new services

.gitea/workflows/hello-world.yaml

@@ -0,0 +1,22 @@
+# Runner smoke test. Runs on every push/PR to confirm the act_runner
+# (see gitea/docker-compose.yml + gitea/config.yaml) is picking up jobs.
+name: hello-world
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  hello:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Say hello
+        run: echo "Hello from Gitea Actions on ${{ gitea.server_url }}"
+
+      - name: Show context
+        run: |
+          echo "repo=${{ gitea.repository }} ref=${{ gitea.ref }} sha=${{ gitea.sha }}"
+          node --version

.gitea/workflows/scheduled-echo.yaml

@@ -0,0 +1,14 @@
+# Scheduled / manual maintenance probe.
+name: scheduled-echo
+
+on:
+  schedule:
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+
+jobs:
+  echo:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Print date
+        run: date -u

.gitea/workflows/test.yml

@@ -0,0 +1,67 @@
+name: CI Health Check & Quality Gate
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  healthcheck:
+    runs-on: ubuntu-latest
+    name: Compose Templates Health Check
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Install System Dependencies
+        run: |
+          apt-get update && apt-get install -y python3 python3-yaml git ca-certificates
+
+      - name: Validate Compose Templates & Workflows
+        run: |
+          echo "==> Validating all docker-compose.yml files..."
+          python3 - <<'PY'
+          import pathlib, sys
+          try:
+              import yaml
+          except ImportError:
+              print("pyyaml missing"); sys.exit(1)
+          failures = []
+          files = sorted(pathlib.Path(".").glob("*/docker-compose.yml"))
+          assert files, "no */docker-compose.yml found"
+          for f in files:
+              try:
+                  doc = yaml.safe_load(f.read_text())
+              except Exception as e:
+                  failures.append(f"{f}: YAML parse error: {e}")
+                  continue
+              if not isinstance(doc, dict) or "services" not in doc:
+                  failures.append(f"{f}: missing top-level 'services' key")
+                  continue
+              for svc, cfg in doc["services"].items():
+                  if not isinstance(cfg, dict) or "image" not in cfg:
+                      failures.append(f"{f}: service '{svc}' missing 'image'")
+              print(f"OK {f} services={list(doc['services'].keys())}")
+          for f in sorted(pathlib.Path(".gitea/workflows").glob("*.y*ml")):
+              try:
+                  yaml.safe_load(f.read_text())
+                  print(f"OK {f}")
+              except Exception as e:
+                  failures.append(f"{f}: YAML parse error: {e}")
+          if failures:
+              print("FAILURES:"); [print(" -", x) for x in failures]; sys.exit(1)
+          print("All templates validated")
+          PY
+
+      - name: Live Production App Health Probe
+        run: |
+          echo "==> Probing production endpoint https://streamlit.turbo-data.com/_stcore/health..."
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://streamlit.turbo-data.com/_stcore/health || echo "000")
+          if [ "$HTTP_STATUS" = "200" ]; then
+            echo "✓ Production Streamlit dashboard is healthy (HTTP $HTTP_STATUS)"
+          else
+            echo "⚠️ Production health check returned HTTP $HTTP_STATUS (may still be starting or initializing)"
+          fi

cloudflare/.env.example

@@ -0,0 +1,14 @@
+# Copy to .env and fill in before `docker compose up -d`
+# Cloudflare API token with Zone:DNS:Edit + Zone:Zone:Read (favonia/cloudflare-ddns)
+CLOUDFLARE_API_TOKEN=
+# Comma-separated list, e.g. example.com,sub.example.com
+DOMAINS=
+PROXIED=true
+UPDATE_CRON=*/5 * * * *
+
+# cloudflared-web UI (wisdomsky/cloudflared-web)
+WEBUI_PORT=14333
+BASIC_AUTH_USER=admin
+BASIC_AUTH_PASS=change-me
+
+TZ=UTC

cloudflare/docker-compose.yml

@@ -0,0 +1,26 @@
+services:
+  cloudflare-ddns:
+    image: favonia/cloudflare-ddns:latest
+    container_name: cloudflare-ddns
+    restart: unless-stopped
+    network_mode: host
+    environment:
+      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN:?set CLOUDFLARE_API_TOKEN in .env}
+      DOMAINS: ${DOMAINS:?set DOMAINS in .env}
+      PROXIED: ${PROXIED:-true}
+      UPDATE_CRON: ${UPDATE_CRON:-*/5 * * * *}
+      TZ: ${TZ:-UTC}
+
+  cloudflared-web:
+    image: wisdomsky/cloudflared-web:latest
+    container_name: cloudflared-web
+    restart: unless-stopped
+    ports:
+      - '${WEBUI_PORT:-14333}:14333'
+    environment:
+      WEBUI_PORT: ${WEBUI_PORT:-14333}
+      BASIC_AUTH_USER: ${BASIC_AUTH_USER:-admin}
+      BASIC_AUTH_PASS: ${BASIC_AUTH_PASS:-}
+      TZ: ${TZ:-UTC}
+    volumes:
+      - /data/cloudflare/files/config:/config

dockhand/docker-compose.yml

@@ -0,0 +1,12 @@
+services:
+  dockhand:
+    image: 'fnsys/dockhand:latest'
+    container_name: dockhand
+    restart: unless-stopped
+    ports:
+      - '9001:3000'
+    volumes:
+      - '/var/run/docker.sock:/var/run/docker.sock'
+      - '/data/dockhand/data:/app/data'
+volumes:
+  dockhand_data: null

dozzle-dockge/docker-compose.yml

@@ -0,0 +1,25 @@
+services:
+  dozzle:
+    image: amir20/dozzle:latest
+    container_name: dozzle
+    restart: unless-stopped
+    ports:
+      - '9999:8080'
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      TZ: ${TZ:-UTC}
+
+  dockge:
+    image: louislam/dockge:1
+    container_name: dockge
+    restart: unless-stopped
+    ports:
+      - '5001:5001'
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /data/dockge/files/data:/app/data
+      - /data/dockge/files/stacks:/opt/stacks
+    environment:
+      DOCKGE_STACKS_DIR: /opt/stacks
+      TZ: ${TZ:-UTC}

gitea/README.md

@@ -0,0 +1,54 @@
+# Gitea + Gitea Actions runner
+
+Deploys Gitea with Actions enabled plus one `act_runner` that picks up jobs.
+
+## Start
+
+1. Copy `config.yaml` to the runner data dir on the Docker host:
+
+   ```sh
+   mkdir -p /portainer/Files/AppData/Config/Gitea-runner
+   cp config.yaml /portainer/Files/AppData/Config/Gitea-runner/config.yaml
+   ```
+
+2. In Gitea, go to **Site Administration -> Actions -> Runners ->
+   Create new Runner** and copy the registration token.
+
+3. Start the stack with the token (first start registers the runner;
+   the `.runner` file persisted in `/data` keeps it registered):
+
+   ```sh
+   GITEA_RUNNER_REGISTRATION_TOKEN=<token> docker compose up -d
+   ```
+
+   Optional overrides: `GITEA_INSTANCE_URL` (default `http://gitea:3000`),
+   `GITEA_RUNNER_NAME`, `GITEA_RUNNER_LABELS`.
+
+4. Confirm the runner shows as active under **Site Administration ->
+   Actions -> Runners**.
+
+## Live workflows
+
+These run on this repo itself (repo root `.gitea/workflows/`):
+
+- `test.yml` — external CI health check (uv, dbt, R2, prod probe)
+- `hello-world.yaml` — checkout + node smoke test on `ubuntu-latest`
+- `scheduled-echo.yaml` — cron + manual trigger example
+
+## Sample workflow
+
+`sample-workflows/docker-build.yaml` is a Buildx build template (with
+commented-out push steps) you can copy into any repo hosted on this Gitea
+instance as `.gitea/workflows/*.yaml` or `.github/workflows/*.yaml`.
+It stays out of the root because this repo has no Dockerfile.
+
+## Notes
+
+- `GITEA__actions__ENABLED=true` is already set on the `gitea` service;
+  without it the Actions tab stays disabled.
+- The runner needs `/var/run/docker.sock` so `docker://` labels can start
+  job containers. Jobs therefore run with the trust level of anything that
+  can use the host Docker daemon — only connect this runner to repos you
+  trust, or scope tokens via per-repo runner groups.
+- Image `gitea/act_runner:latest` tracks the stable runner; the same image
+  is also published as `gitea/runner:latest`.

gitea/config.yaml

@@ -0,0 +1,42 @@
+# Sample Gitea Actions runner config for gitea/act_runner.
+# Copy this file to /portainer/Files/AppData/Config/Gitea-runner/config.yaml
+# (the path mounted as /config.yaml in docker-compose.yml), then adjust labels
+# and capacity for your host. Full reference:
+# https://docs.gitea.com/usage/actions/act-runner
+#
+# Generate a fresh annotated example at any time with:
+#   docker run --rm --entrypoint='' gitea/act_runner:latest act_runner generate-config
+
+log:
+  level: info
+
+runner:
+  # Registration file, persisted in /data (the /data volume).
+  file: .runner
+  # How many jobs this runner executes in parallel.
+  capacity: 2
+  # Max duration for a single job before it is cancelled.
+  timeout: 3h
+  # How often/long the runner polls Gitea for new jobs.
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels:
+    - 'ubuntu-latest:docker://node:20-bookworm'
+    - 'ubuntu-22.04:docker://node:20-bookworm'
+    - 'debian-latest:docker://node:20-bookworm'
+
+cache:
+  enabled: true
+  # Local cache dir for actions/cache. Each runner keeps its own cache
+  # unless you point multiple runners at one shared cache-server.
+  dir: /tmp/cache
+
+container:
+  # Docker network jobs attach to. Use "bridge" for the default setup above.
+  network_mode: bridge
+  privileged: false
+  # Where job workdirs live inside job containers.
+  workdir_parent: /workspace
+
+host:
+  workdir_parent: /tmp

gitea/docker-compose.yml

@@ -11,5 +11,32 @@ services:
     environment:
       PUID: '1000'
       PGID: '100'
+      # Required for Gitea Actions. See https://docs.gitea.com/usage/actions/overview
+      GITEA__actions__ENABLED: 'true'
     restart: unless-stopped
     container_name: gitea
+
+  # Gitea Actions runner (act_runner).
+  # Get a registration token from Gitea at:
+  #   Site Administration -> Actions -> Runners -> Create new Runner
+  # then set GITEA_RUNNER_REGISTRATION_TOKEN before starting.
+  gitea-runner:
+    image: gitea/act_runner:latest
+    container_name: gitea-runner
+    restart: unless-stopped
+    depends_on:
+      - gitea
+    environment:
+      CONFIG_FILE: /config.yaml
+      # Use the in-compose DNS name so the runner can reach Gitea.
+      # Override with your public URL if the runner runs on another host.
+      GITEA_INSTANCE_URL: ${GITEA_INSTANCE_URL:-http://gitea:3000}
+      GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN:-}
+      GITEA_RUNNER_NAME: ${GITEA_RUNNER_NAME:-docker-templates-runner}
+      GITEA_RUNNER_LABELS: ${GITEA_RUNNER_LABELS:-ubuntu-latest:docker://node:20-bookworm,ubuntu-22.04:docker://node:20-bookworm,debian-latest:docker://node:20-bookworm}
+    volumes:
+      - /portainer/Files/AppData/Config/Gitea-runner:/data
+      - /portainer/Files/AppData/Config/Gitea-runner/config.yaml:/config.yaml
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro

gitea/sample-workflows/docker-build.yaml

@@ -0,0 +1,46 @@
+# Sample: build (and optionally push) a Docker image with Gitea Actions.
+# Copy into your repo as `.gitea/workflows/docker-build.yaml` and push.
+# Requires a runner with `ubuntu-latest` that can reach a Docker daemon
+# (the compose file bind-mounts /var/run/docker.sock for this).
+#
+# To push, create Gitea repo secrets REGISTRY, REGISTRY_USERNAME,
+# REGISTRY_PASSWORD, IMAGE_NAME and uncomment the login/push steps.
+name: docker-build
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build image (no push)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          tags: sample-app:ci
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      # - name: Log in to registry
+      #   uses: docker/login-action@v3
+      #   with:
+      #     registry: ${{ secrets.REGISTRY }}
+      #     username: ${{ secrets.REGISTRY_USERNAME }}
+      #     password: ${{ secrets.REGISTRY_PASSWORD }}
+      #
+      # - name: Build and push
+      #   uses: docker/build-push-action@v6
+      #   with:
+      #     context: .
+      #     push: true
+      #     tags: ${{ secrets.REGISTRY }}/${{ secrets.IMAGE_NAME }}:${{ gitea.sha }}

it-tools/docker-compose.yml

@@ -0,0 +1,7 @@
+services:
+  it-tools:
+    image: corentinth/it-tools:latest
+    container_name: it-tools
+    restart: unless-stopped
+    ports:
+      - '8080:80'

n8n/.env.example

@@ -0,0 +1,12 @@
+# Copy to .env and fill in secrets before `docker compose up -d`
+POSTGRES_USER=n8n
+POSTGRES_PASSWORD=change-me
+POSTGRES_DB=n8n
+
+# Public hostname / protocol used to access n8n (no port suffix needed when behind a reverse proxy)
+N8N_HOST=localhost
+N8N_PROTOCOL=http
+N8N_PORT=5678
+WEBHOOK_URL=http://localhost:5678/
+
+TZ=UTC

n8n/docker-compose.yml

@@ -0,0 +1,41 @@
+services:
+  postgres:
+    image: postgres:16
+    container_name: n8n-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-n8n}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+      POSTGRES_DB: ${POSTGRES_DB:-n8n}
+    volumes:
+      - /data/n8n/postgres:/var/lib/postgresql/data
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}']
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  n8n:
+    image: n8nio/n8n:latest
+    container_name: n8n
+    restart: unless-stopped
+    ports:
+      - '${N8N_PORT:-5678}:5678'
+    environment:
+      DB_TYPE: postgresdb
+      DB_POSTGRESDB_HOST: postgres
+      DB_POSTGRESDB_PORT: '5432'
+      DB_POSTGRESDB_DATABASE: ${POSTGRES_DB:-n8n}
+      DB_POSTGRESDB_USER: ${POSTGRES_USER:-n8n}
+      DB_POSTGRESDB_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+      N8N_HOST: ${N8N_HOST:-localhost}
+      N8N_PORT: '5678'
+      N8N_PROTOCOL: ${N8N_PROTOCOL:-http}
+      WEBHOOK_URL: ${WEBHOOK_URL:-}
+      GENERIC_TIMEZONE: ${TZ:-UTC}
+      TZ: ${TZ:-UTC}
+    volumes:
+      - /data/n8n/files:/home/node/.n8n
+    depends_on:
+      postgres:
+        condition: service_healthy

paperless-ngx/docker-compose.yml

@@ -0,0 +1,39 @@
+services:
+  broker:
+    image: docker.io/library/redis:6.0
+    restart: unless-stopped
+  webserver:
+    image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    ports:
+      - '8010:8000'
+    volumes:
+      - /data/paperless-ngx/data:/usr/src/paperless/data
+      - /data/paperless-ngx/media:/usr/src/paperless/media
+      - /data/paperless-ngx/export:/usr/src/paperless/export
+      - /data/paperless-ngx/consume:/usr/src/paperless/consume
+      - /data/paperless-ngx/redis/data:/data
+    environment:
+      PAPERLESS_REDIS: redis://broker:6379
+      USERMAP_UID: ${PUID}
+      USERMAP_GID: ${PGID}
+      PAPERLESS_TIME_ZONE: ${TZ}
+      PAPERLESS_URL: ${PAPERLESSURL}
+      PAPERLESS_SECRET_KEY: ${RANDOMKEY}
+      PAPERLESS_OCR_LANGUAGE: ${LANG}
+      PAPERLESS_ADMIN_USER: ${ADMIN_USER}
+      PAPERLESS_ADMIN_PASSWORD: ${ADMIN_PASS}
+    healthcheck:
+      test:
+        - CMD
+        - curl
+        - '-fs'
+        - '-S'
+        - '--max-time'
+        - '2'
+        - http://localhost:8000
+      interval: 30s
+      timeout: 10s
+      retries: 5
+    depends_on:
+      - broker
+    restart: unless-stopped

tailscale/docker-compose.yml

@@ -0,0 +1,25 @@
+services:
+  tailscale:
+    image: tailscale/tailscale:latest
+    hostname: coolify-server
+    container_name: tailscale
+    restart: unless-stopped
+    network_mode: host
+    environment:
+      - TS_AUTHKEY=${TS_AUTHKEY}
+      - TS_USERSPACE=false
+      - TS_STATE_DIR=/var/lib/tailscale
+      - TS_HOSTNAME=coolify-server
+      - TS_ROUTES=172.17.0.0/16
+      - TS_EXTRA_ARGS=--accept-routes
+    volumes:
+      - tailscale-state:/var/lib/tailscale
+      - /dev/net/tun:/dev/net/tun
+    devices:
+      - /dev/net/tun:/dev/net/tun
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+
+volumes:
+  tailscale-state: