690 changed files with 1579 additions and 44859 deletions
--- a/.env.example
+++ b/.env.example
@ -23,10 +23,6 @@ PORT=5000
 # hand aanpassen kan om terug te rollen naar een eerdere versie.
 #SU_TAG=0.5.40-beta

-# De versie die bij die image-tag hoort. De deploy-workflow en updatehelper
-# houden SU_TAG en SU_VERSION samen bij; normaal hoef je dit niet zelf te zetten.
-#SU_VERSION=0.5.40-beta
-
 # Registry-image, zónder tag. Staat dit ingevuld, dan draait deze server vanaf
 # een registry en werkt de knop "Nu bijwerken" in de interface. Laat het leeg
 # als de server zelf bouwt na een push naar Git — dan is Git de update-route.
@ -35,26 +31,10 @@ PORT=5000

 # ── Overig ───────────────────────────────────────────────────────────────────

-# De hoofdmap voor stacks, appdata en backups. Dit pad wordt in de container op
-# hetzelfde pad gemount, zodat compose-bestanden kloppen, én meegegeven aan de
-# app, zodat de standaarden eronder vallen:
-#   <BASE_DIR>/stacks    <BASE_DIR>/appdata    <BASE_DIR>/backups
-#
-# Wijzig je dit ná de installatie, dan moet je ook de bestaande data verplaatsen.
-# Doe dat via Instellingen → Paden; die knop kopieert eerst, controleert, en
-# ruimt het oude pas daarna op. Alleen deze regel aanpassen laat je data staan
-# waar hij stond.
+# Waar de stacks, appdata en backups komen te staan. Dit pad wordt in de
+# container op hetzelfde pad gemount, zodat compose-bestanden kloppen.
 #BASE_DIR=/opt/serverup

-# Onder welk account Server Up draait. install.sh vult dit in; 0 (of leeg) is
-# root, zoals vóór v0.7.93. De container start altijd als root — dat moet, want
-# het docker-volume is van root — en zakt daarna af naar deze uid/gid.
-#
-# Loop je ergens tegenaan, zet ze dan allebei op 0 en draai `docker compose up -d`.
-# Zie docs/beveiliging.md voor wat dit wel en niet oplevert.
-#SU_UID=0
-#SU_GID=0
-
 # Zet op 1 zodra alles via HTTPS loopt: de sessiecookie krijgt dan de
 # Secure-vlag.
 #SU_HTTPS=1
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@ -40,7 +40,6 @@ jobs:
          if [ -z "$VERSION" ]; then
            VERSION="$(tr -d '[:space:]' < VERSION)"
          fi
-          VERSION="${VERSION#v}"
          IMAGE="${{ vars.REGISTRY }}/${{ vars.OWNER }}/server-up"
          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
          echo "IMAGE=${IMAGE}"     >> "$GITHUB_ENV"
@ -70,54 +69,6 @@ jobs:
            sh -c "pip install -q -r server-up/requirements.txt pytest \
                   && python -m pytest tests -q -p no:cacheprovider"

-      - name: Compose-bestanden valideren
-        run: |
-          set -euo pipefail
-          # De testsuite controleert of de sjablonen geldige YAML opleveren.
-          # Of `docker compose` ze ook accepteert is een andere vraag: een
-          # depends_on in de verkeerde vorm of network_mode naast networks is
-          # prima YAML en een kapotte stack. Dat merk je anders pas als iemand
-          # de app installeert.
-          #
-          # Renderen kan alleen waar Python staat (in de container), valideren
-          # alleen waar Docker staat (op de runner). Vandaar twee helften.
-          docker run --rm \
-            -v "$PWD:/w" -w /w \
-            -v su-pip-cache:/root/.cache/pip \
-            -e PYTHONDONTWRITEBYTECODE=1 \
-            python:3.12-slim \
-            sh -c "pip install -q -r server-up/requirements.txt \
-                   && python tools/render_voor_validatie.py .compose-check \
-                   && chown -R $(id -u):$(id -g) .compose-check"
-          fouten=0
-          for f in .compose-check/*/docker-compose.yml; do
-            if ! uitvoer=$(docker compose -f "$f" config -q 2>&1); then
-              echo "✖ $(basename "$(dirname "$f")")"
-              echo "$uitvoer" | sed 's/^/    /'
-              fouten=$((fouten + 1))
-            fi
-          done
-          rm -rf .compose-check
-          if [ "$fouten" -ne 0 ]; then
-            echo "$fouten sjablo(o)n(en) leveren een compose-bestand op dat docker weigert"
-            exit 1
-          fi
-          echo "Alle compose-bestanden zijn geldig"
-
-      - name: Images controleren
-        run: |
-          set -euo pipefail
-          # Een image dat niet meer bestaat merk je anders pas als iemand op
-          # installeren drukt. Zo verdween Huntarr nadat dat project offline
-          # ging, en wezen Forgejo, Planka en Baby Buddy naar tags die er niet
-          # zijn. Draait bewust rustig: registries knijpen af, en een afgeknepen
-          # verzoek is niet te onderscheiden van een ontbrekend image.
-          docker run --rm \
-            -v "$PWD:/w" -w /w \
-            -e PYTHONDONTWRITEBYTECODE=1 \
-            python:3.12-slim \
-            python tools/controleer_images.py
-
      - name: Inloggen op de registry
        run: |
          set -euo pipefail
@ -132,7 +83,6 @@ jobs:
            --pull \
            --build-arg "SU_VERSION=${VERSION}" \
            -t "${IMAGE}:${VERSION}" \
-            -t "${IMAGE}:v${VERSION}" \
            -t "${IMAGE}:${EXTRA_TAG}" \
            .

@ -140,11 +90,8 @@ jobs:
        run: |
          set -euo pipefail
          docker push "${IMAGE}:${VERSION}"
-          # Compatibiliteit met Server Up <= 0.8.12: die vroeg ten onrechte
-          # om de Forgejo-tag mét v. Nieuwe versies gebruiken de kale tag.
-          docker push "${IMAGE}:v${VERSION}"
          docker push "${IMAGE}:${EXTRA_TAG}"
-          echo "Gepusht: ${IMAGE}:${VERSION}, :v${VERSION} en :${EXTRA_TAG}"
+          echo "Gepusht: ${IMAGE}:${VERSION} en ${IMAGE}:${EXTRA_TAG}"

      - name: Uitloggen
        if: always()
--- a/.forgejo/workflows/deploy-prod.yml
+++ b/.forgejo/workflows/deploy-prod.yml
@ -57,54 +57,6 @@ jobs:
            sh -c "pip install -q -r server-up/requirements.txt pytest \
                   && python -m pytest tests -q -p no:cacheprovider"

-      - name: Compose-bestanden valideren
-        run: |
-          set -euo pipefail
-          # De testsuite controleert of de sjablonen geldige YAML opleveren.
-          # Of `docker compose` ze ook accepteert is een andere vraag: een
-          # depends_on in de verkeerde vorm of network_mode naast networks is
-          # prima YAML en een kapotte stack. Dat merk je anders pas als iemand
-          # de app installeert.
-          #
-          # Renderen kan alleen waar Python staat (in de container), valideren
-          # alleen waar Docker staat (op de runner). Vandaar twee helften.
-          docker run --rm \
-            -v "$PWD:/w" -w /w \
-            -v su-pip-cache:/root/.cache/pip \
-            -e PYTHONDONTWRITEBYTECODE=1 \
-            python:3.12-slim \
-            sh -c "pip install -q -r server-up/requirements.txt \
-                   && python tools/render_voor_validatie.py .compose-check \
-                   && chown -R $(id -u):$(id -g) .compose-check"
-          fouten=0
-          for f in .compose-check/*/docker-compose.yml; do
-            if ! uitvoer=$(docker compose -f "$f" config -q 2>&1); then
-              echo "✖ $(basename "$(dirname "$f")")"
-              echo "$uitvoer" | sed 's/^/    /'
-              fouten=$((fouten + 1))
-            fi
-          done
-          rm -rf .compose-check
-          if [ "$fouten" -ne 0 ]; then
-            echo "$fouten sjablo(o)n(en) leveren een compose-bestand op dat docker weigert"
-            exit 1
-          fi
-          echo "Alle compose-bestanden zijn geldig"
-
-      - name: Images controleren
-        run: |
-          set -euo pipefail
-          # Een image dat niet meer bestaat merk je anders pas als iemand op
-          # installeren drukt. Zo verdween Huntarr nadat dat project offline
-          # ging, en wezen Forgejo, Planka en Baby Buddy naar tags die er niet
-          # zijn. Draait bewust rustig: registries knijpen af, en een afgeknepen
-          # verzoek is niet te onderscheiden van een ontbrekend image.
-          docker run --rm \
-            -v "$PWD:/w" -w /w \
-            -e PYTHONDONTWRITEBYTECODE=1 \
-            python:3.12-slim \
-            python tools/controleer_images.py
-
      - name: Sync code naar deploy-directory
        run: |
          set -euo pipefail
@ -146,8 +98,8 @@ jobs:

          if [ -w .env ] || { [ ! -e .env ] && [ -w . ]; }; then
            touch .env
-            sed -i '/^SU_TAG=/d; /^SU_VERSION=/d' .env
-            printf 'SU_TAG=%s\nSU_VERSION=%s\n' "${VERSION}" "${VERSION}" >> .env
+            sed -i '/^SU_TAG=/d' .env
+            echo "SU_TAG=${VERSION}" >> .env
            echo "Inhoud van $(pwd)/.env:"
            grep -vE '^\s*(#|$)' .env | sed 's/^/  /'
          else
@ -172,11 +124,6 @@ jobs:
              | docker login "${{ vars.REGISTRY }}" -u "${{ vars.OWNER }}" --password-stdin
            docker tag "${SU_IMAGE}:${VERSION}" "${SU_IMAGE}:${CHANNEL}" || true
            docker push "${SU_IMAGE}:${VERSION}"
-            # Compatibiliteit met Server Up <= 0.8.12: de oude updater vroeg
-            # om de Forgejo-tag mét v. Hiermee kan die zichzelf één keer naar
-            # de gerepareerde updater brengen; nieuwe versies gebruiken de kale tag.
-            docker tag "${SU_IMAGE}:${VERSION}" "${SU_IMAGE}:v${VERSION}"
-            docker push "${SU_IMAGE}:v${VERSION}"
            # Pre-releases krijgen geen 'latest': dat hoort bij stable.
            case "$VERSION" in
              *-*) docker tag "${SU_IMAGE}:${VERSION}" "${SU_IMAGE}:beta"
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@ -57,61 +57,6 @@ jobs:
            sh -c "pip install -q -r server-up/requirements.txt pytest \
                   && python -m pytest tests -q -p no:cacheprovider"

-      - name: Compose-bestanden valideren
-        run: |
-          set -euo pipefail
-          # De testsuite controleert of de sjablonen geldige YAML opleveren.
-          # Of `docker compose` ze ook accepteert is een andere vraag: een
-          # depends_on in de verkeerde vorm of network_mode naast networks is
-          # prima YAML en een kapotte stack. Dat merk je anders pas als iemand
-          # de app installeert.
-          #
-          # Renderen kan alleen waar Python staat (in de container), valideren
-          # alleen waar Docker staat (op de runner). Vandaar twee helften.
-          docker run --rm \
-            -v "$PWD:/w" -w /w \
-            -v su-pip-cache:/root/.cache/pip \
-            -e PYTHONDONTWRITEBYTECODE=1 \
-            python:3.12-slim \
-            sh -c "pip install -q -r server-up/requirements.txt \
-                   && python tools/render_voor_validatie.py .compose-check \
-                   && chown -R $(id -u):$(id -g) .compose-check"
-          fouten=0
-          for f in .compose-check/*/docker-compose.yml; do
-            if ! uitvoer=$(docker compose -f "$f" config -q 2>&1); then
-              echo "✖ $(basename "$(dirname "$f")")"
-              echo "$uitvoer" | sed 's/^/    /'
-              fouten=$((fouten + 1))
-            fi
-          done
-          rm -rf .compose-check
-          if [ "$fouten" -ne 0 ]; then
-            echo "$fouten sjablo(o)n(en) leveren een compose-bestand op dat docker weigert"
-            exit 1
-          fi
-          echo "Alle compose-bestanden zijn geldig"
-
-      - name: Images controleren
-        run: |
-          set -euo pipefail
-          # Een image dat niet meer bestaat merk je anders pas als iemand op
-          # installeren drukt. Zo verdween Huntarr nadat dat project offline
-          # ging, en wezen Forgejo, Planka en Baby Buddy naar tags die er niet
-          # zijn. Draait bewust rustig: registries knijpen af, en een afgeknepen
-          # verzoek is niet te onderscheiden van een ontbrekend image.
-          #
-          # Geslaagde controles blijven een week staan in su-image-cache, met
-          # spreiding zodat niet alles op dezelfde dag verloopt. Een sjabloon
-          # dat naar een andere tag gaat wijzen levert een nieuwe sleutel op en
-          # wordt dus altijd gecontroleerd; mislukkingen komen nooit in de cache.
-          docker run --rm \
-            -v "$PWD:/w" -w /w \
-            -v su-image-cache:/cache \
-            -e PYTHONDONTWRITEBYTECODE=1 \
-            -e SU_IMAGE_CACHE=/cache/images.json \
-            python:3.12-slim \
-            python tools/controleer_images.py
-
      - name: Sync code naar deploy-directory
        run: |
          set -euo pipefail
@ -149,8 +94,8 @@ jobs:

          if [ -w .env ] || { [ ! -e .env ] && [ -w . ]; }; then
            touch .env
-            sed -i '/^SU_TAG=/d; /^SU_VERSION=/d' .env
-            printf 'SU_TAG=%s\nSU_VERSION=%s\n' "${VERSION}" "${VERSION}" >> .env
+            sed -i '/^SU_TAG=/d' .env
+            echo "SU_TAG=${VERSION}" >> .env
            echo "Inhoud van $(pwd)/.env:"
            grep -vE '^\s*(#|$)' .env | sed 's/^/  /'
          else
@ -169,49 +114,6 @@ jobs:
          docker compose build --pull
          docker tag "server-up:${VERSION}" "server-up:${CHANNEL}" || true

-      # Server Up draait niet meer als root. Dat hangt aan het entrypoint en aan
-      # `setpriv`, en beide zijn alleen in een echte container te toetsen — de
-      # pytest-suite kan er niet bij. Zonder deze stap merk je een regressie hier
-      # pas als iemands installatie niet meer opkomt.
-      - name: Niet-root modus controleren
-        run: |
-          set -euo pipefail
-          IMG="server-up:${VERSION}"
-
-          echo "1. setpriv aanwezig in het image"
-          docker run --rm --entrypoint setpriv "$IMG" --help >/dev/null
-          echo "   ok"
-
-          echo "2. zakt af naar de opgegeven gebruiker"
-          uit=$(docker run --rm -e SU_UID=1000 -e SU_GID=1000 \
-                  -v /var/run/docker.sock:/var/run/docker.sock "$IMG" id)
-          echo "   $uit"
-          case "$uit" in
-            uid=1000*) ;;
-            *) echo "FOUT: draait niet als uid 1000"; exit 1 ;;
-          esac
-
-          echo "3. zit in de groep van de docker-socket"
-          sok_gid=$(stat -c %g /var/run/docker.sock)
-          case "$uit" in
-            *"$sok_gid"*) echo "   gid $sok_gid aanwezig" ;;
-            *) echo "FOUT: gid $sok_gid van de socket ontbreekt"; exit 1 ;;
-          esac
-
-          echo "4. kan schrijven in /data"
-          docker run --rm -e SU_UID=1000 -e SU_GID=1000 \
-            -v "su-nietroot-proef-${VERSION}:/data" "$IMG" \
-            sh -c 'touch /data/proef && echo "   ok"'
-          docker volume rm "su-nietroot-proef-${VERSION}" >/dev/null
-
-          echo "5. zonder SU_UID blijft het root — de ontsnappingsklep"
-          uit0=$(docker run --rm "$IMG" id)
-          echo "   $uit0"
-          case "$uit0" in
-            uid=0*) ;;
-            *) echo "FOUT: SU_UID=0 hoort root te blijven"; exit 1 ;;
-          esac
-
      - name: Deploy
        run: |
          set -euo pipefail
@ -243,62 +145,6 @@ jobs:
          cd "$DEPLOY_DIR" && docker compose logs --tail=200
          exit 1

-      # De backuptests vervangen Docker allemaal door een nepversie. Dat toetst
-      # de logica maar niet de keten: pg_dump via `docker exec`, het archief,
-      # het terugzetten, en of de database daarna nog schrijft. Juist daar
-      # betekent fout zijn gegevensverlies.
-      #
-      # Draait op het zojuist gebouwde image — dus met exact de Python en de
-      # docker-CLI van productie. De werkmap wordt op hetzelfde pad gemount,
-      # want de bind mount van de postgres-container wordt door de daemon op de
-      # host opgezocht, niet in deze container.
-      - name: Backup en terugzetten met echte Docker
-        run: |
-          set -uo pipefail
-          PROEF="$DEPLOY_DIR/.backup-rondgang"
-          rm -rf "$PROEF"; mkdir -p "$PROEF"
-          docker run --rm \
-            -v /var/run/docker.sock:/var/run/docker.sock \
-            -v "$PROEF:$PROEF" \
-            -v "$PWD:/w" -w /w \
-            -e PYTHONDONTWRITEBYTECODE=1 \
-            "server-up:${VERSION}" \
-            python tools/backup_rondgang.py "$PROEF"
-          code=$?
-          # De exitcode expliciet tonen. Een run die "Rondgang geslaagd" op het
-          # scherm zette en tóch rood werd, liet nergens zien waar dat vandaan
-          # kwam — en zonder dit getal is dat niet te achterhalen.
-          echo "rondgang exitcode: $code"
-          rm -rf "$PROEF" || true
-          [ "$code" -eq 0 ] || exit 1
-
-      # `--doctor` is ruim honderd regels shell die alleen tegen een échte
-      # installatie draaien. De pytest-suite komt niet verder dan "er is geen
-      # Docker"; hier wel.
-      - name: install.sh --doctor doorlichten
-        if: success()
-        run: |
-          set -uo pipefail
-          uit="$(sh "$DEPLOY_DIR/install.sh" --doctor --dir "$DEPLOY_DIR" 2>&1)"
-          code=$?
-          printf '%s\n' "$uit"
-
-          # Alle secties moeten gedraaid hebben: een shell-fout halverwege zou
-          # anders als "niets aan de hand" langskomen.
-          for kop in "Installatie" "Docker" "Container" "Bereikbaarheid" \
-                     "Account" "Mappen" "Bijwerken vanuit de interface"; do
-            printf '%s\n' "$uit" | grep -q "^$kop$" || {
-              echo "FOUT: --doctor kwam niet tot de sectie '$kop'"; exit 1; }
-          done
-
-          # En de uitslag telt mee. Waarschuwingen mogen (deze deploy draait
-          # bewust nog als root), fouten niet.
-          if [ "$code" -ne 0 ]; then
-            echo "FOUT: --doctor meldt problemen met de deploy"
-            exit 1
-          fi
-          echo "--doctor liep van begin tot eind, zonder fouten"
-
      - name: Oude images opruimen (behoud laatste 5)
        if: success()
        run: |
--- a/.gitignore
+++ b/.gitignore
@ -4,6 +4,3 @@ __pycache__/
 .env
 .pytest_cache/
 venv/
-node_modules/
-.compose-check/
-venv/
--- a/AGENTS.md
+++ b/AGENTS.md
@ -1,11 +0,0 @@
-# Projectafspraken
- Werk nooit rechtstreeks op main
- Push naar de dev branch
- Werk met versienummering (v0.0.00)
- In de dev-branch altijd beta weergeven bij de versienummering
- Beschrijf gewijzigde functionaliteiten puntsgewijs in de pull request.
- Gebruik geen sudo
- Commit geen wachtwoorden, tokens, `.env`-bestanden of privésleutels.
- Voer relevante tests uit voor iedere commit.
- Push wijzigingen naar Forgejo, maar merge niet zelfstandig.
- Bij opdracht "Release versie" maak een versie releaseversie
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
--- a/CLAUDE.md
+++ b/CLAUDE.md
@ -1,13 +0,0 @@
-# Projectafspraken
- Werk nooit rechtstreeks op main
- Push naar de dev branch
- Werk met versienummering (v0.0.00)
- Verhoog per uitgave met 0.0.01, dus 0.7.95 → 0.7.96. Geen sprongen van tien,
-  en de middelste positie blijft één cijfer: na 0.7.99 komt 0.8.00.
- In de dev-branch altijd beta weergeven bij de versienummering
- Beschrijf gewijzigde functionaliteiten puntsgewijs in de pull request.
- Gebruik geen sudo
- Commit geen wachtwoorden, tokens, `.env`-bestanden of privésleutels.
- Voer relevante tests uit voor iedere commit.
- Push wijzigingen naar Forgejo, maar merge niet zelfstandig.
- Bij opdracht "Release versie" maak een versie releaseversie
--- a/62
+++ b/62
@ -4,24 +4,16 @@ COPY server-up/requirements.txt .
 RUN pip install --no-cache-dir --prefix=/inst -r requirements.txt

 FROM python:3.12-slim
-# De volgorde hieronder is met opzet: alles wat zelden verandert staat boven,
-# alles wat bij elke commit verandert onderaan. Docker hergebruikt een laag
-# alleen zolang niets ervóór is gewijzigd, dus één regel op de verkeerde plek
-# kost bij elke build opnieuw de hele rit.
-#
-# Wat hier eerder misging: `ARG SU_VERSION` met een LABEL erachter stond
-# bovenaan. Die waarde verandert per release, dus elke uitgave gooide álle
-# lagen erna weg — apt-get, de Docker-CLI van 70 MB, de front-end-bestanden,
-# alles. Vandaar dat versie en label nu helemaal onderaan staan.
-
-# util-linux levert `setpriv`, waarmee het entrypoint naar een gewone gebruiker
-# afzakt zonder de capabilities te verliezen die Server Up nodig heeft. Het is
-# een Essential-pakket en dus al aanwezig, maar expliciet noemen zorgt dat een
-# uitgeklede basis-image het niet stilletjes wegbezuinigt.
+# Build-arg: zet bij build naar de git-tag, zodat de image z'n eigen versie kent.
+#   docker build --build-arg SU_VERSION=$(git describe --tags --always) ...
+# Forgejo Actions doet dit automatisch (zie server-up-deploy/README.md).
+ARG SU_VERSION=dev
+LABEL org.opencontainers.image.title="Server Up" \
+      org.opencontainers.image.version="${SU_VERSION}" \
+      org.opencontainers.image.source="https://git.example.com/bes-r/server-up"
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    git openssh-client curl tar gzip ca-certificates util-linux passwd \
-    && rm -rf /var/lib/apt/lists/* \
-    && setpriv --help >/dev/null
+    git openssh-client curl tar gzip ca-certificates \
+    && rm -rf /var/lib/apt/lists/*

 # Install Docker CLI + docker-compose inside container
 RUN DPKG_ARCH=$(dpkg --print-architecture) \
@ -43,11 +35,9 @@ RUN DPKG_ARCH=$(dpkg --print-architecture) \

 COPY --from=build /inst /usr/local
 WORKDIR /app
-
-# De front-end-bestanden staan vóór de broncode: hun versies staan hier vast,
-# dus deze lagen blijven staan zolang je ze niet zelf wijzigt. Stonden ze erna,
-# dan haalde elke commit ze opnieuw van het CDN én werden ze bij elke push
-# opnieuw geüpload.
+COPY server-up/ ./
+COPY modules/ ./modules-bundled/
+COPY VERSION ./VERSION
 RUN mkdir -p static/fonts \
 && curl -fsSL "https://cdn.jsdelivr.net/npm/@mdi/font@7.4.47/css/materialdesignicons.min.css" -o static/fonts/mdi.min.css \
 && curl -fsSL "https://cdn.jsdelivr.net/npm/@mdi/font@7.4.47/fonts/materialdesignicons-webfont.woff2" -o static/fonts/materialdesignicons-webfont.woff2 \
@ -75,34 +65,10 @@ RUN mkdir -p /data/stacks /data/appdata /data/backups /data/git modules /root \
 # eerste verbinding en bewaart de sleutel in /data/known_hosts. Wijzigt die
 # sleutel later, dan faalt de verbinding — met `no` was elke MITM onzichtbaar.
 ENV PYTHONUNBUFFERED=1 PORT=5000 HOME=/root \
+    SU_VERSION=${SU_VERSION} \
    SU_CONFIG=/data/config.json SU_AUDIT=/data/audit.db SU_GIT_CACHE=/data/git \
-    SU_SECRET=/data/secret.key SU_JOBS=/data/jobs \
+    SU_SECRET=/data/secret.key \
    GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/data/known_hosts"
-COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
-RUN chmod +x /usr/local/bin/docker-entrypoint.sh
-
 EXPOSE 5000
 HEALTHCHECK --interval=30s --timeout=8s --start-period=15s CMD curl -fs http://localhost:5000/healthz || exit 1
-# Het entrypoint start als root, zet /data klaar en zakt daarna af naar
-# SU_UID:SU_GID. Zonder die variabelen verandert er niets: dan blijft het root.
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 CMD ["python","app.py"]
-
-# ── Vanaf hier verandert er iets bij elke commit ─────────────────────────────
-# Alles hierboven blijft in de cache staan; alleen deze laatste lagen worden
-# opnieuw gebouwd. Daardoor duurt een release een halve minuut in plaats van
-# een kwartier, en hoeft de push alleen deze lagen te uploaden.
-COPY server-up/ ./
-COPY modules/ ./modules-bundled/
-COPY VERSION ./VERSION
-
-# Build-arg: zet bij build naar de git-tag, zodat de image z'n eigen versie kent.
-#   docker build --build-arg SU_VERSION=$(git describe --tags --always) ...
-# Forgejo Actions doet dit automatisch (zie server-up-deploy/README.md).
-# Helemaal onderaan, want deze waarde verandert per uitgave en zou alles
-# eronder ongeldig maken.
-ARG SU_VERSION=dev
-ENV SU_VERSION=${SU_VERSION}
-LABEL org.opencontainers.image.title="Server Up" \
-      org.opencontainers.image.version="${SU_VERSION}" \
-      org.opencontainers.image.source="https://git.example.com/bes-r/server-up"
--- a/README.md
+++ b/README.md
@ -16,7 +16,7 @@ IP-adres in je netwerk geven.

 | | |
 |---|---|
-| **App-catalogus** | 286 kant-en-klare apps, ingedeeld in categorieën met kleur. Zoeken, filteren en installeren met een formulier in plaats van YAML. |
+| **App-catalogus** | 96 kant-en-klare apps, ingedeeld in categorieën met kleur. Zoeken, filteren en installeren met een formulier in plaats van YAML. |
 | **Stacks beheren** | Starten, stoppen, bijwerken en herstarten — per stack of per losse container, met logs en live CPU-/geheugengebruik. |
 | **Apps koppelen** | Stacks komen op een gedeeld netwerk, zodat ze elkaar op naam bereiken. Een veld dat naar een andere app verwijst toont een keuzelijst met wat je al draait. |
 | **Eigen IP per stack** | Met macvlan of ipvlan krijgt een app een eigen adres in je LAN in plaats van poorten op de host. |
--- a/2
+++ b/2
@ -1 +1 @@
-0.8.31
+0.7.40-beta
--- a/apps/2fauth/files/compose.yaml
+++ b/apps/2fauth/files/compose.yaml
@ -1,15 +0,0 @@
-services:
-  << service_name >>:
-    image: 2fauth/2fauth:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-      - APP_KEY=<< app_key >>
-      - APP_URL=<< app_url >>
-      - IS_DEMO_APP=false
-      - TRUSTED_PROXIES=*
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/2fauth
-    ports:
-      - "<< port >>:8000"
-    restart: unless-stopped
--- a/apps/2fauth/template.json
+++ b/apps/2fauth/template.json
@ -1,88 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "2FAuth",
-    "description": "Bewaart je tweestapscodes op je eigen server, zodat je ze niet kwijt bent met je telefoon. Naast Vaultwarden, niet erin — dan liggen wachtwoord en code niet op dezelfde plek.",
-    "tags": [
-      "2fa",
-      "totp",
-      "beveiliging"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "2fauth"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "beveiliging"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "2fauth",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 8230,
-          "required": true,
-          "description": "Standaard 8000; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Instellingen",
-      "items": [
-        {
-          "name": "app_url",
-          "type": "str",
-          "title": "Publiek adres",
-          "default": "http://localhost:8230",
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Toegang",
-      "items": [
-        {
-          "name": "app_key",
-          "type": "str",
-          "title": "Applicatiesleutel",
-          "default": "",
-          "required": true,
-          "secret": true,
-          "generate": "auto",
-          "secret_format": "laravel",
-          "secret_bytes": 32,
-          "description": "Laravel-formaat; wordt automatisch in de juiste vorm gemaakt"
-        }
-      ]
-    }
-  ]
-}
--- a/apps/activepieces/files/compose.yaml
+++ b/apps/activepieces/files/compose.yaml
@ -1,13 +0,0 @@
-services:
-  << service_name >>:
-    image: activepieces/activepieces:latest
-    container_name: << service_name >>
-    ports:
-      - "<< port >>:80"
-    environment:
-      - AP_REDIS_TYPE=MEMORY
-      - AP_DB_TYPE=PGLITE
-      - AP_FRONTEND_URL=<< frontend_url >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/root/.activepieces
-    restart: unless-stopped
--- a/apps/activepieces/template.json
+++ b/apps/activepieces/template.json
@ -1,24 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Activepieces",
-    "description": "Visuele workflow-automatisering als toegankelijk alternatief voor n8n. Deze lichte één-containeropzet gebruikt PGLite en een geheugenqueue en is bedoeld voor persoonlijk gebruik op één server.",
-    "tags": ["automatisering", "workflows", "integraties", "no-code"],
-    "icon": {"provider": "selfhst", "id": "activepieces"},
-    "version": {"name": "latest"},
-    "categories": ["productiviteit", "ontwikkeling"],
-    "architectures": ["amd64", "arm64"],
-    "architecture_note": "De officiële Activepieces-image ondersteunt AMD64 en ARM64."
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {"name": "service_name", "type": "str", "title": "Servicenaam", "default": "activepieces", "required": true},
-        {"name": "port", "type": "int", "title": "Webinterface", "default": 14003, "required": true},
-        {"name": "appdata_dir", "type": "str", "title": "Appdata-map", "default": "/opt/serverup/appdata", "required": true},
-        {"name": "frontend_url", "type": "str", "title": "Publiek adres", "default": "http://localhost:14003", "required": true, "description": "Gebruik voor webhooks het HTTPS-adres van je reverse proxy."}
-      ]
-    }
-  ]
-}
--- a/apps/actual-budget/files/compose.yaml
+++ b/apps/actual-budget/files/compose.yaml
@ -5,5 +5,5 @@ services:
    ports:
      - "<< port >>:5006"
    volumes:
-      - << appdata_dir >>/<< service_name >>/data:/data
+      - << data_dir >>/<< service_name >>/data:/data
    restart: unless-stopped
--- a/apps/actual-budget/template.json
+++ b/apps/actual-budget/template.json
@ -39,9 +39,9 @@
          "required": true
        },
        {
-          "name": "appdata_dir",
+          "name": "data_dir",
          "type": "str",
-          "title": "Appdata-map",
+          "title": "Data directory",
          "default": "/opt/serverup/appdata",
          "required": true
        }
--- a/apps/adguard-home/files/compose.yaml
+++ b/apps/adguard-home/files/compose.yaml
@ -7,6 +7,6 @@ services:
      - "<< port_dns >>:53/tcp"
      - "<< port_dns >>:53/udp"
    volumes:
-      - << appdata_dir >>/<< service_name >>/work:/opt/adguardhome/work
-      - << appdata_dir >>/<< service_name >>/conf:/opt/adguardhome/conf
+      - << data_dir >>/<< service_name >>/work:/opt/adguardhome/work
+      - << data_dir >>/<< service_name >>/conf:/opt/adguardhome/conf
    restart: unless-stopped
--- a/apps/adguard-home/template.json
+++ b/apps/adguard-home/template.json
@ -33,9 +33,9 @@
          "required": true
        },
        {
-          "name": "appdata_dir",
+          "name": "data_dir",
          "type": "str",
-          "title": "Appdata-map",
+          "title": "Data directory",
          "default": "/opt/serverup/appdata",
          "required": true
        }
--- a/apps/adminer/files/compose.yaml
+++ b/apps/adminer/files/compose.yaml
@ -1,9 +0,0 @@
-services:
-  << service_name >>:
-    image: adminer:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-    ports:
-      - "<< port >>:8080"
-    restart: unless-stopped
--- a/apps/adminer/template.json
+++ b/apps/adminer/template.json
@ -1,51 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Adminer",
-    "description": "Databasebeheer in één bestand: MySQL, PostgreSQL, SQLite en meer, zonder installatie per database. Let op: Adminer geeft volledige toegang tot elke database die hij kan bereiken. Zet hem niet zomaar op internet.",
-    "tags": [
-      "database",
-      "beheer",
-      "ontwikkeling"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "adminer"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "ontwikkeling"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "adminer",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 8160,
-          "required": true,
-          "description": "Standaard 8080; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    }
-  ]
-}
--- a/apps/alertmanager/files/alertmanager.yml
+++ b/apps/alertmanager/files/alertmanager.yml
@ -1,13 +0,0 @@
-# Startconfiguratie. Zonder dit bestand weigert Alertmanager te starten.
-route:
-  receiver: standaard
-  group_by: [alertname]
-  group_wait: 30s
-  repeat_interval: 4h
-
-receivers:
-  - name: standaard
-<%- if webhook_url %>
-    webhook_configs:
-      - url: "<< webhook_url >>"
-<%- endif %>
--- a/apps/alertmanager/files/compose.yaml
+++ b/apps/alertmanager/files/compose.yaml
@ -1,13 +0,0 @@
-services:
-  << service_name >>:
-    image: quay.io/prometheus/alertmanager:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/etc/alertmanager
-      - ./alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
-    command: --config.file=/etc/alertmanager/alertmanager.yml --storage.path=/alertmanager
-    ports:
-      - "<< port >>:9093"
-    restart: unless-stopped
--- a/apps/alertmanager/template.json
+++ b/apps/alertmanager/template.json
@ -1,83 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Alertmanager",
-    "description": "Neemt de alarmen van Prometheus aan, bundelt ze en stuurt ze door naar e-mail, ntfy of Discord. Onderdrukt herhalingen.",
-    "tags": [
-      "monitoring",
-      "meldingen",
-      "prometheus"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "prometheus"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "monitoring",
-      "communicatie"
-    ],
-    "depends_on": [
-      {
-        "app": "prometheus",
-        "reason": "Alertmanager verwerkt de alarmen die Prometheus opwerpt; los draaiend krijgt hij er nooit een."
-      }
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "alertmanager",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 9093,
-          "required": true
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Instellingen",
-      "items": [
-        {
-          "name": "webhook_url",
-          "type": "str",
-          "title": "Webhook",
-          "default": "",
-          "required": false,
-          "connect": {
-            "app": "ntfy",
-            "scheme": "http",
-            "port": 80
-          },
-          "help": "Waar de alarmen naartoe gaan. Wijs dit naar ntfy of Gotify, of laat het leeg en stel het later in het bestand in."
-        }
-      ]
-    }
-  ]
-}
--- a/apps/alloy/files/compose.yaml
+++ b/apps/alloy/files/compose.yaml
@ -1,14 +0,0 @@
-services:
-  << service_name >>:
-    image: grafana/alloy:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/var/lib/alloy/data
-      - ./config.alloy:/etc/alloy/config.alloy:ro
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    command: run --server.http.listen-addr=0.0.0.0:12345 --storage.path=/var/lib/alloy/data /etc/alloy/config.alloy
-    ports:
-      - "<< port >>:12345"
-    restart: unless-stopped
--- a/apps/alloy/files/config.alloy
+++ b/apps/alloy/files/config.alloy
@ -1,16 +0,0 @@
-// Leest de logs van elke draaiende container en stuurt ze naar Loki.
-discovery.docker "containers" {
-  host = "unix:///var/run/docker.sock"
-}
-
-loki.source.docker "containers" {
-  host       = "unix:///var/run/docker.sock"
-  targets    = discovery.docker.containers.targets
-  forward_to = [loki.write.opslag.receiver]
-}
-
-loki.write "opslag" {
-  endpoint {
-    url = "<< loki_url >>/loki/api/v1/push"
-  }
-}
--- a/apps/alloy/template.json
+++ b/apps/alloy/template.json
@ -1,82 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Grafana Alloy",
-    "description": "Verzamelt de logs van je containers en stuurt ze naar Loki. De opvolger van Promtail.",
-    "tags": [
-      "logs",
-      "monitoring",
-      "grafana"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "grafana"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "monitoring"
-    ],
-    "depends_on": [
-      {
-        "app": "loki",
-        "reason": "Alloy verzamelt logs en stuurt ze door. Zonder Loki om ze te bewaren gaan ze meteen weer verloren."
-      }
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "alloy",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 12345,
-          "required": true
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Instellingen",
-      "items": [
-        {
-          "name": "loki_url",
-          "type": "str",
-          "title": "Adres van Loki",
-          "default": "http://loki:3100",
-          "required": true,
-          "connect": {
-            "app": "loki",
-            "scheme": "http",
-            "port": 3100
-          },
-          "help": "Waar Alloy de logs naartoe stuurt. Draaien ze op hetzelfde gedeelde netwerk, dan is de containernaam genoeg."
-        }
-      ]
-    }
-  ]
-}
--- a/apps/anythingllm/files/compose.yaml
+++ b/apps/anythingllm/files/compose.yaml
@ -1,14 +0,0 @@
-services:
-  << service_name >>:
-    image: mintplexlabs/anythingllm:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-      - STORAGE_DIR=/app/server/storage
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/app/server/storage
-    ports:
-      - "<< port >>:3001"
-    cap_add:
-      - SYS_ADMIN
-    restart: unless-stopped
--- a/apps/anythingllm/template.json
+++ b/apps/anythingllm/template.json
@ -1,61 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "AnythingLLM",
-    "description": "Praat met je eigen documenten: laadt bestanden in een vectordatabase en gebruikt die als context. Werkt met Ollama.",
-    "tags": [
-      "ai",
-      "llm",
-      "rag",
-      "documenten"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "anythingllm"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "ai",
-      "documenten"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "anythingllm",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 8142,
-          "required": true,
-          "description": "Standaard 3001; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    }
-  ]
-}
--- a/apps/appdaemon/files/compose.yaml
+++ b/apps/appdaemon/files/compose.yaml
@ -1,14 +0,0 @@
-services:
-  << service_name >>:
-    image: acockburn/appdaemon:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-      - HA_URL=<< ha_url >>
-      - TOKEN=<< ha_token >>
-      - DASH_URL=<< dash_url >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/conf
-    ports:
-      - "<< port >>:5050"
-    restart: unless-stopped
--- a/apps/appdaemon/template.json
+++ b/apps/appdaemon/template.json
@ -1,106 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "AppDaemon",
-    "description": "Automatiseringen voor Home Assistant in Python in plaats van YAML. Voor logica die met de ingebouwde automatiseringen onhandig wordt.",
-    "tags": [
-      "domotica",
-      "automatisering",
-      "python"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "appdaemon"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "domotica",
-      "ontwikkeling"
-    ],
-    "depends_on": [
-      {
-        "app": "home-assistant",
-        "reason": "Dit is een dienst die Home Assistant aanroept; los draaiend doet hij niets."
-      }
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "appdaemon",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 5050,
-          "required": true
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Instellingen",
-      "items": [
-        {
-          "name": "ha_url",
-          "type": "str",
-          "title": "Adres van Home Assistant",
-          "default": "http://homeassistant:8123",
-          "required": true,
-          "connect": {
-            "app": "home-assistant",
-            "scheme": "http",
-            "port": 8123
-          },
-          "help": "Waar AppDaemon Home Assistant bereikt."
-        },
-        {
-          "name": "dash_url",
-          "type": "str",
-          "title": "Eigen adres",
-          "default": "http://localhost:5050",
-          "required": true,
-          "description": "Waar het dashboard van AppDaemon zelf op staat"
-        }
-      ]
-    },
-    {
-      "title": "Toegang",
-      "items": [
-        {
-          "name": "ha_token",
-          "type": "str",
-          "title": "Toegangstoken van Home Assistant",
-          "default": "",
-          "required": true,
-          "secret": true,
-          "eigen_invoer": true,
-          "description": "Maak er een aan onder je profiel in Home Assistant"
-        }
-      ]
-    }
-  ]
-}
--- a/apps/apprise/files/compose.yaml
+++ b/apps/apprise/files/compose.yaml
@ -1,13 +0,0 @@
-services:
-  << service_name >>:
-    image: caronc/apprise:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-      - APPRISE_STATEFUL_MODE=simple
-      - APPRISE_WORKER_COUNT=1
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/config
-    ports:
-      - "<< port >>:8000"
-    restart: unless-stopped
--- a/apps/apprise/template.json
+++ b/apps/apprise/template.json
@ -1,59 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Apprise",
-    "description": "Eén API die je bericht doorstuurt naar honderd diensten: Discord, Telegram, ntfy, e-mail, Signal. Je apps hoeven maar één adres te kennen.",
-    "tags": [
-      "meldingen",
-      "api",
-      "notificaties"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "apprise"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "communicatie"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "apprise",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 8251,
-          "required": true,
-          "description": "Standaard 8000; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    }
-  ]
-}
--- a/apps/arr-stack/files/compose.yaml
+++ b/apps/arr-stack/files/compose.yaml
@ -1,63 +1,26 @@
 # ARR-stack — kies per onderdeel of je het wilt.
 #
-# Alles deelt één map, gekoppeld als /data. Dat is geen smaakkwestie:
-# staan je downloads en je bibliotheek op verschillende mounts, dan kan
-# Sonarr geen hardlink maken en kopieert elke voltooide download naar je
-# bibliotheek. Traag, en je hebt alles tijdelijk dubbel op de schijf.
-#
-#   /data/media/{films,series,muziek,boeken}   je bibliotheek
-#   /data/torrents/                            torrents (blijven seeden)
-#   /data/usenet/                              usenet-downloads
-#
-# Draai je met Gluetun, dan zitten de downloadclients in het netwerk van
-# die container en bereik je hun webinterface via de Gluetun-poorten.
+# Aandachtspunten:
+#  * Zet de download- en mediamap op hetzelfde bestandssysteem, anders kopieert
+#    elke voltooide download in plaats van te verplaatsen (traag, dubbele opslag).
+#  * Draai je met Gluetun, dan zitten de downloadclients in het netwerk van die
+#    container en bereik je hun webinterface via de Gluetun-poorten.
 services:

-<%- if enable_kapowarr %>
-  << service_name >>-kapowarr:
-    image: mrcas/kapowarr:latest
-    container_name: << service_name >>-kapowarr
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/kapowarr:/app/db
-      - << data_root >>:/data
-    ports:
-      - "<< port_kapowarr >>:5656"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_lidarr %>
-  << service_name >>-lidarr:
-    image: lscr.io/linuxserver/lidarr:latest
-    container_name: << service_name >>-lidarr
+<%- if enable_sonarr %>
+  << service_name >>-sonarr:
+    image: lscr.io/linuxserver/sonarr:latest
+    container_name: << service_name >>-sonarr
    environment:
      - PUID=<< puid >>
      - PGID=<< pgid >>
      - TZ=<< timezone >>
-      - UMASK=002
    volumes:
-      - << appdata_dir >>/<< service_name >>/lidarr:/config
-      - << data_root >>:/data
+      - << data_dir >>/<< service_name >>/sonarr:/config
+      - << media_dir >>/series:/tv
+      - << downloads_dir >>:/downloads
    ports:
-      - "<< port_lidarr >>:8686"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_mylar3 %>
-  << service_name >>-mylar3:
-    image: lscr.io/linuxserver/mylar3:latest
-    container_name: << service_name >>-mylar3
-    environment:
-      - PUID=<< puid >>
-      - PGID=<< pgid >>
-      - TZ=<< timezone >>
-      - UMASK=002
-    volumes:
-      - << appdata_dir >>/<< service_name >>/mylar3:/config
-      - << data_root >>:/data
-    ports:
-      - "<< port_mylar3 >>:8090"
+      - "<< port_sonarr >>:8989"
    restart: unless-stopped
 <%- endif %>

@ -69,15 +32,32 @@ services:
      - PUID=<< puid >>
      - PGID=<< pgid >>
      - TZ=<< timezone >>
-      - UMASK=002
    volumes:
-      - << appdata_dir >>/<< service_name >>/radarr:/config
-      - << data_root >>:/data
+      - << data_dir >>/<< service_name >>/radarr:/config
+      - << media_dir >>/films:/movies
+      - << downloads_dir >>:/downloads
    ports:
      - "<< port_radarr >>:7878"
    restart: unless-stopped
 <%- endif %>

+<%- if enable_lidarr %>
+  << service_name >>-lidarr:
+    image: lscr.io/linuxserver/lidarr:latest
+    container_name: << service_name >>-lidarr
+    environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
+      - TZ=<< timezone >>
+    volumes:
+      - << data_dir >>/<< service_name >>/lidarr:/config
+      - << media_dir >>/muziek:/music
+      - << downloads_dir >>:/downloads
+    ports:
+      - "<< port_lidarr >>:8686"
+    restart: unless-stopped
+<%- endif %>
+
 <%- if enable_readarr %>
  << service_name >>-readarr:
    image: lscr.io/linuxserver/readarr:develop
@ -86,32 +66,15 @@ services:
      - PUID=<< puid >>
      - PGID=<< pgid >>
      - TZ=<< timezone >>
-      - UMASK=002
    volumes:
-      - << appdata_dir >>/<< service_name >>/readarr:/config
-      - << data_root >>:/data
+      - << data_dir >>/<< service_name >>/readarr:/config
+      - << media_dir >>/boeken:/books
+      - << downloads_dir >>:/downloads
    ports:
      - "<< port_readarr >>:8787"
    restart: unless-stopped
 <%- endif %>

-<%- if enable_sonarr %>
-  << service_name >>-sonarr:
-    image: lscr.io/linuxserver/sonarr:latest
-    container_name: << service_name >>-sonarr
-    environment:
-      - PUID=<< puid >>
-      - PGID=<< pgid >>
-      - TZ=<< timezone >>
-      - UMASK=002
-    volumes:
-      - << appdata_dir >>/<< service_name >>/sonarr:/config
-      - << data_root >>:/data
-    ports:
-      - "<< port_sonarr >>:8989"
-    restart: unless-stopped
-<%- endif %>
-
 <%- if enable_whisparr %>
  << service_name >>-whisparr:
    image: ghcr.io/hotio/whisparr:latest
@ -120,74 +83,15 @@ services:
      - PUID=<< puid >>
      - PGID=<< pgid >>
      - TZ=<< timezone >>
-      - UMASK=002
    volumes:
-      - << appdata_dir >>/<< service_name >>/whisparr:/config
-      - << data_root >>:/data
+      - << data_dir >>/<< service_name >>/whisparr:/config
+      - << media_dir >>/volwassen:/adult
+      - << downloads_dir >>:/downloads
    ports:
      - "<< port_whisparr >>:6969"
    restart: unless-stopped
 <%- endif %>

-<%- if enable_byparr %>
-  << service_name >>-byparr:
-    image: ghcr.io/thephaseless/byparr:latest
-    container_name: << service_name >>-byparr
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/byparr:/config
-    ports:
-      - "<< port_byparr >>:8191"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_flaresolverr %>
-  << service_name >>-flaresolverr:
-    image: ghcr.io/flaresolverr/flaresolverr:latest
-    container_name: << service_name >>-flaresolverr
-    environment:
-      - TZ=<< timezone >>
-      - LOG_LEVEL=info
-    volumes:
-      - << appdata_dir >>/<< service_name >>/flaresolverr:/config
-    ports:
-      - "<< port_flaresolverr >>:8191"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_jackett %>
-  << service_name >>-jackett:
-    image: lscr.io/linuxserver/jackett:latest
-    container_name: << service_name >>-jackett
-    environment:
-      - PUID=<< puid >>
-      - PGID=<< pgid >>
-      - TZ=<< timezone >>
-      - UMASK=002
-    volumes:
-      - << appdata_dir >>/<< service_name >>/jackett:/config
-    ports:
-      - "<< port_jackett >>:9117"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_nzbhydra2 %>
-  << service_name >>-nzbhydra2:
-    image: lscr.io/linuxserver/nzbhydra2:latest
-    container_name: << service_name >>-nzbhydra2
-    environment:
-      - PUID=<< puid >>
-      - PGID=<< pgid >>
-      - TZ=<< timezone >>
-      - UMASK=002
-    volumes:
-      - << appdata_dir >>/<< service_name >>/nzbhydra2:/config
-    ports:
-      - "<< port_nzbhydra2 >>:5076"
-    restart: unless-stopped
-<%- endif %>
-
 <%- if enable_prowlarr %>
  << service_name >>-prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
@ -196,61 +100,88 @@ services:
      - PUID=<< puid >>
      - PGID=<< pgid >>
      - TZ=<< timezone >>
-      - UMASK=002
    volumes:
-      - << appdata_dir >>/<< service_name >>/prowlarr:/config
+      - << data_dir >>/<< service_name >>/prowlarr:/config
    ports:
      - "<< port_prowlarr >>:9696"
    restart: unless-stopped
 <%- endif %>

-<%- if enable_deluge %>
-  << service_name >>-deluge:
-    image: lscr.io/linuxserver/deluge:latest
-    container_name: << service_name >>-deluge
+<%- if enable_jackett %>
+  << service_name >>-jackett:
+    image: lscr.io/linuxserver/jackett:latest
+    container_name: << service_name >>-jackett
    environment:
      - PUID=<< puid >>
      - PGID=<< pgid >>
      - TZ=<< timezone >>
-      - UMASK=002
    volumes:
-      - << appdata_dir >>/<< service_name >>/deluge:/config
-      - << data_root >>:/data
-<%- if enable_gluetun %>
-    network_mode: "service:<< service_name >>-gluetun"
-    depends_on:
-      - << service_name >>-gluetun
-<%- endif %>
-<%- if not enable_gluetun %>
+      - << data_dir >>/<< service_name >>/jackett:/config
    ports:
-      - "<< port_deluge >>:8112"
-      - "<< port_deluge_torrent >>:6881"
-      - "<< port_deluge_torrent >>:6881/udp"
-<%- endif %>
+      - "<< port_jackett >>:9117"
    restart: unless-stopped
 <%- endif %>

-<%- if enable_nzbget %>
-  << service_name >>-nzbget:
-    image: lscr.io/linuxserver/nzbget:latest
-    container_name: << service_name >>-nzbget
+<%- if enable_bazarr %>
+  << service_name >>-bazarr:
+    image: lscr.io/linuxserver/bazarr:latest
+    container_name: << service_name >>-bazarr
    environment:
      - PUID=<< puid >>
      - PGID=<< pgid >>
      - TZ=<< timezone >>
-      - UMASK=002
    volumes:
-      - << appdata_dir >>/<< service_name >>/nzbget:/config
-      - << data_root >>:/data
-<%- if enable_gluetun %>
-    network_mode: "service:<< service_name >>-gluetun"
-    depends_on:
-      - << service_name >>-gluetun
-<%- endif %>
-<%- if not enable_gluetun %>
+      - << data_dir >>/<< service_name >>/bazarr:/config
+      - << media_dir >>/films:/movies
+      - << media_dir >>/series:/tv
    ports:
+      - "<< port_bazarr >>:6767"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_flaresolverr %>
+  << service_name >>-flaresolverr:
+    image: ghcr.io/flaresolverr/flaresolverr:latest
+    container_name: << service_name >>-flaresolverr
+    environment:
+      - TZ=<< timezone >>
+      - LOG_LEVEL=info
+    ports:
+      - "<< port_flaresolverr >>:8191"
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_gluetun %>
+  << service_name >>-gluetun:
+    image: qmcgaw/gluetun:latest
+    container_name: << service_name >>-gluetun
+    cap_add:
+      - NET_ADMIN
+    devices:
+      - /dev/net/tun:/dev/net/tun
+    environment:
+      - TZ=<< timezone >>
+      - VPN_SERVICE_PROVIDER=<< vpn_provider >>
+      - VPN_TYPE=<< vpn_type >>
+      - WIREGUARD_PRIVATE_KEY=<< wireguard_private_key >>
+      - WIREGUARD_ADDRESSES=<< wireguard_addresses >>
+      - OPENVPN_USER=<< openvpn_user >>
+      - OPENVPN_PASSWORD=<< openvpn_password >>
+    ports:
+      # De downloadclients delen dit netwerk, dus hun poorten staan hier.
+<%- if enable_qbittorrent %>
+      - "<< port_qbittorrent >>:8090"
+      - "<< port_qbittorrent_tcp >>:6881"
+      - "<< port_qbittorrent_tcp >>:6881/udp"
+<%- endif %>
+<%- if enable_sabnzbd %>
+      - "<< port_sabnzbd >>:8080"
+<%- endif %>
+<%- if enable_nzbget %>
      - "<< port_nzbget >>:6789"
 <%- endif %>
+    volumes:
+      - << data_dir >>/<< service_name >>/gluetun:/gluetun
    restart: unless-stopped
 <%- endif %>

@ -262,11 +193,10 @@ services:
      - PUID=<< puid >>
      - PGID=<< pgid >>
      - TZ=<< timezone >>
-      - UMASK=002
      - WEBUI_PORT=8090
    volumes:
-      - << appdata_dir >>/<< service_name >>/qbittorrent:/config
-      - << data_root >>:/data
+      - << data_dir >>/<< service_name >>/qbittorrent:/config
+      - << downloads_dir >>:/downloads
 <%- if enable_gluetun %>
    network_mode: "service:<< service_name >>-gluetun"
    depends_on:
@ -275,8 +205,8 @@ services:
 <%- if not enable_gluetun %>
    ports:
      - "<< port_qbittorrent >>:8090"
-      - "<< port_qbittorrent_torrent >>:6881"
-      - "<< port_qbittorrent_torrent >>:6881/udp"
+      - "<< port_qbittorrent_tcp >>:6881"
+      - "<< port_qbittorrent_tcp >>:6881/udp"
 <%- endif %>
    restart: unless-stopped
 <%- endif %>
@ -289,10 +219,9 @@ services:
      - PUID=<< puid >>
      - PGID=<< pgid >>
      - TZ=<< timezone >>
-      - UMASK=002
    volumes:
-      - << appdata_dir >>/<< service_name >>/sabnzbd:/config
-      - << data_root >>:/data
+      - << data_dir >>/<< service_name >>/sabnzbd:/config
+      - << downloads_dir >>:/downloads
 <%- if enable_gluetun %>
    network_mode: "service:<< service_name >>-gluetun"
    depends_on:
@ -305,16 +234,17 @@ services:
    restart: unless-stopped
 <%- endif %>

-<%- if enable_slskd %>
-  << service_name >>-slskd:
-    image: slskd/slskd:latest
-    container_name: << service_name >>-slskd
+<%- if enable_nzbget %>
+  << service_name >>-nzbget:
+    image: lscr.io/linuxserver/nzbget:latest
+    container_name: << service_name >>-nzbget
    environment:
+      - PUID=<< puid >>
+      - PGID=<< pgid >>
      - TZ=<< timezone >>
-      - SLSKD_REMOTE_CONFIGURATION=true
    volumes:
-      - << appdata_dir >>/<< service_name >>/slskd:/app
-      - << data_root >>:/data
+      - << data_dir >>/<< service_name >>/nzbget:/config
+      - << downloads_dir >>:/downloads
 <%- if enable_gluetun %>
    network_mode: "service:<< service_name >>-gluetun"
    depends_on:
@ -322,110 +252,11 @@ services:
 <%- endif %>
 <%- if not enable_gluetun %>
    ports:
-      - "<< port_slskd >>:5030"
-      - "<< port_slskd_listen >>:50300"
+      - "<< port_nzbget >>:6789"
 <%- endif %>
    restart: unless-stopped
 <%- endif %>

-<%- if enable_transmission %>
-  << service_name >>-transmission:
-    image: lscr.io/linuxserver/transmission:latest
-    container_name: << service_name >>-transmission
-    environment:
-      - PUID=<< puid >>
-      - PGID=<< pgid >>
-      - TZ=<< timezone >>
-      - UMASK=002
-    volumes:
-      - << appdata_dir >>/<< service_name >>/transmission:/config
-      - << data_root >>:/data
-<%- if enable_gluetun %>
-    network_mode: "service:<< service_name >>-gluetun"
-    depends_on:
-      - << service_name >>-gluetun
-<%- endif %>
-<%- if not enable_gluetun %>
-    ports:
-      - "<< port_transmission >>:9091"
-      - "<< port_transmission_torrent >>:51413"
-      - "<< port_transmission_torrent >>:51413/udp"
-<%- endif %>
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_bazarr %>
-  << service_name >>-bazarr:
-    image: lscr.io/linuxserver/bazarr:latest
-    container_name: << service_name >>-bazarr
-    environment:
-      - PUID=<< puid >>
-      - PGID=<< pgid >>
-      - TZ=<< timezone >>
-      - UMASK=002
-    volumes:
-      - << appdata_dir >>/<< service_name >>/bazarr:/config
-      - << data_root >>:/data
-    ports:
-      - "<< port_bazarr >>:6767"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_lingarr %>
-  << service_name >>-lingarr:
-    image: lingarr/lingarr:latest
-    container_name: << service_name >>-lingarr
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/lingarr:/app/config
-      - << data_root >>:/data
-    ports:
-      - "<< port_lingarr >>:9876"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_tdarr %>
-  << service_name >>-tdarr:
-    image: ghcr.io/haveagitgat/tdarr:latest
-    container_name: << service_name >>-tdarr
-    environment:
-      - PUID=<< puid >>
-      - PGID=<< pgid >>
-      - TZ=<< timezone >>
-      - UMASK=002
-      - serverIP=0.0.0.0
-      - serverPort=8266
-      - webUIPort=8265
-      - internalNode=true
-    volumes:
-      - << appdata_dir >>/<< service_name >>/tdarr:/app/server
-      - << data_root >>:/data
-      - << appdata_dir >>/<< service_name >>/tdarr-configs:/app/configs
-    ports:
-      - "<< port_tdarr >>:8265"
-      - "<< port_tdarr_server >>:8266"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_unpackerr %>
-  << service_name >>-unpackerr:
-    image: ghcr.io/unpackerr/unpackerr:latest
-    container_name: << service_name >>-unpackerr
-    environment:
-      - PUID=<< puid >>
-      - PGID=<< pgid >>
-      - TZ=<< timezone >>
-      - UN_SONARR_0_URL=<< sonarr_url >>
-      - UN_SONARR_0_API_KEY=<< sonarr_apikey >>
-      - UN_RADARR_0_URL=<< radarr_url >>
-      - UN_RADARR_0_API_KEY=<< radarr_apikey >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/unpackerr:/config
-      - << data_root >>:/data
-    restart: unless-stopped
-<%- endif %>
-
 <%- if enable_jellyseerr %>
  << service_name >>-jellyseerr:
    image: fallenbagel/jellyseerr:latest
@ -434,412 +265,98 @@ services:
      - TZ=<< timezone >>
      - LOG_LEVEL=info
    volumes:
-      - << appdata_dir >>/<< service_name >>/jellyseerr:/app/config
+      - << data_dir >>/<< service_name >>/jellyseerr:/app/config
    ports:
      - "<< port_jellyseerr >>:5055"
    restart: unless-stopped
 <%- endif %>

-<%- if enable_overseerr %>
-  << service_name >>-overseerr:
-    image: sctx/overseerr:latest
-    container_name: << service_name >>-overseerr
-    environment:
-      - TZ=<< timezone >>
-      - LOG_LEVEL=info
-    volumes:
-      - << appdata_dir >>/<< service_name >>/overseerr:/app/config
-    ports:
-      - "<< port_overseerr >>:5055"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_prefetcharr %>
-  << service_name >>-prefetcharr:
-    image: phueber/prefetcharr:latest
-    container_name: << service_name >>-prefetcharr
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/prefetcharr:/config
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_pulsarr %>
-  << service_name >>-pulsarr:
-    image: lakker/pulsarr:latest
-    container_name: << service_name >>-pulsarr
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/pulsarr:/app/data
-    ports:
-      - "<< port_pulsarr >>:3003"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_requestrr %>
-  << service_name >>-requestrr:
-    image: thomst08/requestrr:latest
-    container_name: << service_name >>-requestrr
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/requestrr:/root/config
-    ports:
-      - "<< port_requestrr >>:4545"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_suggestarr %>
-  << service_name >>-suggestarr:
-    image: ciuse99/suggestarr:latest
-    container_name: << service_name >>-suggestarr
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/suggestarr:/app/config
-    ports:
-      - "<< port_suggestarr >>:5000"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_wizarr %>
-  << service_name >>-wizarr:
-    image: ghcr.io/wizarrrr/wizarr:latest
-    container_name: << service_name >>-wizarr
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/wizarr:/data/database
-    ports:
-      - "<< port_wizarr >>:5690"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_cleanuparr %>
-  << service_name >>-cleanuparr:
-    image: ghcr.io/cleanuparr/cleanuparr:latest
-    container_name: << service_name >>-cleanuparr
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/cleanuparr:/config
-      - << data_root >>:/data
-    ports:
-      - "<< port_cleanuparr >>:11011"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_crossseed %>
-  << service_name >>-crossseed:
-    image: ghcr.io/cross-seed/cross-seed:latest
-    container_name: << service_name >>-crossseed
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/crossseed:/config
-      - << data_root >>:/data
-    command: daemon
-    ports:
-      - "<< port_crossseed >>:2468"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_decluttarr %>
-  << service_name >>-decluttarr:
-    image: ghcr.io/manimatter/decluttarr:latest
-    container_name: << service_name >>-decluttarr
-    environment:
-      - TZ=<< timezone >>
-      - SONARR_URL=<< sonarr_url >>
-      - SONARR_KEY=<< sonarr_apikey >>
-      - RADARR_URL=<< radarr_url >>
-      - RADARR_KEY=<< radarr_apikey >>
-      - LOG_LEVEL=INFO
-    volumes:
-      - << appdata_dir >>/<< service_name >>/decluttarr:/config
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_janitorr %>
-  << service_name >>-janitorr:
-    image: ghcr.io/schaka/janitorr:native-stable
-    container_name: << service_name >>-janitorr
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/janitorr:/config
-      - << data_root >>:/data
-    ports:
-      - "<< port_janitorr >>:8978"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_maintainerr %>
-  << service_name >>-maintainerr:
-    image: ghcr.io/maintainerr/maintainerr:latest
-    container_name: << service_name >>-maintainerr
-    environment:
-      - PUID=<< puid >>
-      - PGID=<< pgid >>
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/maintainerr:/opt/data
-    ports:
-      - "<< port_maintainerr >>:6246"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_neutarr %>
-  << service_name >>-neutarr:
-    image: iampuid0/neutarr:latest
-    container_name: << service_name >>-neutarr
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/neutarr:/config
-    ports:
-      - "<< port_neutarr >>:9705"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_configarr %>
-  << service_name >>-configarr:
-    image: ghcr.io/raydak-labs/configarr:latest
-    container_name: << service_name >>-configarr
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/configarr:/app/config
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_profilarr %>
-  << service_name >>-profilarr:
-    image: santiagosayshey/profilarr:latest
-    container_name: << service_name >>-profilarr
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/profilarr:/config
-    ports:
-      - "<< port_profilarr >>:6868"
-    restart: unless-stopped
-<%- endif %>
-
 <%- if enable_recyclarr %>
  << service_name >>-recyclarr:
    image: ghcr.io/recyclarr/recyclarr:latest
    container_name: << service_name >>-recyclarr
+    user: << puid >>:<< pgid >>
+    environment:
+      - TZ=<< timezone >>
+    volumes:
+      - << data_dir >>/<< service_name >>/recyclarr:/config
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_unpackerr %>
+  << service_name >>-unpackerr:
+    image: ghcr.io/unpackerr/unpackerr:latest
+    container_name: << service_name >>-unpackerr
+    user: << puid >>:<< pgid >>
+    environment:
+      - TZ=<< timezone >>
+      - UN_SONARR_0_URL=http://<< service_name >>-sonarr:8989
+      - UN_RADARR_0_URL=http://<< service_name >>-radarr:7878
+    volumes:
+      - << data_dir >>/<< service_name >>/unpackerr:/config
+      - << downloads_dir >>:/downloads
+    restart: unless-stopped
+<%- endif %>
+
+<%- if enable_tdarr %>
+  << service_name >>-tdarr:
+    image: ghcr.io/haveagitgat/tdarr:latest
+    container_name: << service_name >>-tdarr
    environment:
      - PUID=<< puid >>
      - PGID=<< pgid >>
      - TZ=<< timezone >>
+      - serverIP=0.0.0.0
+      - serverPort=8266
+      - webUIPort=8265
+      - internalNode=true
    volumes:
-      - << appdata_dir >>/<< service_name >>/recyclarr:/config
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_kometa %>
-  << service_name >>-kometa:
-    image: kometateam/kometa:latest
-    container_name: << service_name >>-kometa
-    environment:
-      - TZ=<< timezone >>
-      - KOMETA_RUN=false
-    volumes:
-      - << appdata_dir >>/<< service_name >>/kometa:/config
-      - << data_root >>:/data
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_posterizarr %>
-  << service_name >>-posterizarr:
-    image: ghcr.io/fscorrupt/posterizarr:latest
-    container_name: << service_name >>-posterizarr
-    environment:
-      - TZ=<< timezone >>
-      - RUN_TIME=disabled
-    volumes:
-      - << appdata_dir >>/<< service_name >>/posterizarr:/config
-      - << data_root >>:/data
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_trailarr %>
-  << service_name >>-trailarr:
-    image: nandyalu/trailarr:latest
-    container_name: << service_name >>-trailarr
-    environment:
-      - PUID=<< puid >>
-      - PGID=<< pgid >>
-      - TZ=<< timezone >>
-      - UMASK=002
-    volumes:
-      - << appdata_dir >>/<< service_name >>/trailarr:/config
-      - << data_root >>:/data
+      - << data_dir >>/<< service_name >>/tdarr/server:/app/server
+      - << data_dir >>/<< service_name >>/tdarr/configs:/app/configs
+      - << media_dir >>:/media
+      - << downloads_dir >>/tdarr-cache:/temp
    ports:
-      - "<< port_trailarr >>:7889"
+      - "<< port_tdarr >>:8265"
+      - "<< port_tdarr_server >>:8266"
    restart: unless-stopped
 <%- endif %>

-<%- if enable_autopulse %>
-  << service_name >>-autopulse:
-    image: ghcr.io/dan-online/autopulse:latest
-    container_name: << service_name >>-autopulse
+<%- if enable_autobrr %>
+  << service_name >>-autobrr:
+    image: ghcr.io/autobrr/autobrr:latest
+    container_name: << service_name >>-autobrr
    environment:
      - TZ=<< timezone >>
    volumes:
-      - << appdata_dir >>/<< service_name >>/autopulse:/app/config
+      - << data_dir >>/<< service_name >>/autobrr:/config
    ports:
-      - "<< port_autopulse >>:2875"
+      - "<< port_autobrr >>:7474"
    restart: unless-stopped
 <%- endif %>

-<%- if enable_exportarr %>
-  << service_name >>-exportarr:
-    image: ghcr.io/onedr0p/exportarr:latest
-    container_name: << service_name >>-exportarr
+<%- if enable_maintainerr %>
+  << service_name >>-maintainerr:
+    image: ghcr.io/jorenn92/maintainerr:latest
+    container_name: << service_name >>-maintainerr
+    user: << puid >>:<< pgid >>
    environment:
      - TZ=<< timezone >>
-      - URL=<< arr_url >>
-      - APIKEY=<< arr_apikey >>
-      - PORT=<< port_exportarr >>
    volumes:
-      - << appdata_dir >>/<< service_name >>/exportarr:/config
-    command: << arr_soort >>
+      - << data_dir >>/<< service_name >>/maintainerr:/opt/data
    ports:
-      - "<< port_exportarr >>:9707"
+      - "<< port_maintainerr >>:6246"
    restart: unless-stopped
 <%- endif %>

-<%- if enable_homarr %>
-  << service_name >>-homarr:
-    image: ghcr.io/homarr-labs/homarr:latest
-    container_name: << service_name >>-homarr
+<%- if enable_huntarr %>
+  << service_name >>-huntarr:
+    image: ghcr.io/plexguide/huntarr:latest
+    container_name: << service_name >>-huntarr
    environment:
      - TZ=<< timezone >>
-      - SECRET_ENCRYPTION_KEY=<< homarr_encryption_key >>
    volumes:
-      - << appdata_dir >>/<< service_name >>/homarr:/appdata
+      - << data_dir >>/<< service_name >>/huntarr:/config
    ports:
-      - "<< port_homarr >>:7575"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_jellystat %>
-  << service_name >>-jellystat:
-    image: cyfershepard/jellystat:latest
-    container_name: << service_name >>-jellystat
-    environment:
-      - TZ=<< timezone >>
-      - POSTGRES_USER=jellystat
-      - POSTGRES_PASSWORD=<< db_password >>
-      - POSTGRES_IP=<< service_name >>-jellystat-db
-      - POSTGRES_PORT=5432
-      - JWT_SECRET=<< jwt_secret >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/jellystat:/app/backend/backup-data
-    ports:
-      - "<< port_jellystat >>:3000"
-    depends_on:
-      - << service_name >>-jellystat-db
-    restart: unless-stopped
-  << service_name >>-jellystat-db:
-    image: postgres:16-alpine
-    container_name: << service_name >>-jellystat-db
-    environment:
-      - POSTGRES_USER=jellystat
-      - POSTGRES_PASSWORD=<< db_password >>
-      - POSTGRES_DB=jfstat
-    volumes:
-      - << appdata_dir >>/<< service_name >>-jellystat-db:/var/lib/postgresql/data
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_notifiarr %>
-  << service_name >>-notifiarr:
-    image: golift/notifiarr:latest
-    container_name: << service_name >>-notifiarr
-    environment:
-      - TZ=<< timezone >>
-      - DN_API_KEY=<< notifiarr_apikey >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/notifiarr:/config
-    ports:
-      - "<< port_notifiarr >>:5454"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_tautulli %>
-  << service_name >>-tautulli:
-    image: lscr.io/linuxserver/tautulli:latest
-    container_name: << service_name >>-tautulli
-    environment:
-      - PUID=<< puid >>
-      - PGID=<< pgid >>
-      - TZ=<< timezone >>
-      - UMASK=002
-    volumes:
-      - << appdata_dir >>/<< service_name >>/tautulli:/config
-    ports:
-      - "<< port_tautulli >>:8181"
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_soularr %>
-  << service_name >>-soularr:
-    image: mrusse08/soularr:latest
-    container_name: << service_name >>-soularr
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/soularr:/data
-      - << data_root >>:/data
-    restart: unless-stopped
-<%- endif %>
-
-<%- if enable_gluetun %>
-  << service_name >>-gluetun:
-    image: qmcgaw/gluetun:latest
-    container_name: << service_name >>-gluetun
-    environment:
-      - TZ=<< timezone >>
-      - VPN_SERVICE_PROVIDER=<< vpn_provider >>
-      - VPN_TYPE=<< vpn_type >>
-      - SERVER_COUNTRIES=<< vpn_landen >>
-      - WIREGUARD_PRIVATE_KEY=<< wireguard_private_key >>
-      - WIREGUARD_ADDRESSES=<< wireguard_addresses >>
-      - OPENVPN_USER=<< openvpn_user >>
-      - OPENVPN_PASSWORD=<< openvpn_password >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>/gluetun:/gluetun
-    cap_add:
-      - NET_ADMIN
-    devices:
-      - /dev/net/tun:/dev/net/tun
-    ports:
-      # De downloadclients delen dit netwerk, dus hun webinterfaces
-      # staan hier. Inkomende torrentpoorten niet: die regelt je
-      # VPN-aanbieder met port forwarding.
-<%- if enable_deluge %>
-      - "<< port_deluge >>:8112"
-<%- endif %>
-<%- if enable_nzbget %>
-      - "<< port_nzbget >>:6789"
-<%- endif %>
-<%- if enable_qbittorrent %>
-      - "<< port_qbittorrent >>:8090"
-<%- endif %>
-<%- if enable_sabnzbd %>
-      - "<< port_sabnzbd >>:8080"
-<%- endif %>
-<%- if enable_slskd %>
-      - "<< port_slskd >>:5030"
-<%- endif %>
-<%- if enable_transmission %>
-      - "<< port_transmission >>:9091"
-<%- endif %>
+      - "<< port_huntarr >>:9705"
    restart: unless-stopped
 <%- endif %>
--- a/apps/arr-stack/template.json
+++ b/apps/arr-stack/template.json
--- a/apps/audiobookshelf/files/compose.yaml
+++ b/apps/audiobookshelf/files/compose.yaml
@ -8,6 +8,6 @@ services:
      - TZ=<< timezone >>
    volumes:
      - << media_dir >>:/audiobooks
-      - << appdata_dir >>/<< service_name >>/config:/config
-      - << appdata_dir >>/<< service_name >>/metadata:/metadata
+      - << data_dir >>/<< service_name >>/config:/config
+      - << data_dir >>/<< service_name >>/metadata:/metadata
    restart: unless-stopped
--- a/apps/audiobookshelf/template.json
+++ b/apps/audiobookshelf/template.json
@ -38,9 +38,9 @@
          "required": true
        },
        {
-          "name": "appdata_dir",
+          "name": "data_dir",
          "type": "str",
-          "title": "Appdata-map",
+          "title": "Data directory",
          "default": "/opt/serverup/appdata",
          "required": true
        },
--- a/apps/authelia/files/compose.yaml
+++ b/apps/authelia/files/compose.yaml
@ -11,5 +11,5 @@ services:
      - AUTHELIA_STORAGE_ENCRYPTION_KEY=<< storage_key >>
    volumes:
      # Zet hier configuration.yml en users_database.yml neer voor de eerste start.
-      - << appdata_dir >>/<< service_name >>/config:/config
+      - << data_dir >>/<< service_name >>/config:/config
    restart: unless-stopped
--- a/apps/authelia/template.json
+++ b/apps/authelia/template.json
@ -38,9 +38,9 @@
          "required": true
        },
        {
-          "name": "appdata_dir",
+          "name": "data_dir",
          "type": "str",
-          "title": "Appdata-map",
+          "title": "Data directory",
          "default": "/opt/serverup/appdata",
          "required": true
        },
@ -61,9 +61,7 @@
          "config": {
            "placeholder": "sterk-wachtwoord"
          },
-          "advanced": true,
-          "generate": "auto",
-          "secret": true
+          "advanced": true
        },
        {
          "name": "session_secret",
@ -75,9 +73,7 @@
          "config": {
            "placeholder": "sterk-wachtwoord"
          },
-          "advanced": true,
-          "generate": "auto",
-          "secret": true
+          "advanced": true
        },
        {
          "name": "storage_key",
@ -89,9 +85,7 @@
          "config": {
            "placeholder": "sterk-wachtwoord"
          },
-          "advanced": true,
-          "generate": "auto",
-          "secret": true
+          "advanced": true
        }
      ]
    }
--- a/apps/authentik/files/compose.yaml
+++ b/apps/authentik/files/compose.yaml
@ -1,58 +0,0 @@
-services:
-  << service_name >>:
-    image: ghcr.io/goauthentik/server:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-      - AUTHENTIK_SECRET_KEY=<< secret_key >>
-      - AUTHENTIK_POSTGRESQL__HOST=<< service_name >>-db
-      - AUTHENTIK_POSTGRESQL__USER=authentik
-      - AUTHENTIK_POSTGRESQL__NAME=authentik
-      - AUTHENTIK_POSTGRESQL__PASSWORD=<< db_password >>
-      - AUTHENTIK_REDIS__HOST=<< service_name >>-redis
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/media
-      - << appdata_dir >>/<< service_name >>-templates:/templates
-    command: server
-    ports:
-      - "<< port >>:9000"
-    depends_on:
-      - << service_name >>-db
-      - << service_name >>-redis
-    restart: unless-stopped
-  << service_name >>-worker:
-    image: ghcr.io/goauthentik/server:latest
-    container_name: << service_name >>-worker
-    command: worker
-    environment:
-      - AUTHENTIK_SECRET_KEY=<< secret_key >>
-      - AUTHENTIK_POSTGRESQL__HOST=<< service_name >>-db
-      - AUTHENTIK_POSTGRESQL__USER=authentik
-      - AUTHENTIK_POSTGRESQL__NAME=authentik
-      - AUTHENTIK_POSTGRESQL__PASSWORD=<< db_password >>
-      - AUTHENTIK_REDIS__HOST=<< service_name >>-redis
-    volumes:
-      - << appdata_dir >>/<< service_name >>/media:/media
-      - << appdata_dir >>/<< service_name >>-templates:/templates
-      - /var/run/docker.sock:/var/run/docker.sock
-    depends_on:
-      - << service_name >>-db
-      - << service_name >>-redis
-    restart: unless-stopped
-  << service_name >>-db:
-    image: postgres:16-alpine
-    container_name: << service_name >>-db
-    environment:
-      - POSTGRES_DB=authentik
-      - POSTGRES_USER=authentik
-      - POSTGRES_PASSWORD=<< db_password >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>-db:/var/lib/postgresql/data
-    restart: unless-stopped
-  << service_name >>-redis:
-    image: valkey/valkey:8-alpine
-    container_name: << service_name >>-redis
-    command: valkey-server --save 60 1
-    volumes:
-      - << appdata_dir >>/<< service_name >>-redis:/data
-    restart: unless-stopped
--- a/apps/authentik/template.json
+++ b/apps/authentik/template.json
@ -1,86 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Authentik",
-    "description": "Volledige identiteitsserver: OIDC, SAML, LDAP en passkeys, met een visuele opbouw van je inlogstappen. De zwaardere broer van Authelia.",
-    "tags": [
-      "sso",
-      "oidc",
-      "saml",
-      "ldap",
-      "authenticatie"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "authentik"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "beveiliging"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "authentik",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 8133,
-          "required": true,
-          "description": "Standaard 9000; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Toegang",
-      "items": [
-        {
-          "name": "db_password",
-          "type": "str",
-          "title": "Databasewachtwoord",
-          "default": "",
-          "required": true,
-          "secret": true,
-          "generate": "auto",
-          "description": "Wordt automatisch ingevuld en in .env bewaard"
-        },
-        {
-          "name": "secret_key",
-          "type": "str",
-          "title": "Geheime sleutel",
-          "default": "",
-          "required": true,
-          "secret": true,
-          "generate": "auto",
-          "description": "Ondertekent de sessies; verlies je hem, dan moet iedereen opnieuw inloggen"
-        }
-      ]
-    }
-  ]
-}
--- a/apps/autopulse/files/compose.yaml
+++ b/apps/autopulse/files/compose.yaml
@ -1,11 +0,0 @@
-services:
-  << service_name >>:
-    image: ghcr.io/dan-online/autopulse:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/app/config
-    ports:
-      - "<< port >>:2875"
-    restart: unless-stopped
--- a/apps/autopulse/template.json
+++ b/apps/autopulse/template.json
@ -1,57 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Autopulse",
-    "description": "Laat Plex of Jellyfin meteen een nieuwe aflevering zien, in plaats van te wachten op de volgende scan.",
-    "tags": [
-      "media",
-      "automatisering"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "autopulse"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "media"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "autopulse",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Poort",
-          "default": 2875,
-          "required": true
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de instellingen van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    }
-  ]
-}
--- a/apps/baby-buddy/files/compose.yaml
+++ b/apps/baby-buddy/files/compose.yaml
@ -1,6 +1,6 @@
 services:
  << service_name >>:
-    image: lscr.io/linuxserver/babybuddy:latest
+    image: ghcr.io/babybuddy/babybuddy:latest
    container_name: << service_name >>
    ports:
      - "<< port >>:8000"
@ -12,5 +12,5 @@ services:
      - ALLOWED_HOSTS=<< allowed_hosts >>
      - CSRF_TRUSTED_ORIGINS=http://<< allowed_hosts >>
    volumes:
-      - << appdata_dir >>/<< service_name >>:/config
+      - << data_dir >>/<< service_name >>/config:/app/data
    restart: unless-stopped
--- a/apps/baby-buddy/template.json
+++ b/apps/baby-buddy/template.json
@ -38,9 +38,9 @@
          "required": true
        },
        {
-          "name": "appdata_dir",
+          "name": "data_dir",
          "type": "str",
-          "title": "Appdata-map",
+          "title": "Data directory",
          "default": "/opt/serverup/appdata",
          "required": true
        },
@ -77,9 +77,7 @@
          "description": "Willekeurige waarde voor sessieversleuteling; gebruik de dobbelsteenknop",
          "config": {
            "placeholder": "willekeurige-lange-string"
-          },
-          "generate": "auto",
-          "secret": true
+          }
        },
        {
          "name": "allowed_hosts",
--- a/apps/backrest/files/compose.yaml
+++ b/apps/backrest/files/compose.yaml
@ -1,14 +0,0 @@
-services:
-  << service_name >>:
-    image: garethgeorge/backrest:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/config
-      - << appdata_dir >>/<< service_name >>-data:/data
-      - << appdata_dir >>/<< service_name >>-cache:/cache
-      - << bron_dir >>:/userdata:ro
-    ports:
-      - "<< port >>:9898"
-    restart: unless-stopped
--- a/apps/backrest/template.json
+++ b/apps/backrest/template.json
@ -1,72 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Backrest",
-    "description": "Webinterface voor restic: back-upschema's, snapshots doorbladeren en terugzetten, zonder de commandoregel.",
-    "tags": [
-      "backup",
-      "restic",
-      "opslag"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "backrest"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "opslag"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "backrest",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 8127,
-          "required": true,
-          "description": "Standaard 9898; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Instellingen",
-      "items": [
-        {
-          "name": "bron_dir",
-          "type": "str",
-          "title": "Map om te back-uppen",
-          "default": "/opt/serverup",
-          "required": true,
-          "description": "Wordt alleen-lezen gekoppeld als /userdata"
-        }
-      ]
-    }
-  ]
-}
--- a/apps/baikal/files/compose.yaml
+++ b/apps/baikal/files/compose.yaml
@ -1,12 +0,0 @@
-services:
-  << service_name >>:
-    image: ckulka/baikal:nginx
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/var/www/baikal/config
-      - << appdata_dir >>/<< service_name >>-specific:/var/www/baikal/Specific
-    ports:
-      - "<< port >>:80"
-    restart: unless-stopped
--- a/apps/baikal/template.json
+++ b/apps/baikal/template.json
@ -1,61 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Baïkal",
-    "description": "Je agenda en contacten op je eigen server, via CalDAV en CardDAV. iPhone, Android en Thunderbird praten er zo mee. Vervangt Google Agenda en Google Contacten.",
-    "tags": [
-      "agenda",
-      "contacten",
-      "caldav",
-      "carddav"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "baikal"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "gezin",
-      "productiviteit"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "baikal",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 8180,
-          "required": true,
-          "description": "Standaard 80; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    }
-  ]
-}
--- a/apps/bambuddy/files/compose.yaml
+++ b/apps/bambuddy/files/compose.yaml
@ -10,8 +10,8 @@ services:
      - PGID=<< pgid >>
      - PORT=8000
    volumes:
-      - << appdata_dir >>/<< service_name >>/data:/app/data
-      - << appdata_dir >>/<< service_name >>/logs:/app/logs
+      - << data_dir >>/<< service_name >>/data:/app/data
+      - << data_dir >>/<< service_name >>/logs:/app/logs
    cap_add:
      - NET_BIND_SERVICE
    stop_grace_period: 30s
--- a/apps/bambuddy/template.json
+++ b/apps/bambuddy/template.json
@ -38,9 +38,9 @@
          "required": true
        },
        {
-          "name": "appdata_dir",
+          "name": "data_dir",
          "type": "str",
-          "title": "Appdata-map",
+          "title": "Data directory",
          "default": "/opt/serverup/appdata",
          "required": true
        },
--- a/apps/baserow/files/compose.yaml
+++ b/apps/baserow/files/compose.yaml
@ -8,5 +8,5 @@ services:
      - TZ=<< timezone >>
      - BASEROW_PUBLIC_URL=<< public_url >>
    volumes:
-      - << appdata_dir >>/<< service_name >>:/baserow/data
+      - << data_dir >>/<< service_name >>:/baserow/data
    restart: unless-stopped
--- a/apps/baserow/template.json
+++ b/apps/baserow/template.json
@ -39,9 +39,9 @@
          "required": true
        },
        {
-          "name": "appdata_dir",
+          "name": "data_dir",
          "type": "str",
-          "title": "Appdata-map",
+          "title": "Data directory",
          "default": "/opt/serverup/appdata",
          "required": true
        },
@ -56,10 +56,9 @@
          "name": "public_url",
          "type": "str",
          "title": "Publieke URL",
-          "default": "http://localhost:8099",
+          "default": "http://localhost:8098",
          "required": true,
-          "description": "Zonder dit kloppen links en uploads niet",
-          "help": "Het adres waarop je Baserow opent. Baserow bouwt hier zijn links mee op, dus een verkeerde poort levert knoppen op die nergens heen gaan. Benader je de server op zijn IP-adres, vul dan dat adres in: http://10.0.20.5:8099"
+          "description": "Zonder dit kloppen links en uploads niet"
        }
      ]
    }
--- a/apps/bazarr/files/compose.yaml
+++ b/apps/bazarr/files/compose.yaml
@ -1,15 +0,0 @@
-services:
-  << service_name >>:
-    image: lscr.io/linuxserver/bazarr:latest
-    container_name: << service_name >>
-    environment:
-      - PUID=<< puid >>
-      - PGID=<< pgid >>
-      - TZ=<< timezone >>
-      - UMASK=002
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/config
-      - << data_root >>:/data
-    ports:
-      - "<< port >>:6767"
-    restart: unless-stopped
--- a/apps/bazarr/template.json
+++ b/apps/bazarr/template.json
@ -1,86 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Bazarr",
-    "description": "Zoekt en downloadt ondertitels bij wat Sonarr en Radarr al hebben binnengehaald.",
-    "tags": [
-      "media",
-      "ondertitels"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "bazarr"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "media"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "bazarr",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 6767,
-          "required": true
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de instellingen van deze app"
-        },
-        {
-          "name": "data_root",
-          "type": "str",
-          "title": "Gedeelde datamap",
-          "default": "/mnt/data",
-          "required": true,
-          "description": "Eén map met je media én je downloads, gekoppeld als /data",
-          "help": "Media en downloads horen onder één map te staan, die als /data in elke container komt. Alleen dan kan een voltooide download met een hardlink naar je bibliotheek: geen kopie, geen dubbele opslag, en je torrent blijft seeden. Zet je ze op gescheiden paden, dan kopieert elke download opnieuw. Eronder: media/films, media/series, torrents/ en usenet/."
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Gebruiker",
-      "items": [
-        {
-          "name": "puid",
-          "type": "int",
-          "title": "Gebruikers-ID (PUID)",
-          "default": 1000,
-          "required": true,
-          "description": "`id -u` op je server; bepaalt de eigenaar van de bestanden"
-        },
-        {
-          "name": "pgid",
-          "type": "int",
-          "title": "Groeps-ID (PGID)",
-          "default": 1000,
-          "required": true
-        }
-      ]
-    }
-  ]
-}
--- a/apps/beszel/files/compose.yaml
+++ b/apps/beszel/files/compose.yaml
@ -7,7 +7,7 @@ services:
    environment:
      - TZ=<< timezone >>
    volumes:
-      - << appdata_dir >>/<< service_name >>/data:/beszel_data
+      - << data_dir >>/<< service_name >>/data:/beszel_data
    restart: unless-stopped

  << service_name >>-agent:
--- a/apps/beszel/template.json
+++ b/apps/beszel/template.json
@ -38,9 +38,9 @@
          "required": true
        },
        {
-          "name": "appdata_dir",
+          "name": "data_dir",
          "type": "str",
-          "title": "Appdata-map",
+          "title": "Data directory",
          "default": "/opt/serverup/appdata",
          "required": true
        },
--- a/apps/bookstack/files/compose.yaml
+++ b/apps/bookstack/files/compose.yaml
@ -15,7 +15,7 @@ services:
      - DB_PASSWORD=<< db_password >>
      - DB_DATABASE=bookstack
    volumes:
-      - << appdata_dir >>/<< service_name >>/config:/config
+      - << data_dir >>/<< service_name >>/config:/config
    depends_on:
      - << service_name >>-db
    restart: unless-stopped
@ -32,5 +32,5 @@ services:
      - MYSQL_USER=bookstack
      - MYSQL_PASSWORD=<< db_password >>
    volumes:
-      - << appdata_dir >>/<< service_name >>/db:/config
+      - << data_dir >>/<< service_name >>/db:/config
    restart: unless-stopped
--- a/apps/bookstack/template.json
+++ b/apps/bookstack/template.json
@ -38,9 +38,9 @@
          "required": true
        },
        {
-          "name": "appdata_dir",
+          "name": "data_dir",
          "type": "str",
-          "title": "Appdata-map",
+          "title": "Data directory",
          "default": "/opt/serverup/appdata",
          "required": true
        },
@ -78,9 +78,7 @@
          "config": {
            "placeholder": "sterk-wachtwoord"
          },
-          "advanced": true,
-          "generate": "auto",
-          "secret": true
+          "advanced": true
        },
        {
          "name": "app_url",
--- a/apps/byparr/files/compose.yaml
+++ b/apps/byparr/files/compose.yaml
@ -1,11 +0,0 @@
-services:
-  << service_name >>:
-    image: ghcr.io/thephaseless/byparr:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/config
-    ports:
-      - "<< port >>:8191"
-    restart: unless-stopped
--- a/apps/byparr/template.json
+++ b/apps/byparr/template.json
@ -1,59 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Byparr",
-    "description": "Nieuwer alternatief voor FlareSolverr, gebouwd op SeleniumBase. Spreekt dezelfde API, dus je kunt het er zo voor in de plaats zetten.",
-    "tags": [
-      "indexers",
-      "downloaden",
-      "proxy"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "byparr"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "downloaden"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "byparr",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Poort",
-          "default": 8119,
-          "required": true,
-          "description": "Byparr luistert intern op 8191, net als FlareSolverr"
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de instellingen van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    }
-  ]
-}
--- a/apps/caddy/files/compose.yaml
+++ b/apps/caddy/files/compose.yaml
@ -10,7 +10,7 @@ services:
      - TZ=<< timezone >>
    volumes:
      # Zet hier je Caddyfile neer; Caddy regelt de certificaten daarna zelf.
-      - << appdata_dir >>/<< service_name >>/Caddyfile:/etc/caddy/Caddyfile
+      - << data_dir >>/<< service_name >>/Caddyfile:/etc/caddy/Caddyfile
      - << service_name >>_data:/data
      - << service_name >>_config:/config
    restart: unless-stopped
--- a/apps/caddy/template.json
+++ b/apps/caddy/template.json
@ -40,9 +40,9 @@
          "help": "Caddy vraagt zelf certificaten aan bij Let's Encrypt en heeft daarvoor poort 80 nodig, ook als je alles via HTTPS aanbiedt."
        },
        {
-          "name": "appdata_dir",
+          "name": "data_dir",
          "type": "str",
-          "title": "Appdata-map",
+          "title": "Data directory",
          "default": "/opt/serverup/appdata",
          "required": true
        },
--- a/apps/cadvisor/files/compose.yaml
+++ b/apps/cadvisor/files/compose.yaml
@ -1,18 +0,0 @@
-services:
-  << service_name >>:
-    image: gcr.io/cadvisor/cadvisor:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - /:/rootfs:ro
-      - /var/run:/var/run:ro
-      - /sys:/sys:ro
-      - /var/lib/docker/:/var/lib/docker:ro
-      - /dev/disk/:/dev/disk:ro
-    ports:
-      - "<< port >>:8080"
-    devices:
-      - /dev/kmsg
-    privileged: true
-    restart: unless-stopped
--- a/apps/cadvisor/template.json
+++ b/apps/cadvisor/template.json
@ -1,59 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "cAdvisor",
-    "description": "Meet per container hoeveel processor, geheugen en netwerk er verbruikt wordt. Vult node-exporter aan, dat alleen de host als geheel ziet. Let op: Draait met verhoogde rechten omdat het bij de cgroups van elke container moet kunnen.",
-    "tags": [
-      "monitoring",
-      "metrics",
-      "containers",
-      "prometheus"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "cadvisor"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "monitoring",
-      "beheer"
-    ],
-    "depends_on": [
-      {
-        "app": "prometheus",
-        "reason": "Levert meetwaarden per container waar Prometheus ze komt ophalen."
-      }
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "cadvisor",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 8202,
-          "required": true,
-          "description": "Standaard 8080; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    }
-  ]
-}
--- a/apps/cal-com/files/compose.yaml
+++ b/apps/cal-com/files/compose.yaml
@ -1,26 +0,0 @@
-services:
-  << service_name >>:
-    image: calcom/cal.com:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-      - DATABASE_URL=postgresql://calcom:<< db_password >>@<< service_name >>-db:5432/calcom
-      - NEXTAUTH_SECRET=<< nextauth_secret >>
-      - CALENDSO_ENCRYPTION_KEY=<< encryption_key >>
-      - NEXT_PUBLIC_WEBAPP_URL=<< app_url >>
-      - NEXTAUTH_URL=<< app_url >>/api/auth
-    ports:
-      - "<< port >>:3000"
-    depends_on:
-      - << service_name >>-db
-    restart: unless-stopped
-  << service_name >>-db:
-    image: postgres:16-alpine
-    container_name: << service_name >>-db
-    environment:
-      - POSTGRES_DB=calcom
-      - POSTGRES_USER=calcom
-      - POSTGRES_PASSWORD=<< db_password >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>-db:/var/lib/postgresql/data
-    restart: unless-stopped
--- a/apps/cal-com/template.json
+++ b/apps/cal-com/template.json
@ -1,111 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Cal.com",
-    "description": "Laat anderen een afspraak in je agenda prikken, zonder heen-en-weer mailen over wanneer het uitkomt. Vervangt Calendly.",
-    "tags": [
-      "agenda",
-      "afspraken",
-      "planning"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "cal-com"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "productiviteit",
-      "zakelijk"
-    ],
-    "architectures": [
-      "amd64"
-    ],
-    "architecture_note": "Een of meer containerimages van deze app worden alleen voor AMD64 gepubliceerd. Deze app werkt daardoor niet op een Raspberry Pi."
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "calcom",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 8194,
-          "required": true,
-          "description": "Standaard 3000; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Instellingen",
-      "items": [
-        {
-          "name": "app_url",
-          "type": "str",
-          "title": "Publiek adres",
-          "default": "http://localhost:8194",
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Toegang",
-      "items": [
-        {
-          "name": "db_password",
-          "type": "str",
-          "title": "Databasewachtwoord",
-          "default": "",
-          "required": true,
-          "secret": true,
-          "generate": "auto",
-          "description": "Wordt automatisch ingevuld en in .env bewaard"
-        },
-        {
-          "name": "nextauth_secret",
-          "type": "str",
-          "title": "Sleutel voor de inlogsessies",
-          "default": "",
-          "required": true,
-          "secret": true,
-          "generate": "auto"
-        },
-        {
-          "name": "encryption_key",
-          "type": "str",
-          "title": "Sleutel voor gekoppelde agenda's",
-          "default": "",
-          "required": true,
-          "secret": true,
-          "generate": "auto",
-          "secret_format": "hex",
-          "secret_bytes": 16
-        }
-      ]
-    }
-  ]
-}
--- a/apps/calibre-web/files/compose.yaml
+++ b/apps/calibre-web/files/compose.yaml
@ -9,6 +9,6 @@ services:
      - PUID=<< puid >>
      - PGID=<< pgid >>
    volumes:
-      - << appdata_dir >>/<< service_name >>/config:/config
+      - << data_dir >>/<< service_name >>/config:/config
      - << books_dir >>:/books
    restart: unless-stopped
--- a/apps/calibre-web/template.json
+++ b/apps/calibre-web/template.json
@ -39,9 +39,9 @@
          "required": true
        },
        {
-          "name": "appdata_dir",
+          "name": "data_dir",
          "type": "str",
-          "title": "Appdata-map",
+          "title": "Data directory",
          "default": "/opt/serverup/appdata",
          "required": true
        },
--- a/apps/changedetection-io/files/compose.yaml
+++ b/apps/changedetection-io/files/compose.yaml
@ -9,5 +9,5 @@ services:
      - CHANGEDETECTION_PASSWORD=<< password >>
 <% endif %>
    volumes:
-      - << appdata_dir >>/<< service_name >>/data:/datastore
+      - << data_dir >>/<< service_name >>/data:/datastore
    restart: unless-stopped
--- a/apps/changedetection-io/template.json
+++ b/apps/changedetection-io/template.json
@ -39,9 +39,9 @@
          "required": true
        },
        {
-          "name": "appdata_dir",
+          "name": "data_dir",
          "type": "str",
-          "title": "Appdata-map",
+          "title": "Data directory",
          "default": "/opt/serverup/appdata",
          "required": true
        }
@ -59,9 +59,7 @@
          "description": "Optioneel wachtwoord om de webinterface te beveiligen. Laat leeg voor geen beveiliging.",
          "config": {
            "placeholder": "sterk-wachtwoord"
-          },
-          "generate": true,
-          "secret": true
+          }
        }
      ]
    }
--- a/apps/cleanuparr/files/compose.yaml
+++ b/apps/cleanuparr/files/compose.yaml
@ -1,12 +0,0 @@
-services:
-  << service_name >>:
-    image: ghcr.io/cleanuparr/cleanuparr:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/config
-      - << data_root >>:/data
-    ports:
-      - "<< port >>:11011"
-    restart: unless-stopped
--- a/apps/cleanuparr/template.json
+++ b/apps/cleanuparr/template.json
@ -1,67 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Cleanuparr",
-    "description": "Ruimt dode en kwaadaardige torrents op, en downloads waar niemand meer naar verwijst.",
-    "tags": [
-      "downloaden",
-      "onderhoud"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "cleanuparr"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "downloaden",
-      "beheer"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "cleanuparr",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 11011,
-          "required": true
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de instellingen van deze app"
-        },
-        {
-          "name": "data_root",
-          "type": "str",
-          "title": "Gedeelde datamap",
-          "default": "/mnt/data",
-          "required": true,
-          "description": "Eén map met je media én je downloads, gekoppeld als /data",
-          "help": "Media en downloads horen onder één map te staan, die als /data in elke container komt. Alleen dan kan een voltooide download met een hardlink naar je bibliotheek: geen kopie, geen dubbele opslag, en je torrent blijft seeden. Zet je ze op gescheiden paden, dan kopieert elke download opnieuw. Eronder: media/films, media/series, torrents/ en usenet/."
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    }
-  ]
-}
--- a/apps/cloudflared/files/compose.yaml
+++ b/apps/cloudflared/files/compose.yaml
@ -1,12 +0,0 @@
-# De tunnel belt zelf naar buiten naar Cloudflare, dus er hoeft geen poort open
-# in je router en je publieke IP blijft onzichtbaar. Wat er door de tunnel
-# bereikbaar is, bepaal je in het Cloudflare-dashboard bij de tunnel zelf.
-services:
-  << service_name >>:
-    image: cloudflare/cloudflared:latest
-    container_name: << service_name >>
-    command: tunnel --no-autoupdate run --token << tunnel_token >>
-    environment:
-      - TZ=<< timezone >>
-      - TUNNEL_METRICS=0.0.0.0:2000
-    restart: unless-stopped
--- a/apps/cloudflared/template.json
+++ b/apps/cloudflared/template.json
@ -1,31 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Cloudflare Tunnel",
-    "description": "Maak een app van buitenaf bereikbaar zonder een poort open te zetten. De tunnel belt zelf naar Cloudflare; je publieke IP blijft onzichtbaar en er komt niets ongevraagd binnen.",
-    "tags": ["tunnel", "proxy", "op afstand", "netwerk", "cloudflare"],
-    "icon": {"provider": "selfhst", "id": "cloudflare"},
-    "version": {"name": "latest"},
-    "categories": ["netwerk", "beveiliging"],
-    "architectures": ["amd64", "arm64"]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {"name": "service_name", "type": "str", "title": "Servicenaam",
-         "default": "cloudflared", "required": true},
-        {"name": "timezone", "type": "str", "title": "Tijdzone",
-         "default": "Europe/Amsterdam", "required": true}
-      ]
-    },
-    {
-      "title": "Toegang",
-      "items": [
-        {"name": "tunnel_token", "type": "str", "title": "Tunneltoken",
-         "default": "", "required": true, "secret": true, "eigen_invoer": true,
-         "help": "Maak in het Zero Trust-dashboard van Cloudflare een tunnel aan; bij 'Docker' staat het token in het voorbeeldcommando. Koppel daar ook welke app op welk adres uitkomt."}
-      ]
-    }
-  ]
-}
--- a/apps/code-server/files/compose.yaml
+++ b/apps/code-server/files/compose.yaml
@ -1,16 +0,0 @@
-services:
-  << service_name >>:
-    image: lscr.io/linuxserver/code-server:latest
-    container_name: << service_name >>
-    environment:
-      - PUID=<< puid >>
-      - PGID=<< pgid >>
-      - TZ=<< timezone >>
-      - UMASK=002
-      - PASSWORD=<< wachtwoord >>
-      - DEFAULT_WORKSPACE=/config/workspace
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/config
-    ports:
-      - "<< port >>:8443"
-    restart: unless-stopped
--- a/apps/code-server/template.json
+++ b/apps/code-server/template.json
@ -1,93 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "code-server",
-    "description": "Visual Studio Code in je browser, draaiend op de server. Handig om vanaf een tablet of een andere machine te werken.",
-    "tags": [
-      "editor",
-      "ontwikkeling",
-      "code"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "vscode"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "ontwikkeling"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "codeserver",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 8161,
-          "required": true,
-          "description": "Standaard 8443; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Gebruiker",
-      "items": [
-        {
-          "name": "puid",
-          "type": "int",
-          "title": "Gebruikers-ID (PUID)",
-          "default": 1000,
-          "required": true,
-          "description": "`id -u` op je server; bepaalt de eigenaar van de bestanden"
-        },
-        {
-          "name": "pgid",
-          "type": "int",
-          "title": "Groeps-ID (PGID)",
-          "default": 1000,
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Toegang",
-      "items": [
-        {
-          "name": "wachtwoord",
-          "type": "str",
-          "title": "Wachtwoord voor de editor",
-          "default": "",
-          "required": true,
-          "secret": true,
-          "eigen_invoer": true
-        }
-      ]
-    }
-  ]
-}
--- a/apps/collabora/files/compose.yaml
+++ b/apps/collabora/files/compose.yaml
@ -1,15 +0,0 @@
-services:
-  << service_name >>:
-    image: collabora/code:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-      - aliasgroup1=<< nextcloud_url >>
-      - extra_params=--o:ssl.enable=false --o:ssl.termination=true
-      - username=<< admin_user >>
-      - password=<< admin_password >>
-    ports:
-      - "<< port >>:9980"
-    cap_add:
-      - MKNOD
-    restart: unless-stopped
--- a/apps/collabora/template.json
+++ b/apps/collabora/template.json
@ -1,97 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Collabora Online",
-    "description": "Documenten, spreadsheets en presentaties bewerken in je browser, samen met anderen. Koppelt aan Nextcloud. Vervangt Google Docs en Microsoft Office.",
-    "tags": [
-      "documenten",
-      "kantoor",
-      "samenwerken"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "collabora"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "documenten",
-      "productiviteit"
-    ],
-    "depends_on": [
-      {
-        "app": "nextcloud-aio",
-        "reason": "Collabora is de bewerker; de bestanden en de gebruikers komen uit Nextcloud. Los draaiend heb je niets om te openen."
-      }
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "collabora",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 8201,
-          "required": true,
-          "description": "Standaard 9980; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Instellingen",
-      "items": [
-        {
-          "name": "nextcloud_url",
-          "type": "str",
-          "title": "Adres van Nextcloud",
-          "default": "https://cloud.example.com",
-          "required": true,
-          "connect": {
-            "app": "nextcloud-aio",
-            "scheme": "https",
-            "port": 443
-          },
-          "help": "Collabora accepteert alleen verzoeken van dit adres. Klopt het niet, dan blijft de bewerker leeg."
-        },
-        {
-          "name": "admin_user",
-          "type": "str",
-          "title": "Beheerdersnaam",
-          "default": "admin",
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Toegang",
-      "items": [
-        {
-          "name": "admin_password",
-          "type": "str",
-          "title": "Beheerderswachtwoord",
-          "default": "",
-          "required": true,
-          "secret": true,
-          "eigen_invoer": true
-        }
-      ]
-    }
-  ]
-}
--- a/apps/comfyui/files/compose.yaml
+++ b/apps/comfyui/files/compose.yaml
@ -1,12 +0,0 @@
-services:
-  << service_name >>:
-    image: ghcr.io/ai-dock/comfyui:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/opt/ComfyUI/models
-      - << appdata_dir >>/<< service_name >>-output:/opt/ComfyUI/output
-    ports:
-      - "<< port >>:8188"
-    restart: unless-stopped
--- a/apps/comfyui/template.json
+++ b/apps/comfyui/template.json
@ -1,63 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "ComfyUI",
-    "description": "Beeldgeneratie met modellen die op je eigen machine draaien, opgebouwd als een schema dat je zelf aan elkaar klikt. Let op: Zonder videokaart die doorgegeven wordt aan de container draait dit op de processor, en dan duurt één afbeelding minuten in plaats van seconden.",
-    "tags": [
-      "ai",
-      "beeld",
-      "generatie"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "comfyui"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "ai"
-    ],
-    "architectures": [
-      "amd64"
-    ],
-    "architecture_note": "Een of meer containerimages van deze app worden alleen voor AMD64 gepubliceerd. Deze app werkt daardoor niet op een Raspberry Pi."
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "comfyui",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 8210,
-          "required": true,
-          "description": "Standaard 8188; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    }
-  ]
-}
--- a/apps/configarr/files/compose.yaml
+++ b/apps/configarr/files/compose.yaml
@ -1,9 +0,0 @@
-services:
-  << service_name >>:
-    image: ghcr.io/raydak-labs/configarr:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/app/config
-    restart: unless-stopped
--- a/apps/configarr/template.json
+++ b/apps/configarr/template.json
@ -1,51 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Configarr",
-    "description": "Zelfde idee als Recyclarr, maar met eigen aanpassingen bovenop de TRaSH-gidsen.",
-    "tags": [
-      "media",
-      "configuratie"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "configarr"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "media",
-      "beheer"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "configarr",
-          "required": true
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de instellingen van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    }
-  ]
-}
--- a/apps/consul/files/compose.yaml
+++ b/apps/consul/files/compose.yaml
@ -1,33 +0,0 @@
-services:
-  << service_name >>:
-    image: hashicorp/consul:latest
-    container_name: << service_name >>
-    command:
-      - agent
-      - -server
-      - -bootstrap-expect=1
-      - -ui
-      - -client=0.0.0.0
-      - -advertise=<< advertise_ip >>
-      - -http-port=<< port_http >>
-      - -server-port=<< port_server >>
-      - -serf-lan-port=<< port_lan >>
-      - -serf-wan-port=<< port_wan >>
-      - -dns-port=<< port_dns >>
-      - -node=<< service_name >>
-    environment:
-      - CONSUL_BIND_INTERFACE=eth0
-    ports:
-      - "<< port_http >>:<< port_http >>"
-      - "<< port_server >>:<< port_server >>"
-      - "<< port_lan >>:<< port_lan >>/tcp"
-      - "<< port_lan >>:<< port_lan >>/udp"
-      - "<< port_wan >>:<< port_wan >>/tcp"
-      - "<< port_wan >>:<< port_wan >>/udp"
-      - "<< port_dns >>:<< port_dns >>/tcp"
-      - "<< port_dns >>:<< port_dns >>/udp"
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/consul/data
-    cap_add:
-      - IPC_LOCK
-    restart: unless-stopped
--- a/apps/consul/template.json
+++ b/apps/consul/template.json
@ -1,33 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Consul",
-    "description": "Service discovery, DNS en healthchecks met een webinterface. Deze eenvoudige single-serveropzet is geschikt voor een thuislab; gebruik voor productie een oneven cluster van meerdere servers.",
-    "tags": ["service discovery", "dns", "healthchecks", "hashicorp"],
-    "icon": {"provider": "selfhst", "id": "consul"},
-    "version": {"name": "latest"},
-    "categories": ["netwerk", "beheer", "ontwikkeling"],
-    "architectures": ["amd64", "arm64"],
-    "architecture_note": "HashiCorp publiceert officiële Consul-images voor AMD64 en ARM64."
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {"name": "service_name", "type": "str", "title": "Servicenaam", "default": "consul", "required": true},
-        {"name": "appdata_dir", "type": "str", "title": "Appdata-map", "default": "/opt/serverup/appdata", "required": true},
-        {"name": "advertise_ip", "type": "str", "title": "LAN-IP van deze server", "default": "", "required": true, "description": "Het bereikbare hostadres dat Consul aan agents doorgeeft, bijvoorbeeld 192.168.1.10."}
-      ]
-    },
-    {
-      "title": "Poorten",
-      "items": [
-        {"name": "port_http", "type": "int", "title": "HTTP API en webinterface", "default": 8500, "required": true},
-        {"name": "port_server", "type": "int", "title": "Server-RPC", "default": 8300, "required": true},
-        {"name": "port_lan", "type": "int", "title": "LAN-gossip", "default": 8301, "required": true},
-        {"name": "port_wan", "type": "int", "title": "WAN-gossip", "default": 8302, "required": true},
-        {"name": "port_dns", "type": "int", "title": "DNS", "default": 8600, "required": true}
-      ]
-    }
-  ]
-}
--- a/apps/convertx/files/compose.yaml
+++ b/apps/convertx/files/compose.yaml
@ -1,13 +0,0 @@
-services:
-  << service_name >>:
-    image: ghcr.io/c4illin/convertx:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-      - JWT_SECRET=<< jwt_secret >>
-      - ACCOUNT_REGISTRATION=false
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/app/data
-    ports:
-      - "<< port >>:3000"
-    restart: unless-stopped
--- a/apps/convertx/template.json
+++ b/apps/convertx/template.json
@ -1,73 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "ConvertX",
-    "description": "Zet bestanden om naar een ander formaat in je browser: afbeeldingen, documenten, video en geluid, zonder uploaddienst van derden.",
-    "tags": [
-      "conversie",
-      "bestanden",
-      "gereedschap"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "convertx"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "productiviteit"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "convertx",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 8176,
-          "required": true,
-          "description": "Standaard 3000; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Toegang",
-      "items": [
-        {
-          "name": "jwt_secret",
-          "type": "str",
-          "title": "JWT-sleutel",
-          "default": "",
-          "required": true,
-          "secret": true,
-          "generate": "auto"
-        }
-      ]
-    }
-  ]
-}
--- a/apps/crafty/files/compose.yaml
+++ b/apps/crafty/files/compose.yaml
@ -1,14 +0,0 @@
-services:
-  << service_name >>:
-    image: registry.gitlab.com/crafty-controller/crafty-4:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/crafty/app/config
-      - << appdata_dir >>/<< service_name >>-servers:/crafty/servers
-      - << appdata_dir >>/<< service_name >>-backups:/crafty/backups
-    ports:
-      - "<< port >>:8443"
-      - "<< port_spel >>:25565"
-    restart: unless-stopped
--- a/apps/crafty/template.json
+++ b/apps/crafty/template.json
@ -1,68 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Crafty Controller",
-    "description": "Beheerpaneel voor gameservers: meerdere Minecraft-werelden naast elkaar, met back-ups, planning en rechten per gebruiker.",
-    "tags": [
-      "spellen",
-      "minecraft",
-      "gameserver"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "crafty"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "spellen",
-      "beheer"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "crafty",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 8206,
-          "required": true,
-          "description": "Standaard 8443; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "port_spel",
-          "type": "int",
-          "title": "Speelpoort",
-          "default": 25566,
-          "required": true,
-          "description": "Voor de eerste server; volgende krijgen 25566 en verder"
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    }
-  ]
-}
--- a/apps/cross-seed/files/compose.yaml
+++ b/apps/cross-seed/files/compose.yaml
@ -1,13 +0,0 @@
-services:
-  << service_name >>:
-    image: ghcr.io/cross-seed/cross-seed:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/config
-      - << data_root >>:/data
-    command: daemon
-    ports:
-      - "<< port >>:2468"
-    restart: unless-stopped
--- a/apps/cross-seed/template.json
+++ b/apps/cross-seed/template.json
@ -1,66 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "cross-seed",
-    "description": "Zoekt dezelfde bestanden bij andere trackers, zodat je één download op meerdere plekken kunt seeden.",
-    "tags": [
-      "torrents",
-      "downloaden"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "cross-seed"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "downloaden"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "crossseed",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Poort",
-          "default": 2468,
-          "required": true
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de instellingen van deze app"
-        },
-        {
-          "name": "data_root",
-          "type": "str",
-          "title": "Gedeelde datamap",
-          "default": "/mnt/data",
-          "required": true,
-          "description": "Eén map met je media én je downloads, gekoppeld als /data",
-          "help": "Media en downloads horen onder één map te staan, die als /data in elke container komt. Alleen dan kan een voltooide download met een hardlink naar je bibliotheek: geen kopie, geen dubbele opslag, en je torrent blijft seeden. Zet je ze op gescheiden paden, dan kopieert elke download opnieuw. Eronder: media/films, media/series, torrents/ en usenet/."
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    }
-  ]
-}
--- a/apps/crowdsec/files/compose.yaml
+++ b/apps/crowdsec/files/compose.yaml
@ -1,14 +0,0 @@
-services:
-  << service_name >>:
-    image: crowdsecurity/crowdsec:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-      - COLLECTIONS=crowdsecurity/linux crowdsecurity/nginx
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/etc/crowdsec
-      - << appdata_dir >>/<< service_name >>-data:/var/lib/crowdsec/data
-      - << log_dir >>:/var/log/host:ro
-    ports:
-      - "<< port >>:8080"
-    restart: unless-stopped
--- a/apps/crowdsec/template.json
+++ b/apps/crowdsec/template.json
@ -1,72 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "CrowdSec",
-    "description": "Leest je logbestanden mee en blokkeert aanvallers, met een blocklijst die door alle gebruikers samen wordt opgebouwd.",
-    "tags": [
-      "beveiliging",
-      "firewall",
-      "logs"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "crowdsec"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "beveiliging"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "crowdsec",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "API-poort",
-          "default": 8130,
-          "required": true,
-          "description": "Standaard 8080; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Instellingen",
-      "items": [
-        {
-          "name": "log_dir",
-          "type": "str",
-          "title": "Logmap van de host",
-          "default": "/var/log",
-          "required": true,
-          "description": "Wordt alleen-lezen gekoppeld; hier leest CrowdSec in mee"
-        }
-      ]
-    }
-  ]
-}
--- a/apps/cryptpad/files/compose.yaml
+++ b/apps/cryptpad/files/compose.yaml
@ -1,15 +0,0 @@
-services:
-  << service_name >>:
-    image: cryptpad/cryptpad:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-      - CPAD_MAIN_DOMAIN=<< hoofddomein >>
-      - CPAD_SANDBOX_DOMAIN=<< sandbox_domein >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/cryptpad/data
-      - << appdata_dir >>/<< service_name >>-blob:/cryptpad/blob
-      - << appdata_dir >>/<< service_name >>-block:/cryptpad/block
-    ports:
-      - "<< port >>:3000"
-    restart: unless-stopped
--- a/apps/cryptpad/template.json
+++ b/apps/cryptpad/template.json
@ -1,82 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "CryptPad",
-    "description": "Documenten, spreadsheets en presentaties die in je browser versleuteld worden. De server ziet alleen onleesbare blokken. Vervangt Google Docs.",
-    "tags": [
-      "documenten",
-      "samenwerken",
-      "privacy",
-      "versleuteling"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "cryptpad"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "documenten",
-      "productiviteit"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "cryptpad",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 8190,
-          "required": true,
-          "description": "Standaard 3000; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Instellingen",
-      "items": [
-        {
-          "name": "hoofddomein",
-          "type": "str",
-          "title": "Hoofddomein",
-          "default": "https://pad.example.com",
-          "required": true
-        },
-        {
-          "name": "sandbox_domein",
-          "type": "str",
-          "title": "Sandbox-domein",
-          "default": "https://pad-sandbox.example.com",
-          "required": true,
-          "description": "Moet een ánder domein zijn dan het hoofddomein",
-          "help": "CryptPad zet de documentbewerker in een aparte oorsprong, zodat een lek in de bewerker niet bij je sleutels kan. Twee keer hetzelfde domein invullen haalt die scheiding weg."
-        }
-      ]
-    }
-  ]
-}
--- a/apps/dashy/files/compose.yaml
+++ b/apps/dashy/files/compose.yaml
@ -1,11 +0,0 @@
-services:
-  << service_name >>:
-    image: lissy93/dashy:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/app/user-data
-    ports:
-      - "<< port >>:8080"
-    restart: unless-stopped
--- a/apps/dashy/template.json
+++ b/apps/dashy/template.json
@ -1,59 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Dashy",
-    "description": "Startpagina met statuscontrole per dienst, thema's en widgets. Alles staat in één configuratiebestand dat je ook met de hand kunt bijwerken.",
-    "tags": [
-      "dashboard",
-      "startpagina",
-      "overzicht"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "dashy"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "beheer"
-    ]
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "dashy",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 8252,
-          "required": true,
-          "description": "Standaard 8080; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    }
-  ]
-}
--- a/apps/dawarich/files/compose.yaml
+++ b/apps/dawarich/files/compose.yaml
@ -1,40 +0,0 @@
-services:
-  << service_name >>:
-    image: freikin/dawarich:latest
-    container_name: << service_name >>
-    environment:
-      - RAILS_ENV=development
-      - DATABASE_HOST=<< service_name >>-db
-      - DATABASE_USERNAME=dawarich
-      - DATABASE_PASSWORD=<< db_password >>
-      - DATABASE_NAME=dawarich
-      - REDIS_URL=redis://<< service_name >>-redis:6379
-      - APPLICATION_HOSTS=<< app_hosts >>
-      - TIME_ZONE=<< timezone >>
-      - SECRET_KEY_BASE=<< secret_key_base >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/var/app/public
-    command: ["web-entrypoint.sh", "bin/rails", "server", "-p", "3000", "-b", "::"]
-    ports:
-      - "<< port >>:3000"
-    depends_on:
-      - << service_name >>-db
-      - << service_name >>-redis
-    restart: unless-stopped
-  << service_name >>-db:
-    image: postgis/postgis:16-3.4-alpine
-    container_name: << service_name >>-db
-    environment:
-      - POSTGRES_DB=dawarich
-      - POSTGRES_USER=dawarich
-      - POSTGRES_PASSWORD=<< db_password >>
-    volumes:
-      - << appdata_dir >>/<< service_name >>-db:/var/lib/postgresql/data
-    restart: unless-stopped
-  << service_name >>-redis:
-    image: valkey/valkey:8-alpine
-    container_name: << service_name >>-redis
-    command: valkey-server --save 60 1
-    volumes:
-      - << appdata_dir >>/<< service_name >>-redis:/data
-    restart: unless-stopped
--- a/apps/dawarich/template.json
+++ b/apps/dawarich/template.json
@ -1,101 +0,0 @@
-{
-  "kind": "compose",
-  "metadata": {
-    "name": "Dawarich",
-    "description": "Je eigen locatiegeschiedenis, als vervanging van Google Maps Timeline. Importeert je oude Google-export.",
-    "tags": [
-      "locatie",
-      "kaart",
-      "privacy"
-    ],
-    "icon": {
-      "provider": "selfhst",
-      "id": "dawarich"
-    },
-    "version": {
-      "name": "latest"
-    },
-    "categories": [
-      "gezin",
-      "beveiliging"
-    ],
-    "architectures": [
-      "amd64"
-    ],
-    "architecture_note": "Een of meer containerimages van deze app worden alleen voor AMD64 gepubliceerd. Deze app werkt daardoor niet op een Raspberry Pi."
-  },
-  "variables": [
-    {
-      "title": "Algemeen",
-      "items": [
-        {
-          "name": "service_name",
-          "type": "str",
-          "title": "Servicenaam",
-          "default": "dawarich",
-          "required": true
-        },
-        {
-          "name": "port",
-          "type": "int",
-          "title": "Webinterface",
-          "default": 8152,
-          "required": true,
-          "description": "Standaard 3000; hier verplaatst omdat die poort al bezet is"
-        },
-        {
-          "name": "appdata_dir",
-          "type": "str",
-          "title": "Appdata-map",
-          "default": "/opt/serverup/appdata",
-          "required": true,
-          "description": "Basismap voor de gegevens van deze app"
-        },
-        {
-          "name": "timezone",
-          "type": "str",
-          "title": "Tijdzone",
-          "default": "Europe/Amsterdam",
-          "required": true
-        }
-      ]
-    },
-    {
-      "title": "Instellingen",
-      "items": [
-        {
-          "name": "app_hosts",
-          "type": "str",
-          "title": "Toegestane adressen",
-          "default": "localhost",
-          "required": true,
-          "description": "Komma-gescheiden; Rails weigert verzoeken van andere namen"
-        }
-      ]
-    },
-    {
-      "title": "Toegang",
-      "items": [
-        {
-          "name": "db_password",
-          "type": "str",
-          "title": "Databasewachtwoord",
-          "default": "",
-          "required": true,
-          "secret": true,
-          "generate": "auto",
-          "description": "Wordt automatisch ingevuld en in .env bewaard"
-        },
-        {
-          "name": "secret_key_base",
-          "type": "str",
-          "title": "Rails-sleutel",
-          "default": "",
-          "required": true,
-          "secret": true,
-          "generate": "auto"
-        }
-      ]
-    }
-  ]
-}
--- a/apps/decluttarr/files/compose.yaml
+++ b/apps/decluttarr/files/compose.yaml
@ -1,14 +0,0 @@
-services:
-  << service_name >>:
-    image: ghcr.io/manimatter/decluttarr:latest
-    container_name: << service_name >>
-    environment:
-      - TZ=<< timezone >>
-      - SONARR_URL=<< sonarr_url >>
-      - SONARR_KEY=<< sonarr_apikey >>
-      - RADARR_URL=<< radarr_url >>
-      - RADARR_KEY=<< radarr_apikey >>
-      - LOG_LEVEL=INFO
-    volumes:
-      - << appdata_dir >>/<< service_name >>:/config
-    restart: unless-stopped
--- a/Show more
+++ b/Show more