_name >>-db
+      - AUTHENTIK_POSTGRESQL__USER=authentik
+      - AUTHENTIK_POSTGRESQL__NAME=authentik
+      - AUTHENTIK_POSTGRESQL__PASSWORD=<< db_password >>
+      - AUTHENTIK_REDIS__HOST=<< service_name >>-redis
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/media
+      - << appdata_dir >>/<< service_name >>-templates:/templates
+    command: server
+    ports:
+      - "<< port >>:9000"
+    depends_on:
+      - << service_name >>-db
+      - << service_name >>-redis
+    restart: unless-stopped
+  << service_name >>-worker:
+    image: ghcr.io/goauthentik/server:latest
+    container_name: << service_name >>-worker
+    command: worker
+    environment:
+      - AUTHENTIK_SECRET_KEY=<< secret_key >>
+      - AUTHENTIK_POSTGRESQL__HOST=<< service_name >>-db
+      - AUTHENTIK_POSTGRESQL__USER=authentik
+      - AUTHENTIK_POSTGRESQL__NAME=authentik
+      - AUTHENTIK_POSTGRESQL__PASSWORD=<< db_password >>
+      - AUTHENTIK_REDIS__HOST=<< service_name >>-redis
+    volumes:
+      - << appdata_dir >>/<< service_name >>/media:/media
+      - << appdata_dir >>/<< service_name >>-templates:/templates
+      - /var/run/docker.sock:/var/run/docker.sock
+    depends_on:
+      - << service_name >>-db
+      - << service_name >>-redis
+    restart: unless-stopped
+  << service_name >>-db:
+    image: postgres:16-alpine
+    container_name: << service_name >>-db
+    environment:
+      - POSTGRES_DB=authentik
+      - POSTGRES_USER=authentik
+      - POSTGRES_PASSWORD=<< db_password >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>-db:/var/lib/postgresql/data
+    restart: unless-stopped
+  << service_name >>-redis:
+    image: valkey/valkey:8-alpine
+    container_name: << service_name >>-redis
+    command: valkey-server --save 60 1
+    volumes:
+      - << appdata_dir >>/<< service_name >>-redis:/data
+    restart: unless-stopped

apps/authentik/template.json

@@ -0,0 +1,86 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Authentik",
+    "description": "Volledige identiteitsserver: OIDC, SAML, LDAP en passkeys, met een visuele opbouw van je inlogstappen. De zwaardere broer van Authelia.",
+    "tags": [
+      "sso",
+      "oidc",
+      "saml",
+      "ldap",
+      "authenticatie"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "authentik"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "beveiliging"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "authentik",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8133,
+          "required": true,
+          "description": "Standaard 9000; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Toegang",
+      "items": [
+        {
+          "name": "db_password",
+          "type": "str",
+          "title": "Databasewachtwoord",
+          "default": "",
+          "required": true,
+          "secret": true,
+          "generate": "auto",
+          "description": "Wordt automatisch ingevuld en in .env bewaard"
+        },
+        {
+          "name": "secret_key",
+          "type": "str",
+          "title": "Geheime sleutel",
+          "default": "",
+          "required": true,
+          "secret": true,
+          "generate": "auto",
+          "description": "Ondertekent de sessies; verlies je hem, dan moet iedereen opnieuw inloggen"
+        }
+      ]
+    }
+  ]
+}

apps/autopulse/files/compose.yaml

@@ -0,0 +1,11 @@
+services:
+  << service_name >>:
+    image: ghcr.io/dan-online/autopulse:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/app/config
+    ports:
+      - "<< port >>:2875"
+    restart: unless-stopped

apps/autopulse/template.json

@@ -0,0 +1,57 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Autopulse",
+    "description": "Laat Plex of Jellyfin meteen een nieuwe aflevering zien, in plaats van te wachten op de volgende scan.",
+    "tags": [
+      "media",
+      "automatisering"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "autopulse"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "media"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "autopulse",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Poort",
+          "default": 2875,
+          "required": true
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de instellingen van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    }
+  ]
+}

apps/baby-buddy/files/compose.yaml

@@ -1,6 +1,6 @@
 services:
   << service_name >>:
-    image: ghcr.io/babybuddy/babybuddy:latest
+    image: lscr.io/linuxserver/babybuddy:latest
     container_name: << service_name >>
     ports:
       - "<< port >>:8000"
@@ -12,5 +12,5 @@ services:
       - ALLOWED_HOSTS=<< allowed_hosts >>
       - CSRF_TRUSTED_ORIGINS=http://<< allowed_hosts >>
     volumes:
-      - << data_dir >>/<< service_name >>/config:/app/data
+      - << appdata_dir >>/<< service_name >>:/config
     restart: unless-stopped

apps/baby-buddy/template.json

@@ -38,9 +38,9 @@
           "required": true
         },
         {
-          "name": "data_dir",
+          "name": "appdata_dir",
           "type": "str",
-          "title": "Data directory",
+          "title": "Appdata-map",
           "default": "/opt/serverup/appdata",
           "required": true
         },
@@ -77,7 +77,9 @@
           "description": "Willekeurige waarde voor sessieversleuteling; gebruik de dobbelsteenknop",
           "config": {
             "placeholder": "willekeurige-lange-string"
-          }
+          },
+          "generate": "auto",
+          "secret": true
         },
         {
           "name": "allowed_hosts",

apps/backrest/files/compose.yaml

@@ -0,0 +1,14 @@
+services:
+  << service_name >>:
+    image: garethgeorge/backrest:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/config
+      - << appdata_dir >>/<< service_name >>-data:/data
+      - << appdata_dir >>/<< service_name >>-cache:/cache
+      - << bron_dir >>:/userdata:ro
+    ports:
+      - "<< port >>:9898"
+    restart: unless-stopped

apps/backrest/template.json

@@ -0,0 +1,72 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Backrest",
+    "description": "Webinterface voor restic: back-upschema's, snapshots doorbladeren en terugzetten, zonder de commandoregel.",
+    "tags": [
+      "backup",
+      "restic",
+      "opslag"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "backrest"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "opslag"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "backrest",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8127,
+          "required": true,
+          "description": "Standaard 9898; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Instellingen",
+      "items": [
+        {
+          "name": "bron_dir",
+          "type": "str",
+          "title": "Map om te back-uppen",
+          "default": "/opt/serverup",
+          "required": true,
+          "description": "Wordt alleen-lezen gekoppeld als /userdata"
+        }
+      ]
+    }
+  ]
+}

apps/baikal/files/compose.yaml

@@ -0,0 +1,12 @@
+services:
+  << service_name >>:
+    image: ckulka/baikal:nginx
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/var/www/baikal/config
+      - << appdata_dir >>/<< service_name >>-specific:/var/www/baikal/Specific
+    ports:
+      - "<< port >>:80"
+    restart: unless-stopped

apps/baikal/template.json

@@ -0,0 +1,61 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Baïkal",
+    "description": "Je agenda en contacten op je eigen server, via CalDAV en CardDAV. iPhone, Android en Thunderbird praten er zo mee. Vervangt Google Agenda en Google Contacten.",
+    "tags": [
+      "agenda",
+      "contacten",
+      "caldav",
+      "carddav"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "baikal"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "gezin",
+      "productiviteit"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "baikal",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8180,
+          "required": true,
+          "description": "Standaard 80; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    }
+  ]
+}

apps/bambuddy/files/compose.yaml

@@ -10,8 +10,8 @@ services:
       - PGID=<< pgid >>
       - PORT=8000
     volumes:
-      - << data_dir >>/<< service_name >>/data:/app/data
+      - << appdata_dir >>/<< service_name >>/data:/app/data
-      - << data_dir >>/<< service_name >>/logs:/app/logs
+      - << appdata_dir >>/<< service_name >>/logs:/app/logs
     cap_add:
       - NET_BIND_SERVICE
     stop_grace_period: 30s

apps/bambuddy/template.json

@@ -38,9 +38,9 @@
           "required": true
         },
         {
-          "name": "data_dir",
+          "name": "appdata_dir",
           "type": "str",
-          "title": "Data directory",
+          "title": "Appdata-map",
           "default": "/opt/serverup/appdata",
           "required": true
         },

apps/baserow/files/compose.yaml

@@ -8,5 +8,5 @@ services:
       - TZ=<< timezone >>
       - BASEROW_PUBLIC_URL=<< public_url >>
     volumes:
-      - << data_dir >>/<< service_name >>:/baserow/data
+      - << appdata_dir >>/<< service_name >>:/baserow/data
     restart: unless-stopped

apps/baserow/template.json

@@ -39,9 +39,9 @@
           "required": true
         },
         {
-          "name": "data_dir",
+          "name": "appdata_dir",
           "type": "str",
-          "title": "Data directory",
+          "title": "Appdata-map",
           "default": "/opt/serverup/appdata",
           "required": true
         },
@@ -56,9 +56,10 @@
           "name": "public_url",
           "type": "str",
           "title": "Publieke URL",
-          "default": "http://localhost:8098",
+          "default": "http://localhost:8099",
           "required": true,
-          "description": "Zonder dit kloppen links en uploads niet"
+          "description": "Zonder dit kloppen links en uploads niet",
+          "help": "Het adres waarop je Baserow opent. Baserow bouwt hier zijn links mee op, dus een verkeerde poort levert knoppen op die nergens heen gaan. Benader je de server op zijn IP-adres, vul dan dat adres in: http://10.0.20.5:8099"
         }
       ]
     }

apps/bazarr/files/compose.yaml

@@ -0,0 +1,15 @@
+services:
+  << service_name >>:
+    image: lscr.io/linuxserver/bazarr:latest
+    container_name: << service_name >>
+    environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
+      - TZ=<< timezone >>
+      - UMASK=002
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/config
+      - << data_root >>:/data
+    ports:
+      - "<< port >>:6767"
+    restart: unless-stopped

apps/bazarr/template.json

@@ -0,0 +1,86 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Bazarr",
+    "description": "Zoekt en downloadt ondertitels bij wat Sonarr en Radarr al hebben binnengehaald.",
+    "tags": [
+      "media",
+      "ondertitels"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "bazarr"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "media"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "bazarr",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 6767,
+          "required": true
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de instellingen van deze app"
+        },
+        {
+          "name": "data_root",
+          "type": "str",
+          "title": "Gedeelde datamap",
+          "default": "/mnt/data",
+          "required": true,
+          "description": "Eén map met je media én je downloads, gekoppeld als /data",
+          "help": "Media en downloads horen onder één map te staan, die als /data in elke container komt. Alleen dan kan een voltooide download met een hardlink naar je bibliotheek: geen kopie, geen dubbele opslag, en je torrent blijft seeden. Zet je ze op gescheiden paden, dan kopieert elke download opnieuw. Eronder: media/films, media/series, torrents/ en usenet/."
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Gebruiker",
+      "items": [
+        {
+          "name": "puid",
+          "type": "int",
+          "title": "Gebruikers-ID (PUID)",
+          "default": 1000,
+          "required": true,
+          "description": "`id -u` op je server; bepaalt de eigenaar van de bestanden"
+        },
+        {
+          "name": "pgid",
+          "type": "int",
+          "title": "Groeps-ID (PGID)",
+          "default": 1000,
+          "required": true
+        }
+      ]
+    }
+  ]
+}

apps/beszel/files/compose.yaml

@@ -7,7 +7,7 @@ services:
     environment:
       - TZ=<< timezone >>
     volumes:
-      - << data_dir >>/<< service_name >>/data:/beszel_data
+      - << appdata_dir >>/<< service_name >>/data:/beszel_data
     restart: unless-stopped
 
   << service_name >>-agent:

apps/beszel/template.json

@@ -38,9 +38,9 @@
           "required": true
         },
         {
-          "name": "data_dir",
+          "name": "appdata_dir",
           "type": "str",
-          "title": "Data directory",
+          "title": "Appdata-map",
           "default": "/opt/serverup/appdata",
           "required": true
         },

apps/bookstack/files/compose.yaml

@@ -15,7 +15,7 @@ services:
       - DB_PASSWORD=<< db_password >>
       - DB_DATABASE=bookstack
     volumes:
-      - << data_dir >>/<< service_name >>/config:/config
+      - << appdata_dir >>/<< service_name >>/config:/config
     depends_on:
       - << service_name >>-db
     restart: unless-stopped
@@ -32,5 +32,5 @@ services:
       - MYSQL_USER=bookstack
       - MYSQL_PASSWORD=<< db_password >>
     volumes:
-      - << data_dir >>/<< service_name >>/db:/config
+      - << appdata_dir >>/<< service_name >>/db:/config
     restart: unless-stopped

apps/bookstack/template.json

@@ -38,9 +38,9 @@
           "required": true
         },
         {
-          "name": "data_dir",
+          "name": "appdata_dir",
           "type": "str",
-          "title": "Data directory",
+          "title": "Appdata-map",
           "default": "/opt/serverup/appdata",
           "required": true
         },
@@ -78,7 +78,9 @@
           "config": {
             "placeholder": "sterk-wachtwoord"
           },
-          "advanced": true
+          "advanced": true,
+          "generate": "auto",
+          "secret": true
         },
         {
           "name": "app_url",

apps/byparr/files/compose.yaml

@@ -0,0 +1,11 @@
+services:
+  << service_name >>:
+    image: ghcr.io/thephaseless/byparr:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/config
+    ports:
+      - "<< port >>:8191"
+    restart: unless-stopped

apps/byparr/template.json

@@ -0,0 +1,59 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Byparr",
+    "description": "Nieuwer alternatief voor FlareSolverr, gebouwd op SeleniumBase. Spreekt dezelfde API, dus je kunt het er zo voor in de plaats zetten.",
+    "tags": [
+      "indexers",
+      "downloaden",
+      "proxy"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "byparr"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "downloaden"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "byparr",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Poort",
+          "default": 8119,
+          "required": true,
+          "description": "Byparr luistert intern op 8191, net als FlareSolverr"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de instellingen van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    }
+  ]
+}

apps/caddy/files/compose.yaml

@@ -10,7 +10,7 @@ services:
       - TZ=<< timezone >>
     volumes:
       # Zet hier je Caddyfile neer; Caddy regelt de certificaten daarna zelf.
-      - << data_dir >>/<< service_name >>/Caddyfile:/etc/caddy/Caddyfile
+      - << appdata_dir >>/<< service_name >>/Caddyfile:/etc/caddy/Caddyfile
       - << service_name >>_data:/data
       - << service_name >>_config:/config
     restart: unless-stopped

apps/caddy/template.json

@@ -40,9 +40,9 @@
           "help": "Caddy vraagt zelf certificaten aan bij Let's Encrypt en heeft daarvoor poort 80 nodig, ook als je alles via HTTPS aanbiedt."
         },
         {
-          "name": "data_dir",
+          "name": "appdata_dir",
           "type": "str",
-          "title": "Data directory",
+          "title": "Appdata-map",
           "default": "/opt/serverup/appdata",
           "required": true
         },

apps/cadvisor/files/compose.yaml

@@ -0,0 +1,18 @@
+services:
+  << service_name >>:
+    image: gcr.io/cadvisor/cadvisor:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - /:/rootfs:ro
+      - /var/run:/var/run:ro
+      - /sys:/sys:ro
+      - /var/lib/docker/:/var/lib/docker:ro
+      - /dev/disk/:/dev/disk:ro
+    ports:
+      - "<< port >>:8080"
+    devices:
+      - /dev/kmsg
+    privileged: true
+    restart: unless-stopped

apps/cadvisor/template.json

@@ -0,0 +1,59 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "cAdvisor",
+    "description": "Meet per container hoeveel processor, geheugen en netwerk er verbruikt wordt. Vult node-exporter aan, dat alleen de host als geheel ziet. Let op: Draait met verhoogde rechten omdat het bij de cgroups van elke container moet kunnen.",
+    "tags": [
+      "monitoring",
+      "metrics",
+      "containers",
+      "prometheus"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "cadvisor"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "monitoring",
+      "beheer"
+    ],
+    "depends_on": [
+      {
+        "app": "prometheus",
+        "reason": "Levert meetwaarden per container waar Prometheus ze komt ophalen."
+      }
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "cadvisor",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8202,
+          "required": true,
+          "description": "Standaard 8080; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    }
+  ]
+}

apps/cal-com/files/compose.yaml

@@ -0,0 +1,26 @@
+services:
+  << service_name >>:
+    image: calcom/cal.com:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+      - DATABASE_URL=postgresql://calcom:<< db_password >>@<< service_name >>-db:5432/calcom
+      - NEXTAUTH_SECRET=<< nextauth_secret >>
+      - CALENDSO_ENCRYPTION_KEY=<< encryption_key >>
+      - NEXT_PUBLIC_WEBAPP_URL=<< app_url >>
+      - NEXTAUTH_URL=<< app_url >>/api/auth
+    ports:
+      - "<< port >>:3000"
+    depends_on:
+      - << service_name >>-db
+    restart: unless-stopped
+  << service_name >>-db:
+    image: postgres:16-alpine
+    container_name: << service_name >>-db
+    environment:
+      - POSTGRES_DB=calcom
+      - POSTGRES_USER=calcom
+      - POSTGRES_PASSWORD=<< db_password >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>-db:/var/lib/postgresql/data
+    restart: unless-stopped

apps/cal-com/template.json

@@ -0,0 +1,107 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Cal.com",
+    "description": "Laat anderen een afspraak in je agenda prikken, zonder heen-en-weer mailen over wanneer het uitkomt. Vervangt Calendly.",
+    "tags": [
+      "agenda",
+      "afspraken",
+      "planning"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "cal-com"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "productiviteit",
+      "zakelijk"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "calcom",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8194,
+          "required": true,
+          "description": "Standaard 3000; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Instellingen",
+      "items": [
+        {
+          "name": "app_url",
+          "type": "str",
+          "title": "Publiek adres",
+          "default": "http://localhost:8194",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Toegang",
+      "items": [
+        {
+          "name": "db_password",
+          "type": "str",
+          "title": "Databasewachtwoord",
+          "default": "",
+          "required": true,
+          "secret": true,
+          "generate": "auto",
+          "description": "Wordt automatisch ingevuld en in .env bewaard"
+        },
+        {
+          "name": "nextauth_secret",
+          "type": "str",
+          "title": "Sleutel voor de inlogsessies",
+          "default": "",
+          "required": true,
+          "secret": true,
+          "generate": "auto"
+        },
+        {
+          "name": "encryption_key",
+          "type": "str",
+          "title": "Sleutel voor gekoppelde agenda's",
+          "default": "",
+          "required": true,
+          "secret": true,
+          "generate": "auto",
+          "secret_format": "hex",
+          "secret_bytes": 16
+        }
+      ]
+    }
+  ]
+}

apps/calibre-web/files/compose.yaml

@@ -9,6 +9,6 @@ services:
       - PUID=<< puid >>
       - PGID=<< pgid >>
     volumes:
-      - << data_dir >>/<< service_name >>/config:/config
+      - << appdata_dir >>/<< service_name >>/config:/config
       - << books_dir >>:/books
     restart: unless-stopped

apps/calibre-web/template.json

@@ -39,9 +39,9 @@
           "required": true
         },
         {
-          "name": "data_dir",
+          "name": "appdata_dir",
           "type": "str",
-          "title": "Data directory",
+          "title": "Appdata-map",
           "default": "/opt/serverup/appdata",
           "required": true
         },

apps/changedetection-io/files/compose.yaml

@@ -9,5 +9,5 @@ services:
       - CHANGEDETECTION_PASSWORD=<< password >>
 <% endif %>
     volumes:
-      - << data_dir >>/<< service_name >>/data:/datastore
+      - << appdata_dir >>/<< service_name >>/data:/datastore
     restart: unless-stopped

apps/changedetection-io/template.json

@@ -39,9 +39,9 @@
           "required": true
         },
         {
-          "name": "data_dir",
+          "name": "appdata_dir",
           "type": "str",
-          "title": "Data directory",
+          "title": "Appdata-map",
           "default": "/opt/serverup/appdata",
           "required": true
         }
@@ -59,7 +59,9 @@
           "description": "Optioneel wachtwoord om de webinterface te beveiligen. Laat leeg voor geen beveiliging.",
           "config": {
             "placeholder": "sterk-wachtwoord"
-          }
+          },
+          "generate": true,
+          "secret": true
         }
       ]
     }

apps/cleanuparr/files/compose.yaml

@@ -0,0 +1,12 @@
+services:
+  << service_name >>:
+    image: ghcr.io/cleanuparr/cleanuparr:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/config
+      - << data_root >>:/data
+    ports:
+      - "<< port >>:11011"
+    restart: unless-stopped

apps/cleanuparr/template.json

@@ -0,0 +1,67 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Cleanuparr",
+    "description": "Ruimt dode en kwaadaardige torrents op, en downloads waar niemand meer naar verwijst.",
+    "tags": [
+      "downloaden",
+      "onderhoud"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "cleanuparr"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "downloaden",
+      "beheer"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "cleanuparr",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 11011,
+          "required": true
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de instellingen van deze app"
+        },
+        {
+          "name": "data_root",
+          "type": "str",
+          "title": "Gedeelde datamap",
+          "default": "/mnt/data",
+          "required": true,
+          "description": "Eén map met je media én je downloads, gekoppeld als /data",
+          "help": "Media en downloads horen onder één map te staan, die als /data in elke container komt. Alleen dan kan een voltooide download met een hardlink naar je bibliotheek: geen kopie, geen dubbele opslag, en je torrent blijft seeden. Zet je ze op gescheiden paden, dan kopieert elke download opnieuw. Eronder: media/films, media/series, torrents/ en usenet/."
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    }
+  ]
+}

apps/code-server/files/compose.yaml

@@ -0,0 +1,16 @@
+services:
+  << service_name >>:
+    image: lscr.io/linuxserver/code-server:latest
+    container_name: << service_name >>
+    environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
+      - TZ=<< timezone >>
+      - UMASK=002
+      - PASSWORD=<< wachtwoord >>
+      - DEFAULT_WORKSPACE=/config/workspace
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/config
+    ports:
+      - "<< port >>:8443"
+    restart: unless-stopped

apps/code-server/template.json

@@ -0,0 +1,93 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "code-server",
+    "description": "Visual Studio Code in je browser, draaiend op de server. Handig om vanaf een tablet of een andere machine te werken.",
+    "tags": [
+      "editor",
+      "ontwikkeling",
+      "code"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "vscode"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "ontwikkeling"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "codeserver",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8161,
+          "required": true,
+          "description": "Standaard 8443; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Gebruiker",
+      "items": [
+        {
+          "name": "puid",
+          "type": "int",
+          "title": "Gebruikers-ID (PUID)",
+          "default": 1000,
+          "required": true,
+          "description": "`id -u` op je server; bepaalt de eigenaar van de bestanden"
+        },
+        {
+          "name": "pgid",
+          "type": "int",
+          "title": "Groeps-ID (PGID)",
+          "default": 1000,
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Toegang",
+      "items": [
+        {
+          "name": "wachtwoord",
+          "type": "str",
+          "title": "Wachtwoord voor de editor",
+          "default": "",
+          "required": true,
+          "secret": true,
+          "eigen_invoer": true
+        }
+      ]
+    }
+  ]
+}

apps/collabora/files/compose.yaml

@@ -0,0 +1,15 @@
+services:
+  << service_name >>:
+    image: collabora/code:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+      - aliasgroup1=<< nextcloud_url >>
+      - extra_params=--o:ssl.enable=false --o:ssl.termination=true
+      - username=<< admin_user >>
+      - password=<< admin_password >>
+    ports:
+      - "<< port >>:9980"
+    cap_add:
+      - MKNOD
+    restart: unless-stopped

apps/collabora/template.json

@@ -0,0 +1,97 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Collabora Online",
+    "description": "Documenten, spreadsheets en presentaties bewerken in je browser, samen met anderen. Koppelt aan Nextcloud. Vervangt Google Docs en Microsoft Office.",
+    "tags": [
+      "documenten",
+      "kantoor",
+      "samenwerken"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "collabora"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "documenten",
+      "productiviteit"
+    ],
+    "depends_on": [
+      {
+        "app": "nextcloud-aio",
+        "reason": "Collabora is de bewerker; de bestanden en de gebruikers komen uit Nextcloud. Los draaiend heb je niets om te openen."
+      }
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "collabora",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8201,
+          "required": true,
+          "description": "Standaard 9980; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Instellingen",
+      "items": [
+        {
+          "name": "nextcloud_url",
+          "type": "str",
+          "title": "Adres van Nextcloud",
+          "default": "https://cloud.example.com",
+          "required": true,
+          "connect": {
+            "app": "nextcloud-aio",
+            "scheme": "https",
+            "port": 443
+          },
+          "help": "Collabora accepteert alleen verzoeken van dit adres. Klopt het niet, dan blijft de bewerker leeg."
+        },
+        {
+          "name": "admin_user",
+          "type": "str",
+          "title": "Beheerdersnaam",
+          "default": "admin",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Toegang",
+      "items": [
+        {
+          "name": "admin_password",
+          "type": "str",
+          "title": "Beheerderswachtwoord",
+          "default": "",
+          "required": true,
+          "secret": true,
+          "eigen_invoer": true
+        }
+      ]
+    }
+  ]
+}

apps/comfyui/files/compose.yaml

@@ -0,0 +1,12 @@
+services:
+  << service_name >>:
+    image: ghcr.io/ai-dock/comfyui:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/opt/ComfyUI/models
+      - << appdata_dir >>/<< service_name >>-output:/opt/ComfyUI/output
+    ports:
+      - "<< port >>:8188"
+    restart: unless-stopped

apps/comfyui/template.json

@@ -0,0 +1,59 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "ComfyUI",
+    "description": "Beeldgeneratie met modellen die op je eigen machine draaien, opgebouwd als een schema dat je zelf aan elkaar klikt. Let op: Zonder videokaart die doorgegeven wordt aan de container draait dit op de processor, en dan duurt één afbeelding minuten in plaats van seconden.",
+    "tags": [
+      "ai",
+      "beeld",
+      "generatie"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "comfyui"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "ai"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "comfyui",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8210,
+          "required": true,
+          "description": "Standaard 8188; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    }
+  ]
+}

apps/configarr/files/compose.yaml

@@ -0,0 +1,9 @@
+services:
+  << service_name >>:
+    image: ghcr.io/raydak-labs/configarr:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/app/config
+    restart: unless-stopped

apps/configarr/template.json

@@ -0,0 +1,51 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Configarr",
+    "description": "Zelfde idee als Recyclarr, maar met eigen aanpassingen bovenop de TRaSH-gidsen.",
+    "tags": [
+      "media",
+      "configuratie"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "configarr"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "media",
+      "beheer"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "configarr",
+          "required": true
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de instellingen van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    }
+  ]
+}

apps/convertx/files/compose.yaml

@@ -0,0 +1,13 @@
+services:
+  << service_name >>:
+    image: ghcr.io/c4illin/convertx:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+      - JWT_SECRET=<< jwt_secret >>
+      - ACCOUNT_REGISTRATION=false
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/app/data
+    ports:
+      - "<< port >>:3000"
+    restart: unless-stopped

apps/convertx/template.json

@@ -0,0 +1,73 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "ConvertX",
+    "description": "Zet bestanden om naar een ander formaat in je browser: afbeeldingen, documenten, video en geluid, zonder uploaddienst van derden.",
+    "tags": [
+      "conversie",
+      "bestanden",
+      "gereedschap"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "convertx"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "productiviteit"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "convertx",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8176,
+          "required": true,
+          "description": "Standaard 3000; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Toegang",
+      "items": [
+        {
+          "name": "jwt_secret",
+          "type": "str",
+          "title": "JWT-sleutel",
+          "default": "",
+          "required": true,
+          "secret": true,
+          "generate": "auto"
+        }
+      ]
+    }
+  ]
+}

apps/crafty/files/compose.yaml

@@ -0,0 +1,14 @@
+services:
+  << service_name >>:
+    image: registry.gitlab.com/crafty-controller/crafty-4:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/crafty/app/config
+      - << appdata_dir >>/<< service_name >>-servers:/crafty/servers
+      - << appdata_dir >>/<< service_name >>-backups:/crafty/backups
+    ports:
+      - "<< port >>:8443"
+      - "<< port_spel >>:25565"
+    restart: unless-stopped

apps/crafty/template.json

@@ -0,0 +1,68 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Crafty Controller",
+    "description": "Beheerpaneel voor gameservers: meerdere Minecraft-werelden naast elkaar, met back-ups, planning en rechten per gebruiker.",
+    "tags": [
+      "spellen",
+      "minecraft",
+      "gameserver"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "crafty"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "spellen",
+      "beheer"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "crafty",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8206,
+          "required": true,
+          "description": "Standaard 8443; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "port_spel",
+          "type": "int",
+          "title": "Speelpoort",
+          "default": 25566,
+          "required": true,
+          "description": "Voor de eerste server; volgende krijgen 25566 en verder"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    }
+  ]
+}

apps/cross-seed/files/compose.yaml

@@ -0,0 +1,13 @@
+services:
+  << service_name >>:
+    image: ghcr.io/cross-seed/cross-seed:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/config
+      - << data_root >>:/data
+    command: daemon
+    ports:
+      - "<< port >>:2468"
+    restart: unless-stopped

apps/cross-seed/template.json

@@ -0,0 +1,66 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "cross-seed",
+    "description": "Zoekt dezelfde bestanden bij andere trackers, zodat je één download op meerdere plekken kunt seeden.",
+    "tags": [
+      "torrents",
+      "downloaden"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "cross-seed"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "downloaden"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "crossseed",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Poort",
+          "default": 2468,
+          "required": true
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de instellingen van deze app"
+        },
+        {
+          "name": "data_root",
+          "type": "str",
+          "title": "Gedeelde datamap",
+          "default": "/mnt/data",
+          "required": true,
+          "description": "Eén map met je media én je downloads, gekoppeld als /data",
+          "help": "Media en downloads horen onder één map te staan, die als /data in elke container komt. Alleen dan kan een voltooide download met een hardlink naar je bibliotheek: geen kopie, geen dubbele opslag, en je torrent blijft seeden. Zet je ze op gescheiden paden, dan kopieert elke download opnieuw. Eronder: media/films, media/series, torrents/ en usenet/."
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    }
+  ]
+}

apps/crowdsec/files/compose.yaml

@@ -0,0 +1,14 @@
+services:
+  << service_name >>:
+    image: crowdsecurity/crowdsec:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+      - COLLECTIONS=crowdsecurity/linux crowdsecurity/nginx
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/etc/crowdsec
+      - << appdata_dir >>/<< service_name >>-data:/var/lib/crowdsec/data
+      - << log_dir >>:/var/log/host:ro
+    ports:
+      - "<< port >>:8080"
+    restart: unless-stopped

apps/crowdsec/template.json

@@ -0,0 +1,72 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "CrowdSec",
+    "description": "Leest je logbestanden mee en blokkeert aanvallers, met een blocklijst die door alle gebruikers samen wordt opgebouwd.",
+    "tags": [
+      "beveiliging",
+      "firewall",
+      "logs"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "crowdsec"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "beveiliging"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "crowdsec",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "API-poort",
+          "default": 8130,
+          "required": true,
+          "description": "Standaard 8080; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Instellingen",
+      "items": [
+        {
+          "name": "log_dir",
+          "type": "str",
+          "title": "Logmap van de host",
+          "default": "/var/log",
+          "required": true,
+          "description": "Wordt alleen-lezen gekoppeld; hier leest CrowdSec in mee"
+        }
+      ]
+    }
+  ]
+}

apps/cryptpad/files/compose.yaml

@@ -0,0 +1,15 @@
+services:
+  << service_name >>:
+    image: cryptpad/cryptpad:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+      - CPAD_MAIN_DOMAIN=<< hoofddomein >>
+      - CPAD_SANDBOX_DOMAIN=<< sandbox_domein >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/cryptpad/data
+      - << appdata_dir >>/<< service_name >>-blob:/cryptpad/blob
+      - << appdata_dir >>/<< service_name >>-block:/cryptpad/block
+    ports:
+      - "<< port >>:3000"
+    restart: unless-stopped

apps/cryptpad/template.json

@@ -0,0 +1,82 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "CryptPad",
+    "description": "Documenten, spreadsheets en presentaties die in je browser versleuteld worden. De server ziet alleen onleesbare blokken. Vervangt Google Docs.",
+    "tags": [
+      "documenten",
+      "samenwerken",
+      "privacy",
+      "versleuteling"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "cryptpad"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "documenten",
+      "productiviteit"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "cryptpad",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8190,
+          "required": true,
+          "description": "Standaard 3000; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Instellingen",
+      "items": [
+        {
+          "name": "hoofddomein",
+          "type": "str",
+          "title": "Hoofddomein",
+          "default": "https://pad.example.com",
+          "required": true
+        },
+        {
+          "name": "sandbox_domein",
+          "type": "str",
+          "title": "Sandbox-domein",
+          "default": "https://pad-sandbox.example.com",
+          "required": true,
+          "description": "Moet een ánder domein zijn dan het hoofddomein",
+          "help": "CryptPad zet de documentbewerker in een aparte oorsprong, zodat een lek in de bewerker niet bij je sleutels kan. Twee keer hetzelfde domein invullen haalt die scheiding weg."
+        }
+      ]
+    }
+  ]
+}

apps/dashy/files/compose.yaml

@@ -0,0 +1,11 @@
+services:
+  << service_name >>:
+    image: lissy93/dashy:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/app/user-data
+    ports:
+      - "<< port >>:8080"
+    restart: unless-stopped

apps/dashy/template.json

@@ -0,0 +1,59 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Dashy",
+    "description": "Startpagina met statuscontrole per dienst, thema's en widgets. Alles staat in één configuratiebestand dat je ook met de hand kunt bijwerken.",
+    "tags": [
+      "dashboard",
+      "startpagina",
+      "overzicht"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "dashy"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "beheer"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "dashy",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8252,
+          "required": true,
+          "description": "Standaard 8080; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    }
+  ]
+}

apps/dawarich/files/compose.yaml

@@ -0,0 +1,40 @@
+services:
+  << service_name >>:
+    image: freikin/dawarich:latest
+    container_name: << service_name >>
+    environment:
+      - RAILS_ENV=development
+      - DATABASE_HOST=<< service_name >>-db
+      - DATABASE_USERNAME=dawarich
+      - DATABASE_PASSWORD=<< db_password >>
+      - DATABASE_NAME=dawarich
+      - REDIS_URL=redis://<< service_name >>-redis:6379
+      - APPLICATION_HOSTS=<< app_hosts >>
+      - TIME_ZONE=<< timezone >>
+      - SECRET_KEY_BASE=<< secret_key_base >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/var/app/public
+    command: ["web-entrypoint.sh", "bin/rails", "server", "-p", "3000", "-b", "::"]
+    ports:
+      - "<< port >>:3000"
+    depends_on:
+      - << service_name >>-db
+      - << service_name >>-redis
+    restart: unless-stopped
+  << service_name >>-db:
+    image: postgis/postgis:16-3.4-alpine
+    container_name: << service_name >>-db
+    environment:
+      - POSTGRES_DB=dawarich
+      - POSTGRES_USER=dawarich
+      - POSTGRES_PASSWORD=<< db_password >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>-db:/var/lib/postgresql/data
+    restart: unless-stopped
+  << service_name >>-redis:
+    image: valkey/valkey:8-alpine
+    container_name: << service_name >>-redis
+    command: valkey-server --save 60 1
+    volumes:
+      - << appdata_dir >>/<< service_name >>-redis:/data
+    restart: unless-stopped

apps/dawarich/template.json

@@ -0,0 +1,97 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Dawarich",
+    "description": "Je eigen locatiegeschiedenis, als vervanging van Google Maps Timeline. Importeert je oude Google-export.",
+    "tags": [
+      "locatie",
+      "kaart",
+      "privacy"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "dawarich"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "gezin",
+      "beveiliging"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "dawarich",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8152,
+          "required": true,
+          "description": "Standaard 3000; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Instellingen",
+      "items": [
+        {
+          "name": "app_hosts",
+          "type": "str",
+          "title": "Toegestane adressen",
+          "default": "localhost",
+          "required": true,
+          "description": "Komma-gescheiden; Rails weigert verzoeken van andere namen"
+        }
+      ]
+    },
+    {
+      "title": "Toegang",
+      "items": [
+        {
+          "name": "db_password",
+          "type": "str",
+          "title": "Databasewachtwoord",
+          "default": "",
+          "required": true,
+          "secret": true,
+          "generate": "auto",
+          "description": "Wordt automatisch ingevuld en in .env bewaard"
+        },
+        {
+          "name": "secret_key_base",
+          "type": "str",
+          "title": "Rails-sleutel",
+          "default": "",
+          "required": true,
+          "secret": true,
+          "generate": "auto"
+        }
+      ]
+    }
+  ]
+}

apps/decluttarr/files/compose.yaml

@@ -0,0 +1,14 @@
+services:
+  << service_name >>:
+    image: ghcr.io/manimatter/decluttarr:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+      - SONARR_URL=<< sonarr_url >>
+      - SONARR_KEY=<< sonarr_apikey >>
+      - RADARR_URL=<< radarr_url >>
+      - RADARR_KEY=<< radarr_apikey >>
+      - LOG_LEVEL=INFO
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/config
+    restart: unless-stopped

apps/decluttarr/template.json

@@ -0,0 +1,100 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Decluttarr",
+    "description": "Houdt de downloadwachtrij schoon: gooit weg wat vastloopt of niet meer nodig is.",
+    "tags": [
+      "downloaden",
+      "onderhoud"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "decluttarr"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "downloaden",
+      "beheer"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "decluttarr",
+          "required": true
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de instellingen van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Koppelingen",
+      "items": [
+        {
+          "name": "sonarr_url",
+          "type": "str",
+          "title": "Sonarr",
+          "default": "http://sonarr:8989",
+          "required": false,
+          "connect": {
+            "app": "sonarr",
+            "scheme": "http",
+            "port": 8989
+          },
+          "help": "Adres van Sonarr. Laat leeg als je Sonarr niet gebruikt."
+        },
+        {
+          "name": "sonarr_apikey",
+          "type": "str",
+          "title": "Sonarr API-sleutel",
+          "default": "",
+          "required": false,
+          "secret": true,
+          "description": "Te vinden in Sonarr onder Settings → General"
+        },
+        {
+          "name": "radarr_url",
+          "type": "str",
+          "title": "Radarr",
+          "default": "http://radarr:7878",
+          "required": false,
+          "connect": {
+            "app": "radarr",
+            "scheme": "http",
+            "port": 7878
+          },
+          "help": "Adres van Radarr. Laat leeg als je Radarr niet gebruikt."
+        },
+        {
+          "name": "radarr_apikey",
+          "type": "str",
+          "title": "Radarr API-sleutel",
+          "default": "",
+          "required": false,
+          "secret": true,
+          "description": "Te vinden in Radarr onder Settings → General"
+        }
+      ]
+    }
+  ]
+}

apps/deluge/files/compose.yaml

@@ -0,0 +1,17 @@
+services:
+  << service_name >>:
+    image: lscr.io/linuxserver/deluge:latest
+    container_name: << service_name >>
+    environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
+      - TZ=<< timezone >>
+      - UMASK=002
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/config
+      - << data_root >>:/data
+    ports:
+      - "<< port >>:8112"
+      - "<< port_torrent >>:6881"
+      - "<< port_torrent >>:6881/udp"
+    restart: unless-stopped

apps/deluge/template.json

@@ -0,0 +1,95 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Deluge",
+    "description": "Lichte torrentclient met webinterface en een uitgebreid plugin-systeem.",
+    "tags": [
+      "torrents",
+      "downloaden"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "deluge"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "downloaden"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "deluge",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8113,
+          "required": true,
+          "description": "Standaard 8112; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "port_torrent",
+          "type": "int",
+          "title": "Inkomende poort",
+          "default": 6882,
+          "required": true,
+          "description": "Zet deze poort open in je router voor betere snelheden"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de instellingen van deze app"
+        },
+        {
+          "name": "data_root",
+          "type": "str",
+          "title": "Gedeelde datamap",
+          "default": "/mnt/data",
+          "required": true,
+          "description": "Eén map met je media én je downloads, gekoppeld als /data",
+          "help": "Media en downloads horen onder één map te staan, die als /data in elke container komt. Alleen dan kan een voltooide download met een hardlink naar je bibliotheek: geen kopie, geen dubbele opslag, en je torrent blijft seeden. Zet je ze op gescheiden paden, dan kopieert elke download opnieuw. Eronder: media/films, media/series, torrents/ en usenet/."
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Gebruiker",
+      "items": [
+        {
+          "name": "puid",
+          "type": "int",
+          "title": "Gebruikers-ID (PUID)",
+          "default": 1000,
+          "required": true,
+          "description": "`id -u` op je server; bepaalt de eigenaar van de bestanden"
+        },
+        {
+          "name": "pgid",
+          "type": "int",
+          "title": "Groeps-ID (PGID)",
+          "default": 1000,
+          "required": true
+        }
+      ]
+    }
+  ]
+}

apps/dockge/files/compose.yaml

@@ -0,0 +1,14 @@
+services:
+  << service_name >>:
+    image: louislam/dockge:1
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+      - DOCKGE_STACKS_DIR=/opt/stacks
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/app/data
+      - /var/run/docker.sock:/var/run/docker.sock
+      - << stacks_dir >>:/opt/stacks
+    ports:
+      - "<< port >>:5001"
+    restart: unless-stopped

apps/dockge/template.json

@@ -0,0 +1,73 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Dockge",
+    "description": "Beheert je compose-stacks met een interface die het compose-bestand laat zien in plaats van te verstoppen. Lichter dan Portainer.",
+    "tags": [
+      "docker",
+      "beheer",
+      "containers"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "dockge"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "beheer"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "dockge",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8121,
+          "required": true,
+          "description": "Standaard 5001; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Instellingen",
+      "items": [
+        {
+          "name": "stacks_dir",
+          "type": "str",
+          "title": "Stacks-map",
+          "default": "/opt/stacks",
+          "required": true,
+          "description": "Waar Dockge de compose-bestanden neerzet",
+          "help": "Dockge bewaart hier zijn eigen stacks. Wijs dit niet naar de library van Server Up: dan beheren twee programma's dezelfde mappen en overschrijven ze elkaars werk."
+        }
+      ]
+    }
+  ]
+}

apps/docmost/files/compose.yaml

@@ -0,0 +1,35 @@
+services:
+  << service_name >>:
+    image: docmost/docmost:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+      - APP_URL=<< app_url >>
+      - APP_SECRET=<< app_secret >>
+      - DATABASE_URL=postgresql://docmost:<< db_password >>@<< service_name >>-db:5432/docmost?schema=public
+      - REDIS_URL=redis://<< service_name >>-redis:6379
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/app/data/storage
+    ports:
+      - "<< port >>:3000"
+    depends_on:
+      - << service_name >>-db
+      - << service_name >>-redis
+    restart: unless-stopped
+  << service_name >>-db:
+    image: postgres:16-alpine
+    container_name: << service_name >>-db
+    environment:
+      - POSTGRES_DB=docmost
+      - POSTGRES_USER=docmost
+      - POSTGRES_PASSWORD=<< db_password >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>-db:/var/lib/postgresql/data
+    restart: unless-stopped
+  << service_name >>-redis:
+    image: valkey/valkey:8-alpine
+    container_name: << service_name >>-redis
+    command: valkey-server --save 60 1
+    volumes:
+      - << appdata_dir >>/<< service_name >>-redis:/data
+    restart: unless-stopped

apps/docmost/template.json

@@ -0,0 +1,96 @@
+{
+  "kind": "compose",
+  "metadata": {
+    "name": "Docmost",
+    "description": "Documenten samen bewerken in realtime, met werkruimtes en rechten. Vergelijkbaar met Confluence of Notion.",
+    "tags": [
+      "wiki",
+      "documenten",
+      "samenwerken"
+    ],
+    "icon": {
+      "provider": "selfhst",
+      "id": "docmost"
+    },
+    "version": {
+      "name": "latest"
+    },
+    "categories": [
+      "documenten",
+      "productiviteit"
+    ]
+  },
+  "variables": [
+    {
+      "title": "Algemeen",
+      "items": [
+        {
+          "name": "service_name",
+          "type": "str",
+          "title": "Servicenaam",
+          "default": "docmost",
+          "required": true
+        },
+        {
+          "name": "port",
+          "type": "int",
+          "title": "Webinterface",
+          "default": 8157,
+          "required": true,
+          "description": "Standaard 3000; hier verplaatst omdat die poort al bezet is"
+        },
+        {
+          "name": "appdata_dir",
+          "type": "str",
+          "title": "Appdata-map",
+          "default": "/opt/serverup/appdata",
+          "required": true,
+          "description": "Basismap voor de gegevens van deze app"
+        },
+        {
+          "name": "timezone",
+          "type": "str",
+          "title": "Tijdzone",
+          "default": "Europe/Amsterdam",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Instellingen",
+      "items": [
+        {
+          "name": "app_url",
+          "type": "str",
+          "title": "Publiek adres",
+          "default": "http://localhost:8157",
+          "required": true
+        }
+      ]
+    },
+    {
+      "title": "Toegang",
+      "items": [
+        {
+          "name": "db_password",
+          "type": "str",
+          "title": "Databasewachtwoord",
+          "default": "",
+          "required": true,
+          "secret": true,
+          "generate": "auto",
+          "description": "Wordt automatisch ingevuld en in .env bewaard"
+        },
+        {
+          "name": "app_secret",
+          "type": "str",
+          "title": "Geheime sleutel",
+          "default": "",
+          "required": true,
+          "secret": true,
+          "generate": "auto"
+        }
+      ]
+    }
+  ]
+}

apps/docuseal/files/compose.yaml

@@ -0,0 +1,26 @@
+services:
+  << service_name >>:
+    image: docuseal/docuseal:latest
+    container_name: << service_name >>
+    environment:
+      - TZ=<< timezone >>
+      - DATABASE_URL=postgresql://docuseal:<< db_password >>@<< service_name >>-db:5432/docuseal
+      - SECRET_KEY_BASE=<< secret_key_base >>
+      - FORCE_SSL=false
+    volumes:
+      - << appdata_dir >>/<< service_name >>:/data
+    ports:
+      - "<< port >>:3000"
+    depends_on:
+      - << service_name >>-db
+    restart: unless-stopped
+  << service_name >>-db:
+    image: postgres:16-alpine
+    container_name: << service_name >>-db
+    environment:
+      - POSTGRES_DB=docuseal
+      - POSTGRES_USER=docuseal
+      - POSTGRES_PASSWORD=<< db_password >>
+    volumes:
+      - << appdata_dir >>/<< service_name >>-db:/var/lib/postgresql/data
+    restart: unless-stopped