openship 0.6.0 → 0.6.5

package/dist/{chunk-OTLSJYAC.js → chunk-LEYSL46B.js}

@@ -908,6 +908,49 @@ function appVolumeTargets(volumes, appDir = APP_DIR) {
   return out;
 }
 
+// ../../packages/core/src/compose-namespace.ts
+var CONTAINER_REF = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
+var SERVICE_REF = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
+function parseComposeNamespace(raw, field) {
+  if (raw === void 0 || raw === null) return void 0;
+  if (typeof raw !== "string") {
+    return { ok: false, reason: `${field} must be a string, got ${typeof raw}.` };
+  }
+  const value = raw.trim();
+  if (!value) return void 0;
+  if (value === "host") {
+    return {
+      ok: false,
+      reason: `${field}: host is not supported. A host-namespace container bypasses the edge (its ports bind host interfaces directly) and can reach every loopback service on the machine, including Openship's own API. Share a sibling's namespace instead (${field}: service:<name>), or run this workload outside the stack.`
+    };
+  }
+  if (field === "network_mode") {
+    if (value === "none") return { ok: true, ref: { kind: "none" }, value };
+    if (value === "bridge" || value === "default") return void 0;
+  }
+  const serviceRef = value.startsWith("service:") ? value.slice("service:".length) : void 0;
+  if (serviceRef !== void 0) {
+    if (!SERVICE_REF.test(serviceRef)) {
+      return { ok: false, reason: `${field}: "${value}" is not a valid service reference.` };
+    }
+    return { ok: true, ref: { kind: "service", service: serviceRef }, value };
+  }
+  const containerRef = value.startsWith("container:") ? value.slice("container:".length) : void 0;
+  if (containerRef !== void 0) {
+    if (!CONTAINER_REF.test(containerRef)) {
+      return { ok: false, reason: `${field}: "${value}" is not a valid container reference.` };
+    }
+    return { ok: true, ref: { kind: "container", container: containerRef }, value };
+  }
+  return {
+    ok: false,
+    reason: `${field}: "${value}" is not supported. Openship accepts ` + (field === "network_mode" ? `"none", ` : "") + `"service:<name>" (a service in this stack) and "container:<id>".`
+  };
+}
+function ownsNetworkEndpoint(resolvedNetworkMode) {
+  return !resolvedNetworkMode;
+}
+
 // ../../packages/core/src/constants.ts
 var DEFAULT_IMAGE_REGISTRY = "ghcr.io/oblien";
 var PLANS = {
@@ -1228,6 +1271,27 @@ function withTimeout(promise2, ms, message) {
     );
   });
 }
+function wrapText(text, width = 88) {
+  const out = [];
+  for (const paragraph of text.split("\n")) {
+    const words = paragraph.split(/\s+/).filter(Boolean);
+    if (words.length === 0) {
+      out.push("");
+      continue;
+    }
+    let line = "";
+    for (const word of words) {
+      if (line && line.length + 1 + word.length > width) {
+        out.push(line);
+        line = word;
+      } else {
+        line = line ? `${line} ${word}` : word;
+      }
+    }
+    if (line) out.push(line);
+  }
+  return out;
+}
 
 // ../../packages/core/src/errors.ts
 var AppError = class extends Error {
@@ -1265,6 +1329,7 @@ var OPENSHIP_PRODUCTION_MODES = [
   "static",
   "standalone"
 ];
+var OPENSHIP_WORKLOADS = ["web", "worker", "static"];
 var OPENSHIP_DOMAIN_TYPES = ["free", "custom"];
 var OPENSHIP_RESTARTS = [
   "no",
@@ -1296,6 +1361,7 @@ var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "volumes",
   "runtime",
   "productionMode",
+  "workload",
   "port",
   "env",
   "domains",
@@ -1642,6 +1708,7 @@ function parseOpenshipConfig(raw) {
     volumes: ctx.strArray(raw.volumes, "volumes"),
     runtime: ctx.enumOf(raw.runtime, "runtime", OPENSHIP_RUNTIMES),
     productionMode: ctx.enumOf(raw.productionMode, "productionMode", OPENSHIP_PRODUCTION_MODES),
+    workload: ctx.enumOf(raw.workload, "workload", OPENSHIP_WORKLOADS),
     port: ctx.int(raw.port, "port", 1, 65535),
     env: parseEnv(ctx, raw.env, "env"),
     domains: parseDomains(ctx, raw.domains, "domains"),
@@ -2255,12 +2322,345 @@ function parseProxyValue(spec, raw) {
   return coerceProxyValue(spec, normalized.toLowerCase());
 }
 
+// ../../packages/core/src/answer.ts
+function answered(value) {
+  return { supported: true, value };
+}
+function refused(reason) {
+  return { supported: false, reason };
+}
+
+// ../../packages/core/src/host-firewall.ts
+var ADDRESS = /^[0-9A-Fa-f.:]+(?:\/\d{1,3})?$/;
+function invalidScope(scope) {
+  if (!Number.isInteger(scope.port) || scope.port < 1 || scope.port > 65535) {
+    return `${JSON.stringify(scope.port)} is not a port number, so no firewall rule was built for it.`;
+  }
+  const bad = scope.cidrs.find((cidr) => !ADDRESS.test(cidr));
+  if (bad !== void 0) {
+    return `${JSON.stringify(bad)} is not an address or CIDR, so no firewall rule was built for it.`;
+  }
+  return null;
+}
+function ipFamily(cidr) {
+  return cidr.includes(":") ? "ipv6" : "ipv4";
+}
+function nftSource(cidr) {
+  return `${cidr.includes(":") ? "ip6" : "ip"} saddr ${cidr}`;
+}
+var ALLOW = {
+  ufw: ({ cidrs, port, proto }) => cidrs.length === 0 ? [`ufw allow ${port}/${proto}`] : cidrs.map((c) => `ufw allow from ${c} to any port ${port} proto ${proto}`),
+  firewalld: ({ cidrs, port, proto }) => [
+    ...cidrs.length === 0 ? [`firewall-cmd --permanent --add-port=${port}/${proto}`] : cidrs.map(
+      (c) => `firewall-cmd --permanent --add-rich-rule='rule family="${ipFamily(c)}" source address="${c}" port port="${port}" protocol="${proto}" accept'`
+    ),
+    "firewall-cmd --reload"
+  ],
+  // Adding a rule to an existing chain only. The detector reports `nftables` exactly when
+  // `table inet filter` is present, so the chain is there; if it's named something else
+  // (an iptables-nft translation layer, say) this fails loudly rather than half-applying.
+  nftables: ({ cidrs, port, proto }) => cidrs.length === 0 ? [`nft add rule inet filter input ${proto} dport ${port} accept`] : cidrs.map(
+    (c) => `nft add rule inet filter input ${nftSource(c)} ${proto} dport ${port} accept`
+  ),
+  iptables: ({ cidrs, port, proto }) => cidrs.length === 0 ? [`iptables -I INPUT -p ${proto} --dport ${port} -j ACCEPT`] : cidrs.map((c) => `iptables -I INPUT -p ${proto} -s ${c} --dport ${port} -j ACCEPT`)
+};
+var REVOKE = {
+  ufw: ({ cidrs, port, proto }) => answered(
+    cidrs.length === 0 ? [`ufw delete allow ${port}/${proto}`] : cidrs.map((c) => `ufw delete allow from ${c} to any port ${port} proto ${proto}`)
+  ),
+  firewalld: ({ cidrs, port, proto }) => answered([
+    ...cidrs.length === 0 ? [`firewall-cmd --permanent --remove-port=${port}/${proto}`] : cidrs.map(
+      (c) => `firewall-cmd --permanent --remove-rich-rule='rule family="${ipFamily(c)}" source address="${c}" port port="${port}" protocol="${proto}" accept'`
+    ),
+    "firewall-cmd --reload"
+  ]),
+  nftables: () => refused(
+    "An nftables rule is deleted by handle, and the handle only exists in the live ruleset \u2014 there is no command that removes a rule by its contents. Read it with `nft -a list chain inet filter input`, then `nft delete rule inet filter input handle <n>`."
+  ),
+  iptables: ({ cidrs, port, proto }) => answered(
+    cidrs.length === 0 ? [`iptables -D INPUT -p ${proto} --dport ${port} -j ACCEPT`] : cidrs.map((c) => `iptables -D INPUT -p ${proto} -s ${c} --dport ${port} -j ACCEPT`)
+  )
+};
+function firewallManager(firewall) {
+  switch (firewall) {
+    case "ufw":
+    case "firewalld":
+    case "nftables":
+    case "iptables":
+      return answered(firewall);
+    case "none":
+      return refused(
+        "No firewall is active on this host, so there is no rule to add \u2014 traffic reaches it already. Check a cloud security group / network ACL if it doesn't."
+      );
+    case "unknown":
+      return refused(
+        "Openship could not determine which firewall this host runs, so it will not guess at a rule \u2014 applying an iptables rule where firewalld is managing the chains looks like it worked and is gone after a reload."
+      );
+  }
+}
+var PERSISTS = {
+  // Both keep their own on-disk config and reload it at boot.
+  ufw: true,
+  firewalld: true,
+  // The rule lives in the running ruleset only; something else has to save it.
+  nftables: false,
+  iptables: false,
+  // Nothing was added, so there is nothing to survive anything.
+  none: false,
+  unknown: false
+};
+function firewallPersists(firewall) {
+  return PERSISTS[firewall];
+}
+function firewallAllowSteps(manager, scope) {
+  const invalid = invalidScope(scope);
+  return invalid ? refused(invalid) : answered(ALLOW[manager](scope));
+}
+function firewallRevokeSteps(manager, scope) {
+  const invalid = invalidScope(scope);
+  return invalid ? refused(invalid) : REVOKE[manager](scope);
+}
+
+// ../../packages/core/src/host-channel.ts
+var HOST_CHANNEL_UNAFFECTED = "Ordinary deploys to this box still work \u2014 they go through the Docker socket.";
+var HOST_CHANNEL_BLOCKED = [
+  "the host terminal, host system info and host port scans",
+  "taking over :80/:443 from a proxy Openship didn't start",
+  "installing or updating the mail engine",
+  "deploying a catalog app that needs a generated config file on the host (Supabase's kong.yml, say)"
+];
+var HOST_CHANNEL_SYMPTOM = `This box also reads "Offline" in the dashboard's server list while the channel is down.`;
+var HOST_CHANNEL_PROVISION_COMMAND = "openship up";
+var HOST_CHANNEL_RECHECK_COMMAND = "openship doctor";
+var HOST_CHANNEL_RECHECK = `Re-check it any time with \`${HOST_CHANNEL_RECHECK_COMMAND}\`.`;
+var HOST_CHANNEL_NOT_PROVISIONED = (
+  // Two sentences rather than one clause chain, for the reason HOST_CHANNEL_OPT_OUT
+  // gives: every surface wraps this to a terminal width, and both commands have to
+  // survive the break. Starting the second sentence with its command keeps it whole.
+  `Re-run \`${HOST_CHANNEL_PROVISION_COMMAND}\` to provision the host channel. \`${HOST_CHANNEL_RECHECK_COMMAND}\` reports whether it worked.`
+);
+var HOST_CHANNEL_UNPROVISIONED = "Openship is running in a container with no host channel \u2014 OPENSHIP_HOST_SSH_HOST is unset, so there is no address to reach the host at and nothing has been dialed.";
+var HOST_CHANNEL_OPT_OUT = (
+  // The command sits early in the sentence on purpose: every surface wraps this to a
+  // terminal width, and a line break through the middle of a command is a command an
+  // operator can't copy.
+  "Not a fix, a choice: `openship up --no-host-control` turns the channel off and takes its key back, for a box where the api container should never run host commands \u2014 the items above stay unavailable."
+);
+var SSHD_ENABLE_HINT_UNKNOWN = "sudo systemctl enable --now ssh   # RHEL-family hosts name the unit 'sshd'";
+function explainHostChannelCause(cause, ctx) {
+  const at = ctx.target;
+  const suffix = ctx.detail ? ` (${ctx.detail})` : "";
+  switch (cause) {
+    case "timeout":
+      return {
+        headline: `${at} \u2014 no response, not even a refusal${suffix}`,
+        body: "That is what a dropped packet looks like. This address is host-local, so the connection traverses the host's filter/INPUT chain, where a default-deny firewall applies. Published container ports are forwarded and never reach that chain, which is why the rest of the stack looks healthy.",
+        firewallShaped: true
+      };
+    case "refused":
+      return {
+        headline: `${at} \u2014 connection refused${suffix}`,
+        // The command sits on its own line (wrapText honours the break) so no terminal
+        // width can fold it in half and hand the operator something unpasteable.
+        body: `The packet arrived and nothing accepted it: either sshd isn't listening on an address the containers can reach, or something is rejecting rather than dropping it. A firewall rule alone won't fix a refusal. Check that ListenAddress in /etc/ssh/sshd_config isn't pinned to 127.0.0.1, then:
+  ${ctx.sshdEnableHint ?? SSHD_ENABLE_HINT_UNKNOWN}`,
+        firewallShaped: false
+      };
+    case "unresolved":
+      return {
+        headline: `"${ctx.host ?? at}" didn't resolve inside the Openship container${suffix}`,
+        body: "The host alias needs `extra_hosts: host.docker.internal:host-gateway` and Docker 20.10+; under rootless Docker the host gateway isn't provided at all. Re-run `openship up` to reprovision the channel.",
+        firewallShaped: false
+      };
+    case "no_route":
+      return {
+        headline: `${at} \u2014 no route from the Openship container${suffix}`,
+        body: "The address the channel was provisioned with isn't reachable on this box's networks. Re-run `openship up` to reprovision it, or point OPENSHIP_HOST_SSH_HOST at an address the container can reach.",
+        firewallShaped: false
+      };
+    case "error":
+      return {
+        headline: `${at} \u2014 ${ctx.detail ?? "the connection failed"}`,
+        body: "",
+        firewallShaped: false
+      };
+  }
+}
+function summarizeHostChannelCause(cause, ctx) {
+  const at = ctx.target;
+  switch (cause) {
+    case "timeout":
+      return `${at} dropped the connection`;
+    case "refused":
+      return `${at} refused \u2014 sshd isn't listening where containers can reach it`;
+    case "unresolved":
+      return `${ctx.host ?? at} didn't resolve in the container \u2014 needs Docker 20.10+ host-gateway`;
+    case "no_route":
+      return `no route to ${at} from the container`;
+    case "error":
+      return `${at} \u2014 ${ctx.detail ?? "the connection failed"}`;
+  }
+}
+var DOCKER_DEFAULT_POOL_CIDR = "172.16.0.0/12";
+var PERSIST_IPTABLES = {
+  debian: "persist it with `sudo apt-get install iptables-persistent`, which saves the current rules as it installs",
+  rhel: "persist it with `sudo dnf install iptables-services && sudo service iptables save`",
+  alpine: "persist it with `sudo rc-update add iptables && sudo /etc/init.d/iptables save`",
+  suse: "persist it with whatever this distro restores iptables from at boot",
+  arch: "persist it with whatever this distro restores iptables from at boot",
+  unknown: "persist it with iptables-persistent (Debian/Ubuntu) or iptables-services (RHEL family)"
+};
+function note(text) {
+  return `# (${text})`;
+}
+function pasteable(steps) {
+  return steps.supported ? steps.value.map((step) => `sudo ${step}`).join("\n") : steps.reason.split("\n").map((line) => `# ${line}`).join("\n");
+}
+function hostChannelRuleScope(cidrs, port) {
+  return { cidrs: cidrs.length > 0 ? cidrs : [DOCKER_DEFAULT_POOL_CIDR], port, proto: "tcp" };
+}
+function everyForm(render, managers) {
+  return managers.flatMap((manager) => [`# ${manager}:`, render(manager)]).join("\n");
+}
+var OFFER_ORDER = ["ufw", "firewalld", "nftables", "iptables"];
+function hostFirewallRule(firewall, cidrs, port, family = "unknown") {
+  const scope = hostChannelRuleScope(cidrs, port);
+  const allow = (manager) => pasteable(firewallAllowSteps(manager, scope));
+  const unpersisted = (manager, caveat) => `${allow(manager)}
+${note(caveat)}`;
+  const ruleFor = (manager) => {
+    switch (manager) {
+      case "ufw":
+      case "firewalld":
+        return allow(manager);
+      case "nftables":
+        return unpersisted(
+          "nftables",
+          "an `nft add rule` is gone at the next reboot \u2014 write it into /etc/nftables.conf (or your distro's ruleset file) to keep it"
+        );
+      case "iptables":
+        return unpersisted(
+          "iptables",
+          `a raw iptables rule does not survive a reboot \u2014 ${PERSIST_IPTABLES[family]}`
+        );
+    }
+  };
+  switch (firewall) {
+    case "ufw":
+    case "firewalld":
+    case "nftables":
+    case "iptables":
+      return ruleFor(firewall);
+    // Two different observations, one rule: `iptables` means raw rules are already the
+    // only thing enforcing here, `none` means nothing is. Either way iptables is what
+    // this host speaks, and either way the rule is lost at reboot.
+    case "none":
+      return ruleFor("iptables");
+    case "unknown":
+      return everyForm(ruleFor, OFFER_ORDER);
+  }
+}
+function hostFirewallRuleRemoval(firewall, cidrs, port) {
+  const scope = hostChannelRuleScope(cidrs, port);
+  const revoke = (manager) => pasteable(firewallRevokeSteps(manager, scope));
+  switch (firewall) {
+    case "ufw":
+    case "firewalld":
+    case "nftables":
+      return revoke(firewall);
+    case "iptables":
+    case "none":
+      return revoke("iptables");
+    case "unknown":
+      return everyForm(revoke, OFFER_ORDER);
+  }
+}
+
+// ../../packages/core/src/compose-spec.ts
+var asIs = (s) => s;
+function composeMountToSpec(mount, interpolate = asIs) {
+  const source = mount.source ?? mount.name;
+  const target = mount.target;
+  const bindOpts = mount.bind;
+  const volumeOpts = mount.volume;
+  const selinux = typeof bindOpts?.selinux === "string" ? bindOpts.selinux : void 0;
+  const mode = mount.read_only === true ? ":ro" : volumeOpts?.nocopy === true ? ":nocopy" : selinux === "z" || selinux === "Z" ? `:${selinux}` : "";
+  if (source && target) return `${source}:${target}${mode}`;
+  if (target) return String(target);
+  return void 0;
+}
+function composeMountIssues(mount) {
+  const issues = [];
+  const target = typeof mount.target === "string" ? mount.target : "<unnamed>";
+  const type = typeof mount.type === "string" ? mount.type : void 0;
+  if (type === "tmpfs") {
+    return [
+      {
+        field: "volumes[].type=tmpfs",
+        reason: `the tmpfs mount at ${target} is not modeled. Openship mounts volumes and host paths only, so this would be created as a persistent volume on disk rather than in memory \u2014 remove it or make it a named volume deliberately.`,
+        blocking: true
+      }
+    ];
+  }
+  if (type === "npipe" || type === "cluster" || type === "image") {
+    return [
+      {
+        field: `volumes[].type=${type}`,
+        reason: `the ${type} mount at ${target} is not modeled.`,
+        blocking: true
+      }
+    ];
+  }
+  const volumeOpts = mount.volume;
+  if (typeof volumeOpts?.subpath === "string" && volumeOpts.subpath) {
+    issues.push({
+      field: "volumes[].volume.subpath",
+      reason: `volume.subpath on the mount at ${target} is not modeled. Ignoring it would mount the ENTIRE volume there instead of the one subdirectory, exposing data the file scoped out.`,
+      blocking: true
+    });
+  }
+  if (mount.read_only === true && !mount.source && !mount.name) {
+    issues.push({
+      field: "volumes[].read_only",
+      reason: `read_only on the anonymous volume at ${target} is not modeled \u2014 a volume with no source cannot be mounted read-only. Give it a named source to make it read-only.`
+    });
+  }
+  const bindOpts = mount.bind;
+  if (typeof bindOpts?.propagation === "string" && bindOpts.propagation) {
+    issues.push({
+      field: "volumes[].bind.propagation",
+      reason: `bind.propagation on the mount at ${target} is not modeled.`
+    });
+  }
+  if (bindOpts?.create_host_path === false) {
+    issues.push({
+      field: "volumes[].bind.create_host_path",
+      reason: `create_host_path: false on the mount at ${target} is not modeled \u2014 Docker will create the host path if it is missing.`
+    });
+  }
+  return issues;
+}
+function composePortToSpec(port, interpolate = asIs) {
+  const target = port.target ?? port.container_port;
+  if (target === void 0 || target === null || target === "") return void 0;
+  const published = port.published ?? port.host_port;
+  const proto = typeof port.protocol === "string" ? port.protocol.toLowerCase() : void 0;
+  const suffix = proto && proto !== "tcp" ? `/${proto}` : "";
+  const hostIp = typeof port.host_ip === "string" ? interpolate(port.host_ip) : void 0;
+  const hasPublished = published !== void 0 && published !== null && published !== "" && published !== 0 && published !== "0";
+  const hostPart = hasPublished ? hostIp ? `${hostIp}:${published}:` : `${published}:` : hostIp ? `${hostIp}::` : "";
+  return `${hostPart}${target}${suffix}`;
+}
+
 // ../../packages/core/src/object-storage.ts
 function isAwsS3Endpoint(endpoint2) {
   return !endpoint2 || endpoint2.includes(".amazonaws.com");
 }
 
 // ../../packages/core/src/shell-split.ts
+function shellQuote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
 function shellSplitWords(value) {
   const words = [];
   let current = "";
@@ -3168,6 +3568,74 @@ var LANGUAGE_MANIFEST_FILES = Array.from(
   new Set(LANGUAGE_DETECTORS.flatMap((d) => d.manifestFiles.map((f) => f.toLowerCase())))
 );
 
+// ../../packages/core/src/mail-server/relay-providers.ts
+var RELAY_PROVIDERS = [
+  {
+    id: "ses",
+    label: "Amazon SES",
+    hostTemplate: "email-smtp.{region}.amazonaws.com",
+    regional: true,
+    defaultPort: 587,
+    spfInclude: "include:amazonses.com",
+    providerDkim: true,
+    mailFrom: {
+      mxTemplate: "feedback-smtp.{region}.amazonaws.com",
+      spf: "v=spf1 include:amazonses.com ~all"
+    }
+  },
+  {
+    id: "sendgrid",
+    label: "SendGrid",
+    hostTemplate: "smtp.sendgrid.net",
+    defaultPort: 587,
+    spfInclude: "include:sendgrid.net",
+    username: "apikey",
+    providerDkim: true
+  },
+  {
+    id: "mailgun",
+    label: "Mailgun",
+    hostTemplate: "smtp.mailgun.org",
+    defaultPort: 587,
+    spfInclude: "include:mailgun.org",
+    providerDkim: true
+  },
+  {
+    id: "postmark",
+    label: "Postmark",
+    hostTemplate: "smtp.postmarkapp.com",
+    defaultPort: 587,
+    spfInclude: "include:spf.mtasv.net",
+    providerDkim: true
+  },
+  {
+    id: "resend",
+    // Resend rides SES, but the verified-domain records it hands out are
+    // per-account — don't assume the SES include.
+    label: "Resend",
+    hostTemplate: "smtp.resend.com",
+    defaultPort: 587,
+    username: "resend",
+    providerDkim: true
+  },
+  {
+    id: "oracle",
+    // OCI Email Delivery's SPF include is region-scoped
+    // (rp / eu.rp / ap.rp .oracleemaildelivery.com) — the operator pastes theirs.
+    label: "Oracle Cloud",
+    hostTemplate: "smtp.email.{region}.oci.oraclecloud.com",
+    regional: true,
+    defaultPort: 587,
+    providerDkim: true
+  },
+  {
+    id: "custom",
+    label: "Custom SMTP",
+    defaultPort: 587
+  }
+];
+var RELAY_PROVIDER_IDS = RELAY_PROVIDERS.map((p) => p.id);
+
 // ../../packages/core/src/apps/catalog.json
 var catalog_default = {
   version: 1,
@@ -3177,9 +3645,9 @@ var catalog_default = {
       verified: true,
       id: "mail",
       name: "Openship Mail",
-      description: "A complete self-hosted mail server \u2014 SMTP/IMAP + webmail on your own domain.",
+      description: "Your own mail on your own domain \u2014 SMTP/IMAP, mailboxes and webmail on one server. Or keep the mailboxes you already have and just run the webmail.",
       kind: "flow",
-      logo: "mail-webmail",
+      logo: "mail",
       category: "mail",
       tags: [
         "mail",
@@ -5071,18 +5539,1051 @@ COMMIT;
             AUTH_TYPE: "LOGIN_FORM",
             SPRING_SECURITY_USER_NAME: "admin"
           },
-          secretEnv: [
-            "SPRING_SECURITY_USER_PASSWORD"
-          ],
+          secretEnv: [
+            "SPRING_SECURITY_USER_PASSWORD"
+          ],
+          restart: "unless-stopped"
+        }
+      ],
+      configFields: [
+        {
+          key: "SPRING_SECURITY_USER_PASSWORD",
+          service: "kafka-ui",
+          label: "Kafka UI password",
+          help: "Auto-generated. The password to sign in to the Kafka UI web console (username: admin).",
+          generate: "secret",
+          secret: true
+        }
+      ],
+      management: {
+        kind: "schema"
+      },
+      connection: {
+        title: "Connect to Kafka",
+        description: "Open the Kafka UI to browse topics and messages, or point a client at the broker from another service in this project.",
+        outputs: [
+          {
+            id: "ui",
+            label: "Kafka UI",
+            source: "publicUrl:kafka-ui",
+            kind: "url",
+            help: "Sign in with the username + password below."
+          },
+          {
+            id: "uiUser",
+            label: "UI username",
+            source: "env:kafka-ui:SPRING_SECURITY_USER_NAME"
+          },
+          {
+            id: "uiPassword",
+            label: "UI password",
+            source: "env:kafka-ui:SPRING_SECURITY_USER_PASSWORD",
+            secret: true
+          },
+          {
+            id: "broker",
+            label: "Bootstrap server (internal)",
+            source: "template:kafka:9092",
+            help: "Reachable as kafka:9092 from other services in this project \u2014 connect an app to it."
+          }
+        ]
+      },
+      endpoints: [
+        {
+          service: "kafka-ui",
+          port: 8080,
+          label: "Kafka UI",
+          kind: "http"
+        }
+      ]
+    },
+    {
+      available: true,
+      verified: true,
+      id: "qdrant",
+      name: "Qdrant",
+      description: "High-performance vector database for AI search, RAG, and embeddings \u2014 with the built-in Qdrant Web UI for browsing collections and running queries.",
+      kind: "template",
+      logo: "qdrant",
+      category: "backend",
+      tags: [
+        "database",
+        "vector",
+        "ai",
+        "search",
+        "rag",
+        "embeddings"
+      ],
+      framework: "docker-compose",
+      services: [
+        {
+          name: "qdrant",
+          image: "qdrant/qdrant:v1.18.3",
+          ports: [
+            "6333:6333"
+          ],
+          exposedPort: 6333,
+          exposed: true,
+          routes: [
+            {
+              port: 6333
+            }
+          ],
+          secretEnv: [
+            "QDRANT__SERVICE__API_KEY"
+          ],
+          volumes: [
+            "qdrant_storage:/qdrant/storage"
+          ],
+          restart: "unless-stopped"
+        }
+      ],
+      configFields: [
+        {
+          key: "QDRANT__SERVICE__API_KEY",
+          service: "qdrant",
+          label: "API key",
+          help: "Auto-generated. Required as the `api-key` header on every request, and to open the Web UI.",
+          generate: "secret",
+          secret: true
+        }
+      ],
+      management: {
+        kind: "schema"
+      },
+      connection: {
+        title: "Connect to Qdrant",
+        description: "Open the Qdrant Web UI in your browser (it lives under /dashboard), or point a client at the REST API. Every request needs the API key below.",
+        outputs: [
+          {
+            id: "ui",
+            label: "Qdrant Web UI",
+            source: "publicUrl:qdrant",
+            kind: "url",
+            help: "The dashboard is at this URL under /dashboard. Paste the API key when it asks."
+          },
+          {
+            id: "restUrl",
+            label: "REST API",
+            source: "publicUrl:qdrant"
+          },
+          {
+            id: "apiKey",
+            label: "API key",
+            source: "env:qdrant:QDRANT__SERVICE__API_KEY",
+            secret: true,
+            help: "Send it as the `api-key` header on every request."
+          }
+        ]
+      }
+    },
+    {
+      available: true,
+      verified: true,
+      id: "meilisearch",
+      name: "Meilisearch",
+      description: "Lightning-fast, typo-tolerant search engine. Point any Meilisearch client at the URL below with the master key \u2014 index your documents and search in milliseconds.",
+      kind: "template",
+      logo: "meilisearch",
+      category: "backend",
+      tags: [
+        "search",
+        "full-text",
+        "index",
+        "typo-tolerant"
+      ],
+      framework: "docker-compose",
+      services: [
+        {
+          name: "meilisearch",
+          image: "getmeili/meilisearch:v1.12",
+          ports: [
+            "7700:7700"
+          ],
+          exposedPort: 7700,
+          exposed: true,
+          routes: [
+            {
+              port: 7700
+            }
+          ],
+          environment: {
+            MEILI_ENV: "production",
+            MEILI_NO_ANALYTICS: "true"
+          },
+          secretEnv: [
+            "MEILI_MASTER_KEY"
+          ],
+          volumes: [
+            "meili_data:/meili_data"
+          ],
+          healthcheck: {
+            test: [
+              "CMD-SHELL",
+              "wget -q -O - http://127.0.0.1:7700/health 2>&1 | grep -q available"
+            ],
+            interval: "10s",
+            timeout: "5s",
+            retries: 5,
+            startPeriod: "10s"
+          },
+          restart: "unless-stopped"
+        }
+      ],
+      configFields: [
+        {
+          key: "MEILI_MASTER_KEY",
+          service: "meilisearch",
+          label: "Master key",
+          help: "Auto-generated. Send it as the `Authorization: Bearer` header on every request. Use it to mint scoped API keys.",
+          generate: "secret",
+          secret: true
+        }
+      ],
+      management: {
+        kind: "schema"
+      },
+      connection: {
+        title: "Connect to Meilisearch",
+        description: "Point a Meilisearch client at the URL with the master key. Every request needs the key as a Bearer token.",
+        guide: {
+          intro: "Your project gets a Meilisearch endpoint plus its master key.",
+          useHint: "Read `process.env.MEILISEARCH_URL` and `process.env.MEILISEARCH_KEY` in your code \u2014 set on your next deploy.",
+          defaultMode: "internal"
+        },
+        outputs: [
+          {
+            id: "url",
+            label: "API URL",
+            source: "publicUrl:meilisearch",
+            sourceLabel: "Public",
+            variants: [
+              {
+                id: "internal",
+                label: "Internal",
+                source: "template:http://meilisearch:7700"
+              }
+            ],
+            envKey: "MEILISEARCH_URL",
+            recommended: true,
+            help: "The Meilisearch HTTP endpoint. Switch to Internal for apps on the same project network."
+          },
+          {
+            id: "masterKey",
+            label: "Master key",
+            source: "env:meilisearch:MEILI_MASTER_KEY",
+            secret: true,
+            envKey: "MEILISEARCH_KEY",
+            recommended: true,
+            help: "Send as the `Authorization: Bearer <key>` header. Full-access \u2014 mint scoped keys for clients."
+          }
+        ]
+      },
+      provides: [
+        {
+          id: "meilisearch",
+          outputRefs: [
+            "url",
+            "masterKey"
+          ],
+          category: "search"
+        }
+      ],
+      endpoints: [
+        {
+          service: "meilisearch",
+          port: 7700,
+          label: "Meilisearch",
+          kind: "http"
+        }
+      ]
+    },
+    {
+      available: true,
+      verified: false,
+      hosting: "experimental",
+      minResources: {
+        memoryMb: 8192
+      },
+      id: "neon",
+      name: "Neon",
+      description: "Self-hosted Neon \u2014 the serverless-Postgres storage engine (pageserver, 3 safekeepers, storage broker) on S3-backed object storage, with a Neon compute node built from source. EXPERIMENTAL and heavy: ~9 containers, needs roughly 8 GB RAM, and is a test-grade topology, not a production HA cluster. Not for production data.",
+      repository: "https://github.com/neondatabase/neon",
+      kind: "template",
+      logo: "neon",
+      category: "database",
+      tags: [
+        "database",
+        "postgres",
+        "postgresql",
+        "serverless",
+        "sql"
+      ],
+      framework: "docker-compose",
+      services: [
+        {
+          name: "storage_broker",
+          image: "ghcr.io/neondatabase/neon:latest",
+          command: "storage_broker --listen-addr=0.0.0.0:50051",
+          restart: "unless-stopped"
+        },
+        {
+          name: "minio",
+          image: "minio/minio:RELEASE.2025-04-22T22-12-26Z",
+          command: "server /data --address :9000 --console-address :9001",
+          volumes: [
+            "neon_minio_data:/data"
+          ],
+          restart: "unless-stopped"
+        },
+        {
+          name: "pageserver",
+          image: "ghcr.io/neondatabase/neon:latest",
+          dependsOn: [
+            "storage_broker",
+            "minio"
+          ],
+          environment: {
+            AWS_ACCESS_KEY_ID: "{{config:MINIO_ROOT_USER}}",
+            AWS_SECRET_ACCESS_KEY: "{{config:MINIO_ROOT_PASSWORD}}"
+          },
+          secretEnv: [
+            "AWS_SECRET_ACCESS_KEY"
+          ],
+          restart: "unless-stopped"
+        },
+        {
+          name: "safekeeper1",
+          image: "ghcr.io/neondatabase/neon:latest",
+          command: "safekeeper --listen-pg=safekeeper1:5454 --listen-http=0.0.0.0:7676 --id=1 --broker-endpoint=http://storage_broker:50051 -D /data --remote-storage={endpoint='http://minio:9000',bucket_name='neon',bucket_region='eu-north-1',prefix_in_bucket='/safekeeper/'}",
+          dependsOn: [
+            "storage_broker",
+            "minio"
+          ],
+          environment: {
+            AWS_ACCESS_KEY_ID: "{{config:MINIO_ROOT_USER}}",
+            AWS_SECRET_ACCESS_KEY: "{{config:MINIO_ROOT_PASSWORD}}"
+          },
+          secretEnv: [
+            "AWS_SECRET_ACCESS_KEY"
+          ],
+          restart: "unless-stopped"
+        },
+        {
+          name: "safekeeper2",
+          image: "ghcr.io/neondatabase/neon:latest",
+          command: "safekeeper --listen-pg=safekeeper2:5454 --listen-http=0.0.0.0:7676 --id=2 --broker-endpoint=http://storage_broker:50051 -D /data --remote-storage={endpoint='http://minio:9000',bucket_name='neon',bucket_region='eu-north-1',prefix_in_bucket='/safekeeper/'}",
+          dependsOn: [
+            "storage_broker",
+            "minio"
+          ],
+          environment: {
+            AWS_ACCESS_KEY_ID: "{{config:MINIO_ROOT_USER}}",
+            AWS_SECRET_ACCESS_KEY: "{{config:MINIO_ROOT_PASSWORD}}"
+          },
+          secretEnv: [
+            "AWS_SECRET_ACCESS_KEY"
+          ],
+          restart: "unless-stopped"
+        },
+        {
+          name: "safekeeper3",
+          image: "ghcr.io/neondatabase/neon:latest",
+          command: "safekeeper --listen-pg=safekeeper3:5454 --listen-http=0.0.0.0:7676 --id=3 --broker-endpoint=http://storage_broker:50051 -D /data --remote-storage={endpoint='http://minio:9000',bucket_name='neon',bucket_region='eu-north-1',prefix_in_bucket='/safekeeper/'}",
+          dependsOn: [
+            "storage_broker",
+            "minio"
+          ],
+          environment: {
+            AWS_ACCESS_KEY_ID: "{{config:MINIO_ROOT_USER}}",
+            AWS_SECRET_ACCESS_KEY: "{{config:MINIO_ROOT_PASSWORD}}"
+          },
+          secretEnv: [
+            "AWS_SECRET_ACCESS_KEY"
+          ],
+          restart: "unless-stopped"
+        },
+        {
+          name: "compute",
+          build: {
+            dockerfile: `FROM ghcr.io/neondatabase/compute-node-v16:latest
+
+USER root
+RUN echo 'Acquire::Retries "5";' > /etc/apt/apt.conf.d/80-retries && \\
+    apt-get update && \\
+    apt-get install -y curl jq netcat-openbsd && \\
+    rm -rf /var/lib/apt/lists/*
+
+COPY compute/compute.sh /shell/compute.sh
+RUN chmod +x /shell/compute.sh
+
+USER postgres
+ENTRYPOINT ["/shell/compute.sh"]
+`,
+            files: [
+              {
+                path: "compute.sh",
+                content: '#!/usr/bin/env bash\nset -eux\n\n# Generate a random tenant or timeline ID\n#\n# Takes a variable name as argument. The result is stored in that variable.\ngenerate_id() {\n    local -n resvar=${1}\n    printf -v resvar \'%08x%08x%08x%08x\' ${SRANDOM} ${SRANDOM} ${SRANDOM} ${SRANDOM}\n}\n\nPG_VERSION=${PG_VERSION:-16}\n\nreadonly CONFIG_FILE_ORG=/var/db/postgres/configs/config.json\nreadonly CONFIG_FILE=/tmp/config.json\n\necho "Waiting pageserver become ready."\nwhile ! nc -z pageserver 6400; do\n     sleep 1\ndone\necho "Page server is ready."\n\ncp "${CONFIG_FILE_ORG}" "${CONFIG_FILE}"\n\nif [[ -n "${TENANT_ID:-}" && -n "${TIMELINE_ID:-}" ]]; then\n   tenant_id=${TENANT_ID}\n   timeline_id=${TIMELINE_ID}\nelse\n  echo "Check if a tenant present"\n  PARAMS=(\n       -X GET\n       -H "Content-Type: application/json"\n       "http://pageserver:9898/v1/tenant"\n  )\n  tenant_id=$(curl "${PARAMS[@]}" | jq -r .[0].id)\n  if [[ -z "${tenant_id}" || "${tenant_id}" = null ]]; then\n    echo "Create a tenant"\n    generate_id tenant_id\n    PARAMS=(\n         -X PUT\n         -H "Content-Type: application/json"\n         -d "{\\"mode\\": \\"AttachedSingle\\", \\"generation\\": 1, \\"tenant_conf\\": {}}"\n        "http://pageserver:9898/v1/tenant/${tenant_id}/location_config"\n    )\n    result=$(curl "${PARAMS[@]}")\n    printf \'%s\\n\' "${result}" | jq .\n  fi\n\n  echo "Check if a timeline present"\n  PARAMS=(\n       -X GET\n       -H "Content-Type: application/json"\n      "http://pageserver:9898/v1/tenant/${tenant_id}/timeline"\n  )\n  timeline_id=$(curl "${PARAMS[@]}" | jq -r .[0].timeline_id)\n  if [[ -z "${timeline_id}" || "${timeline_id}" = null ]]; then\n    generate_id timeline_id\n    PARAMS=(\n        -sbf\n        -X POST\n        -H "Content-Type: application/json"\n        -d "{\\"new_timeline_id\\": \\"${timeline_id}\\", \\"pg_version\\": ${PG_VERSION}}"\n        "http://pageserver:9898/v1/tenant/${tenant_id}/timeline/"\n    )\n    result=$(curl "${PARAMS[@]}")\n    printf \'%s\\n\' "${result}" | jq .\n  fi\nfi\n\necho "Overwrite tenant id and timeline id in spec file"\nsed -i "s|TENANT_ID|${tenant_id}|" ${CONFIG_FILE}\nsed -i "s|TIMELINE_ID|${timeline_id}|" ${CONFIG_FILE}\n\ncat ${CONFIG_FILE}\n\necho "Start compute node"\n/usr/local/bin/compute_ctl --pgdata /var/db/postgres/compute \\\n     -C "postgresql://cloud_admin@localhost:55433/postgres"  \\\n     -b /usr/local/bin/postgres                              \\\n     --compute-id "compute-${RANDOM}"                        \\\n     --config "${CONFIG_FILE}"\n'
+              }
+            ]
+          },
+          dependsOn: [
+            "pageserver",
+            "safekeeper1",
+            "safekeeper2",
+            "safekeeper3"
+          ],
+          environment: {
+            PG_VERSION: "16"
+          },
+          ports: [
+            "55433:55433"
+          ],
+          volumes: [
+            "neon_compute_data:/var/db/postgres/compute"
+          ],
+          healthcheck: {
+            test: [
+              "CMD-SHELL",
+              "pg_isready -h 127.0.0.1 -p 55433 -U cloud_admin || exit 1"
+            ],
+            interval: "10s",
+            timeout: "5s",
+            retries: 10,
+            startPeriod: "90s"
+          },
+          restart: "unless-stopped"
+        }
+      ],
+      configFields: [
+        {
+          key: "MINIO_ROOT_USER",
+          service: "minio",
+          label: "Object-storage access key",
+          help: "The S3 access key the Neon storage layer uses against its bundled MinIO.",
+          type: "text",
+          default: "neon",
+          required: true
+        },
+        {
+          key: "MINIO_ROOT_PASSWORD",
+          service: "minio",
+          label: "Object-storage secret key",
+          help: "Auto-generated. The S3 secret key shared by the pageserver and safekeepers.",
+          generate: "secret",
+          secret: true
+        }
+      ],
+      management: {
+        kind: "schema"
+      },
+      prepare: [
+        {
+          service: "minio",
+          command: 'mc alias set local http://127.0.0.1:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" > /dev/null && mc mb --ignore-existing --region eu-north-1 local/neon > /dev/null && printf %s neon',
+          capture: "bucket",
+          phase: "post-ready",
+          readiness: {
+            test: 'mc alias set local http://127.0.0.1:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"',
+            interval: 1e3,
+            retries: 30
+          },
+          once: true
+        }
+      ],
+      connection: {
+        title: "Connect to Neon",
+        description: "Point a Postgres driver at the compute node. The compute serves the Postgres wire protocol on port 55433 as user cloud_admin.",
+        guide: {
+          intro: "Your project gets a Postgres connection served by the Neon compute node.",
+          useHint: "Read process.env.DATABASE_URL in your code \u2014 it's set the next time your project deploys.",
+          defaultMode: "internal"
+        },
+        outputs: [
+          {
+            id: "dbUrl",
+            label: "Database URL",
+            source: "template:postgresql://cloud_admin:cloud_admin@{{host}}:55433/postgres",
+            sourceLabel: "Public",
+            variants: [
+              {
+                id: "internal",
+                label: "Internal",
+                source: "template:postgresql://cloud_admin:cloud_admin@compute:55433/postgres"
+              }
+            ],
+            secret: true,
+            envKey: "DATABASE_URL",
+            recommended: true,
+            help: "Postgres connection (cloud_admin). Published on port 55433. Switch to Internal for apps on the same project network."
+          }
+        ]
+      },
+      endpoints: [
+        {
+          service: "compute",
+          port: 55433,
+          label: "Postgres",
+          kind: "tcp"
+        }
+      ],
+      files: [
+        {
+          service: "pageserver",
+          path: "/data/.neon/pageserver.toml",
+          content: `broker_endpoint='http://storage_broker:50051'
+pg_distrib_dir='/usr/local/'
+listen_pg_addr='0.0.0.0:6400'
+listen_http_addr='0.0.0.0:9898'
+remote_storage={ endpoint='http://minio:9000', bucket_name='neon', bucket_region='eu-north-1', prefix_in_bucket='/pageserver' }
+control_plane_api='http://0.0.0.0:6666'
+control_plane_emergency_mode=true
+virtual_file_io_mode="buffered"
+`
+        },
+        {
+          service: "pageserver",
+          path: "/data/.neon/identity.toml",
+          content: "id=1234\n"
+        },
+        {
+          service: "compute",
+          path: "/var/db/postgres/configs/config.json",
+          content: '{\n    "spec": {\n        "format_version": 1.0,\n\n        "timestamp": "2022-10-12T18:00:00.000Z",\n        "operation_uuid": "0f657b36-4b0f-4a2d-9c2e-1dcd615e7d8c",\n        "suspend_timeout_seconds": -1,\n\n        "cluster": {\n            "cluster_id": "docker_compose",\n            "name": "docker_compose_test",\n            "state": "restarted",\n            "roles": [\n                {\n                    "name": "cloud_admin",\n                    "encrypted_password": "b093c0d3b281ba6da1eacc608620abd8",\n                    "options": null\n                }\n            ],\n            "databases": [\n            ],\n            "settings": [\n                {\n                    "name": "fsync",\n                    "value": "off",\n                    "vartype": "bool"\n                },\n                {\n                    "name": "wal_level",\n                    "value": "logical",\n                    "vartype": "enum"\n                },\n                {\n                    "name": "wal_log_hints",\n                    "value": "on",\n                    "vartype": "bool"\n                },\n                {\n                    "name": "log_connections",\n                    "value": "on",\n                    "vartype": "bool"\n                },\n                {\n                    "name": "port",\n                    "value": "55433",\n                    "vartype": "integer"\n                },\n                {\n                    "name": "shared_buffers",\n                    "value": "1MB",\n                    "vartype": "string"\n                },\n                {\n                    "name": "max_connections",\n                    "value": "100",\n                    "vartype": "integer"\n                },\n                {\n                    "name": "listen_addresses",\n                    "value": "0.0.0.0",\n                    "vartype": "string"\n                },\n                {\n                    "name": "max_wal_senders",\n                    "value": "10",\n                    "vartype": "integer"\n                },\n                {\n                    "name": "max_replication_slots",\n                    "value": "10",\n                    "vartype": "integer"\n                },\n                {\n                    "name": "wal_sender_timeout",\n                    "value": "5s",\n                    "vartype": "string"\n                },\n                {\n                    "name": "wal_keep_size",\n                    "value": "0",\n                    "vartype": "integer"\n                },\n                {\n                    "name": "password_encryption",\n                    "value": "md5",\n                    "vartype": "enum"\n                },\n                {\n                    "name": "restart_after_crash",\n                    "value": "off",\n                    "vartype": "bool"\n                },\n                {\n                    "name": "synchronous_standby_names",\n                    "value": "walproposer",\n                    "vartype": "string"\n                },\n                {\n                    "name": "shared_preload_libraries",\n                    "value": "neon,pg_cron,timescaledb,pg_stat_statements",\n                    "vartype": "string"\n                },\n                {\n                    "name": "neon.safekeepers",\n                    "value": "safekeeper1:5454,safekeeper2:5454,safekeeper3:5454",\n                    "vartype": "string"\n                },\n                {\n                    "name": "neon.timeline_id",\n                    "value": "TIMELINE_ID",\n                    "vartype": "string"\n                },\n                {\n                    "name": "neon.tenant_id",\n                    "value": "TENANT_ID",\n                    "vartype": "string"\n                },\n                {\n                    "name": "neon.pageserver_connstring",\n                    "value": "host=pageserver port=6400",\n                    "vartype": "string"\n                },\n                {\n                    "name": "max_replication_write_lag",\n                    "value": "500MB",\n                    "vartype": "string"\n                },\n                {\n                    "name": "max_replication_flush_lag",\n                    "value": "10GB",\n                    "vartype": "string"\n                },\n                {\n                    "name": "cron.database",\n                    "value": "postgres",\n                    "vartype": "string"\n                }\n            ]\n        },\n\n        "delta_operations": [\n        ]\n    },\n    "compute_ctl_config": {\n        "jwks": {\n            "keys": [\n                {\n                    "use": "sig",\n                    "key_ops": [\n                        "verify"\n                    ],\n                    "alg": "EdDSA",\n                    "kid": "ZGIxMzAzOGY0YWQwODk2ODU1MTk1NzMxMDFkYmUyOWU2NzZkOWNjNjMyMGRkZGJjOWY0MjdjYWVmNzE1MjUyOAo=",\n                    "kty": "OKP",\n                    "crv": "Ed25519",\n                    "x": "MGQ4ZDFhOTdmNTM0NmUwMDc3ZmJkN2Q0MWE0ZmI3M2NhNWE3YjFjOTNkM2IyYzRkZTQzOGM3MjBkZTk3N2E5ZAo="\n                }\n            ]\n        }\n    }\n}\n'
+        }
+      ],
+      provides: [
+        {
+          id: "postgres",
+          outputRefs: [
+            "dbUrl"
+          ],
+          category: "database"
+        }
+      ]
+    },
+    {
+      available: true,
+      verified: false,
+      hosting: "experimental",
+      minResources: {
+        memoryMb: 8192,
+        cpuCores: 4
+      },
+      id: "posthog",
+      name: "PostHog",
+      description: "Self-hosted PostHog \u2014 product analytics, session replay, and feature flags. EXPERIMENTAL and heavy: the hobby stack runs the PostHog app plus Postgres, Redis, ClickHouse, Zookeeper, a Kafka-compatible broker (Redpanda), and MinIO (~9 containers) and wants roughly 4 vCPU / 8\u201316 GB RAM. Not for production.",
+      repository: "https://github.com/PostHog/posthog",
+      kind: "template",
+      logo: "posthog",
+      category: "analytics",
+      tags: [
+        "analytics",
+        "product-analytics",
+        "events",
+        "session-replay",
+        "feature-flags"
+      ],
+      framework: "docker-compose",
+      services: [
+        {
+          name: "db",
+          image: "postgres:15.12-alpine",
+          environment: {
+            POSTGRES_USER: "posthog",
+            POSTGRES_DB: "posthog"
+          },
+          secretEnv: [
+            "POSTGRES_PASSWORD"
+          ],
+          volumes: [
+            "posthog_pgdata:/var/lib/postgresql/data"
+          ],
+          healthcheck: {
+            test: [
+              "CMD-SHELL",
+              "pg_isready -U posthog"
+            ],
+            interval: "5s",
+            timeout: "5s",
+            retries: 10,
+            startPeriod: "10s"
+          },
+          restart: "unless-stopped"
+        },
+        {
+          name: "redis",
+          image: "redis:7.2-alpine",
+          command: "redis-server --maxmemory-policy allkeys-lru --maxmemory 200mb",
+          volumes: [
+            "posthog_redis:/data"
+          ],
+          healthcheck: {
+            test: [
+              "CMD",
+              "redis-cli",
+              "ping"
+            ],
+            interval: "5s",
+            timeout: "5s",
+            retries: 10
+          },
+          restart: "unless-stopped"
+        },
+        {
+          name: "zookeeper",
+          image: "zookeeper:3.7.0",
+          environment: {
+            ZOO_AUTOPURGE_PURGEINTERVAL: "1",
+            ZOO_AUTOPURGE_SNAPRETAINCOUNT: "3"
+          },
+          volumes: [
+            "posthog_zk_data:/data",
+            "posthog_zk_datalog:/datalog"
+          ],
+          restart: "unless-stopped"
+        },
+        {
+          name: "kafka",
+          image: "docker.io/redpandadata/redpanda:v25.1.9",
+          command: "redpanda start --kafka-addr internal://0.0.0.0:9092 --advertise-kafka-addr internal://kafka:9092 --mode dev-container --smp 1 --memory 1G",
+          volumes: [
+            "posthog_kafka:/var/lib/redpanda/data"
+          ],
+          restart: "unless-stopped"
+        },
+        {
+          name: "clickhouse",
+          image: "clickhouse/clickhouse-server:24.12",
+          dependsOn: [
+            "kafka",
+            "zookeeper"
+          ],
+          environment: {
+            CLICKHOUSE_SKIP_USER_SETUP: "1"
+          },
+          volumes: [
+            "posthog_clickhouse:/var/lib/clickhouse"
+          ],
+          restart: "unless-stopped"
+        },
+        {
+          name: "objectstorage",
+          image: "minio/minio:RELEASE.2025-04-22T22-12-26Z",
+          command: "server /data --console-address :9001",
+          secretEnv: [
+            "MINIO_ROOT_PASSWORD"
+          ],
+          volumes: [
+            "posthog_objectstorage:/data"
+          ],
+          restart: "unless-stopped"
+        },
+        {
+          name: "web",
+          image: "posthog/posthog:latest",
+          command: "./bin/docker-server",
+          dependsOn: [
+            "db",
+            "redis",
+            "clickhouse",
+            "kafka",
+            "objectstorage"
+          ],
+          exposedPort: 8e3,
+          exposed: true,
+          routes: [
+            {
+              port: 8e3
+            }
+          ],
+          environment: {
+            DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            CLICKHOUSE_HOST: "clickhouse",
+            CLICKHOUSE_DATABASE: "posthog",
+            CLICKHOUSE_SECURE: "false",
+            CLICKHOUSE_VERIFY: "false",
+            KAFKA_HOSTS: "kafka:9092",
+            KAFKA_URL: "kafka://kafka:9092",
+            REDIS_URL: "redis://redis:6379/",
+            SECRET_KEY: "{{config:POSTHOG_SECRET}}",
+            OBJECT_STORAGE_ENABLED: "True",
+            OBJECT_STORAGE_ENDPOINT: "http://objectstorage:9000",
+            OBJECT_STORAGE_ACCESS_KEY_ID: "{{config:MINIO_ROOT_USER}}",
+            OBJECT_STORAGE_SECRET_ACCESS_KEY: "{{config:MINIO_ROOT_PASSWORD}}",
+            OBJECT_STORAGE_BUCKET: "posthog",
+            SITE_URL: "{{publicUrl:web}}",
+            DISABLE_SECURE_SSL_REDIRECT: "true",
+            IS_BEHIND_PROXY: "true",
+            TRUST_ALL_PROXIES: "true"
+          },
+          secretEnv: [
+            "DATABASE_URL",
+            "SECRET_KEY",
+            "OBJECT_STORAGE_SECRET_ACCESS_KEY"
+          ],
+          restart: "unless-stopped"
+        },
+        {
+          name: "worker",
+          image: "posthog/posthog:latest",
+          command: "./bin/docker-worker-celery --with-scheduler",
+          dependsOn: [
+            "db",
+            "redis",
+            "clickhouse",
+            "kafka",
+            "objectstorage",
+            "web"
+          ],
+          environment: {
+            DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            CLICKHOUSE_HOST: "clickhouse",
+            CLICKHOUSE_DATABASE: "posthog",
+            CLICKHOUSE_SECURE: "false",
+            CLICKHOUSE_VERIFY: "false",
+            KAFKA_HOSTS: "kafka:9092",
+            KAFKA_URL: "kafka://kafka:9092",
+            REDIS_URL: "redis://redis:6379/",
+            SECRET_KEY: "{{config:POSTHOG_SECRET}}",
+            OBJECT_STORAGE_ENABLED: "True",
+            OBJECT_STORAGE_ENDPOINT: "http://objectstorage:9000",
+            OBJECT_STORAGE_ACCESS_KEY_ID: "{{config:MINIO_ROOT_USER}}",
+            OBJECT_STORAGE_SECRET_ACCESS_KEY: "{{config:MINIO_ROOT_PASSWORD}}",
+            OBJECT_STORAGE_BUCKET: "posthog",
+            SITE_URL: "{{publicUrl:web}}"
+          },
+          secretEnv: [
+            "DATABASE_URL",
+            "SECRET_KEY",
+            "OBJECT_STORAGE_SECRET_ACCESS_KEY"
+          ],
+          restart: "unless-stopped"
+        },
+        {
+          name: "plugins",
+          image: "posthog/posthog:latest",
+          command: "./bin/plugin-server --no-restart-loop",
+          dependsOn: [
+            "db",
+            "redis",
+            "clickhouse",
+            "kafka",
+            "objectstorage",
+            "web"
+          ],
+          environment: {
+            DATABASE_URL: "postgres://posthog:{{config:POSTGRES_PASSWORD}}@db:5432/posthog",
+            CLICKHOUSE_HOST: "clickhouse",
+            CLICKHOUSE_DATABASE: "posthog",
+            CLICKHOUSE_SECURE: "false",
+            CLICKHOUSE_VERIFY: "false",
+            KAFKA_HOSTS: "kafka:9092",
+            KAFKA_URL: "kafka://kafka:9092",
+            REDIS_URL: "redis://redis:6379/",
+            SECRET_KEY: "{{config:POSTHOG_SECRET}}",
+            OBJECT_STORAGE_ENABLED: "True",
+            OBJECT_STORAGE_ENDPOINT: "http://objectstorage:9000",
+            OBJECT_STORAGE_ACCESS_KEY_ID: "{{config:MINIO_ROOT_USER}}",
+            OBJECT_STORAGE_SECRET_ACCESS_KEY: "{{config:MINIO_ROOT_PASSWORD}}",
+            OBJECT_STORAGE_BUCKET: "posthog"
+          },
+          secretEnv: [
+            "DATABASE_URL",
+            "SECRET_KEY",
+            "OBJECT_STORAGE_SECRET_ACCESS_KEY"
+          ],
+          restart: "unless-stopped"
+        }
+      ],
+      configFields: [
+        {
+          key: "POSTGRES_PASSWORD",
+          service: "db",
+          label: "Database password",
+          help: "Auto-generated. The Postgres password PostHog uses.",
+          generate: "secret",
+          secret: true
+        },
+        {
+          key: "POSTHOG_SECRET",
+          service: "web",
+          label: "Django secret key",
+          help: "Auto-generated. Signs sessions and cookies (SECRET_KEY).",
+          generate: "secret",
+          secret: true
+        },
+        {
+          key: "MINIO_ROOT_USER",
+          service: "objectstorage",
+          label: "Object-storage access key",
+          help: "The S3 access key PostHog uses against its bundled MinIO (session recordings).",
+          type: "text",
+          default: "posthog",
+          required: true
+        },
+        {
+          key: "MINIO_ROOT_PASSWORD",
+          service: "objectstorage",
+          label: "Object-storage secret key",
+          help: "Auto-generated. The S3 secret key for the bundled MinIO.",
+          generate: "secret",
+          secret: true
+        }
+      ],
+      management: {
+        kind: "schema"
+      },
+      prepare: [
+        {
+          service: "objectstorage",
+          command: 'mc alias set local http://127.0.0.1:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" > /dev/null && mc mb --ignore-existing local/posthog > /dev/null && printf %s posthog',
+          capture: "bucket",
+          phase: "post-ready",
+          readiness: {
+            test: 'mc alias set local http://127.0.0.1:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"',
+            interval: 1e3,
+            retries: 30
+          },
+          once: true
+        }
+      ],
+      connection: {
+        title: "Open PostHog",
+        description: "Open the PostHog UI and create your admin account on first load.",
+        guide: {
+          intro: "PostHog runs its own analytics UI \u2014 create the admin account when you first open it.",
+          defaultMode: "public"
+        },
+        outputs: [
+          {
+            id: "ui",
+            label: "PostHog",
+            source: "publicUrl:web",
+            kind: "url",
+            help: "PostHog has no default login \u2014 the first visitor creates the admin account."
+          }
+        ],
+        firstLogin: {
+          note: "PostHog ships no default credentials \u2014 open the URL above and sign up to create the first (admin) account."
+        }
+      },
+      endpoints: [
+        {
+          service: "web",
+          port: 8e3,
+          label: "PostHog",
+          kind: "http"
+        }
+      ]
+    },
+    {
+      available: true,
+      verified: true,
+      id: "redis",
+      name: "Valkey (Redis)",
+      description: "In-memory data store for caching, sessions, rate limits, and queues \u2014 Valkey, the open-source Redis fork. Drop-in Redis-compatible: point any redis client at it.",
+      kind: "template",
+      logo: "valkey",
+      category: "database",
+      tags: [
+        "cache",
+        "redis",
+        "valkey",
+        "key-value",
+        "queue"
+      ],
+      framework: "docker-compose",
+      services: [
+        {
+          name: "valkey",
+          image: "valkey/valkey:8.1-alpine",
+          command: "valkey-server /etc/valkey/valkey.conf",
+          ports: [
+            "6379:6379"
+          ],
+          volumes: [
+            "valkey_data:/data"
+          ],
+          healthcheck: {
+            test: [
+              "CMD-SHELL",
+              'valkey-cli --no-auth-warning -a "$VALKEY_PASSWORD" ping | grep -q PONG'
+            ],
+            interval: "10s",
+            timeout: "5s",
+            retries: 5,
+            startPeriod: "10s"
+          },
+          restart: "unless-stopped"
+        }
+      ],
+      configFields: [
+        {
+          key: "VALKEY_PASSWORD",
+          service: "valkey",
+          label: "Password",
+          help: "Auto-generated. Required by every client (Valkey's `requirepass` auth).",
+          generate: "secret",
+          secret: true
+        }
+      ],
+      files: [
+        {
+          service: "valkey",
+          path: "/etc/valkey/valkey.conf",
+          content: "requirepass {{config:VALKEY_PASSWORD}}\nappendonly yes\nappendfsync everysec\nsave 300 100\n"
+        }
+      ],
+      management: {
+        kind: "schema"
+      },
+      connection: {
+        title: "Connect to Valkey",
+        description: "A Redis-compatible endpoint. Point any redis client at the URL below \u2014 it already carries the password.",
+        guide: {
+          intro: "Your project gets a Redis-compatible cache, ready to use.",
+          useHint: "Read `process.env.REDIS_URL` in your code \u2014 it's set the next time your project deploys.",
+          defaultMode: "internal"
+        },
+        outputs: [
+          {
+            id: "url",
+            label: "Connection URL",
+            source: "template:redis://:{{env:valkey:VALKEY_PASSWORD}}@{{host}}:6379",
+            sourceLabel: "Public",
+            variants: [
+              {
+                id: "internal",
+                label: "Internal",
+                source: "template:redis://:{{env:valkey:VALKEY_PASSWORD}}@valkey:6379"
+              }
+            ],
+            secret: true,
+            envKey: "REDIS_URL",
+            recommended: true,
+            help: "Redis-protocol URL with the password embedded. Published on port 6379. Switch to Internal for apps on the same project network."
+          },
+          {
+            id: "password",
+            label: "Password",
+            source: "env:valkey:VALKEY_PASSWORD",
+            secret: true,
+            envKey: "REDIS_PASSWORD",
+            width: "half"
+          }
+        ]
+      },
+      provides: [
+        {
+          id: "redis",
+          outputRefs: [
+            "url"
+          ],
+          category: "database"
+        }
+      ],
+      endpoints: [
+        {
+          service: "valkey",
+          port: 6379,
+          label: "Redis / Valkey",
+          kind: "tcp"
+        }
+      ]
+    },
+    {
+      available: true,
+      verified: true,
+      id: "umami",
+      name: "Umami",
+      description: "Privacy-friendly, cookie-free web analytics \u2014 a self-hosted alternative to Google Analytics. Add one script tag to your site and see traffic in a clean dashboard you own.",
+      kind: "template",
+      logo: "umami",
+      category: "analytics",
+      tags: [
+        "analytics",
+        "web-analytics",
+        "privacy",
+        "statistics"
+      ],
+      framework: "docker-compose",
+      services: [
+        {
+          name: "umami",
+          image: "ghcr.io/umami-software/umami:postgresql-v2.19.0",
+          exposedPort: 3e3,
+          exposed: true,
+          ports: [
+            "3000:3000"
+          ],
+          routes: [
+            {
+              port: 3e3
+            }
+          ],
+          dependsOn: [
+            "umami-db"
+          ],
+          environment: {
+            DATABASE_TYPE: "postgresql",
+            DATABASE_URL: "postgresql://umami:{{config:POSTGRES_PASSWORD}}@umami-db:5432/umami"
+          },
+          secretEnv: [
+            "DATABASE_URL"
+          ],
+          healthcheck: {
+            test: [
+              "CMD-SHELL",
+              "wget -q -O - http://127.0.0.1:3000/api/heartbeat 2>&1 | grep -q ok"
+            ],
+            interval: "10s",
+            timeout: "5s",
+            retries: 10,
+            startPeriod: "30s"
+          },
+          restart: "unless-stopped"
+        },
+        {
+          name: "umami-db",
+          image: "postgres:16-alpine",
+          environment: {
+            POSTGRES_DB: "umami",
+            POSTGRES_USER: "umami"
+          },
+          secretEnv: [
+            "POSTGRES_PASSWORD"
+          ],
+          volumes: [
+            "umami_db:/var/lib/postgresql/data"
+          ],
+          healthcheck: {
+            test: [
+              "CMD-SHELL",
+              "pg_isready -U umami -d umami"
+            ],
+            interval: "10s",
+            timeout: "5s",
+            retries: 5,
+            startPeriod: "10s"
+          },
           restart: "unless-stopped"
         }
       ],
       configFields: [
         {
-          key: "SPRING_SECURITY_USER_PASSWORD",
-          service: "kafka-ui",
-          label: "Kafka UI password",
-          help: "Auto-generated. The password to sign in to the Kafka UI web console (username: admin).",
+          key: "POSTGRES_PASSWORD",
+          service: "umami-db",
+          label: "Database password",
+          help: "Auto-generated. The password for Umami's Postgres database.",
+          generate: "secret",
+          secret: true
+        },
+        {
+          key: "APP_SECRET",
+          service: "umami",
+          label: "App secret",
+          help: "Auto-generated. Signs Umami's session tokens \u2014 keep it stable.",
           generate: "secret",
           secret: true
         }
@@ -5091,123 +6592,205 @@ COMMIT;
         kind: "schema"
       },
       connection: {
-        title: "Connect to Kafka",
-        description: "Open the Kafka UI to browse topics and messages, or point a client at the broker from another service in this project.",
+        title: "Connect to Umami",
+        description: "Open the Umami dashboard and sign in, then add your website to get its tracking script.",
+        guide: {
+          intro: "Your project gets a self-hosted Umami analytics dashboard.",
+          useHint: "Sign in, add your website under Settings \u2192 Websites, and paste the tracking snippet into your site's <head>."
+        },
+        firstLogin: {
+          username: "admin",
+          password: "umami",
+          note: "Change this password immediately from Settings \u2192 Profile after your first sign-in."
+        },
         outputs: [
           {
-            id: "ui",
-            label: "Kafka UI",
-            source: "publicUrl:kafka-ui",
+            id: "dashboard",
+            label: "Dashboard",
+            source: "publicUrl:umami",
             kind: "url",
+            envKey: "UMAMI_URL",
+            recommended: true,
             help: "Sign in with the username + password below."
-          },
-          {
-            id: "uiUser",
-            label: "UI username",
-            source: "env:kafka-ui:SPRING_SECURITY_USER_NAME"
-          },
-          {
-            id: "uiPassword",
-            label: "UI password",
-            source: "env:kafka-ui:SPRING_SECURITY_USER_PASSWORD",
-            secret: true
-          },
-          {
-            id: "broker",
-            label: "Bootstrap server (internal)",
-            source: "template:kafka:9092",
-            help: "Reachable as kafka:9092 from other services in this project \u2014 connect an app to it."
           }
         ]
       },
       endpoints: [
         {
-          service: "kafka-ui",
-          port: 8080,
-          label: "Kafka UI",
+          service: "umami",
+          port: 3e3,
+          label: "Dashboard",
           kind: "http"
+        },
+        {
+          service: "umami-db",
+          port: 5432,
+          label: "Database",
+          kind: "tcp"
         }
       ]
     },
     {
       available: true,
       verified: true,
-      id: "qdrant",
-      name: "Qdrant",
-      description: "High-performance vector database for AI search, RAG, and embeddings \u2014 with the built-in Qdrant Web UI for browsing collections and running queries.",
+      unlisted: true,
+      id: "webmail",
+      name: "Openship Webmail",
+      description: "A fast, self-hosted webmail client. Point it at any IMAP/SMTP mailbox \u2014 an Openship Mail server, Gmail, Fastmail, or your company's \u2014 and read, search and send from a clean UI on your own domain. Nothing is stored outside your server.",
       kind: "template",
-      logo: "qdrant",
-      category: "backend",
+      logo: "webmail",
+      category: "mail",
       tags: [
-        "database",
-        "vector",
-        "ai",
-        "search",
-        "rag",
-        "embeddings"
+        "mail",
+        "webmail",
+        "email",
+        "imap",
+        "smtp"
       ],
       framework: "docker-compose",
+      repository: "https://github.com/Mail-0/Zero",
       services: [
         {
-          name: "qdrant",
-          image: "qdrant/qdrant:v1.18.3",
-          ports: [
-            "6333:6333"
-          ],
-          exposedPort: 6333,
+          name: "webmail",
+          image: "ghcr.io/oblien/openship-webmail:latest",
+          exposedPort: 4080,
           exposed: true,
-          routes: [
-            {
-              port: 6333
-            }
-          ],
-          secretEnv: [
-            "QDRANT__SERVICE__API_KEY"
-          ],
           volumes: [
-            "qdrant_storage:/qdrant/storage"
+            "webmail_data:/data"
           ],
+          environment: {
+            TRUSTED_ORIGINS: "{{publicUrl:webmail}}"
+          },
           restart: "unless-stopped"
         }
       ],
       configFields: [
         {
-          key: "QDRANT__SERVICE__API_KEY",
-          service: "qdrant",
-          label: "API key",
-          help: "Auto-generated. Required as the `api-key` header on every request, and to open the Web UI.",
+          key: "SESSION_ENCRYPTION_KEY",
+          service: "webmail",
+          label: "Session encryption key",
+          help: "Auto-generated (32 random bytes, hex). Encrypts each signed-in user's IMAP password at rest. Changing it signs everyone out; they just sign in again.",
+          generate: "secret",
+          secret: true
+        },
+        {
+          key: "BRANDING_ADMIN_TOKEN",
+          service: "webmail",
+          label: "Branding admin token",
+          help: "Auto-generated. Lets Openship write this webmail's white-label login page (logo, name, colors) over its admin API. Nothing else accepts it.",
           generate: "secret",
           secret: true
         }
       ],
+      settings: [
+        {
+          id: "backend",
+          label: "Mail backend",
+          description: "Which IMAP/SMTP server this webmail talks to. Leave the hosts blank and each address resolves to mail.<its own domain> at sign-in \u2014 the convention Openship Mail and iRedMail install. Set them to pin every mailbox to one server. Users can still override host and port on the sign-in screen.",
+          fields: [
+            {
+              key: "DEFAULT_IMAP_HOST",
+              service: "webmail",
+              label: "IMAP host",
+              help: "Where mail is read from. Blank \u2192 mail.<domain of the address signing in>.",
+              type: "text",
+              placeholder: "mail.example.com",
+              installStep: true,
+              requiresRedeploy: true
+            },
+            {
+              key: "DEFAULT_SMTP_HOST",
+              service: "webmail",
+              label: "SMTP host",
+              help: "Where mail is sent through. Blank \u2192 mail.<domain of the address signing in>.",
+              type: "text",
+              placeholder: "mail.example.com",
+              installStep: true,
+              requiresRedeploy: true
+            },
+            {
+              key: "DEFAULT_IMAP_PORT",
+              service: "webmail",
+              label: "IMAP port",
+              help: "Blank \u2192 993 (IMAPS). TLS is always required.",
+              type: "number",
+              integer: true,
+              min: 1,
+              max: 65535,
+              placeholder: "993",
+              advanced: true,
+              installStep: true,
+              requiresRedeploy: true
+            },
+            {
+              key: "DEFAULT_SMTP_PORT",
+              service: "webmail",
+              label: "SMTP port",
+              help: "Blank \u2192 587 (submission, STARTTLS). Use 465 for implicit TLS \u2014 the port alone selects the mode, and TLS is required either way.",
+              type: "number",
+              integer: true,
+              min: 1,
+              max: 65535,
+              placeholder: "587",
+              advanced: true,
+              installStep: true,
+              requiresRedeploy: true
+            }
+          ]
+        },
+        {
+          id: "access",
+          label: "Access",
+          description: "Where this webmail is reached from. Filled in from the hostname you route it on \u2014 override it only when something in front of it changes the origin the browser sees.",
+          fields: [
+            {
+              key: "TRUSTED_ORIGINS",
+              service: "webmail",
+              label: "Trusted origins",
+              help: "Comma-separated origins allowed to sign in \u2014 scheme + host, no path. Defaults to this app's own public URL. Set it when the app is served through a proxy Openship doesn't route, e.g. an Openship Mail server fronting mail.<domain> for a cloud deploy.",
+              type: "text",
+              placeholder: "https://mail.example.com",
+              advanced: true,
+              requiresRedeploy: true
+            }
+          ]
+        }
+      ],
       management: {
         kind: "schema"
       },
       connection: {
-        title: "Connect to Qdrant",
-        description: "Open the Qdrant Web UI in your browser (it lives under /dashboard), or point a client at the REST API. Every request needs the API key below.",
+        title: "Sign in to Webmail",
+        description: "Open the webmail URL and sign in with a full email address and its mailbox password. There is no separate account to create \u2014 the mailbox on your IMAP server is the account.",
+        guide: {
+          intro: "Your project runs its own webmail client. It holds no mail: every message is read live from IMAP, and only encrypted session credentials and per-user settings live on disk.",
+          useHint: "Webmail is domain-only by design: sessions use Secure cookies, so sign-in never completes over plain http, and the container publishes nothing to the host \u2014 the edge reaches it on loopback. Point a hostname at it and TLS is issued automatically.",
+          defaultMode: "public"
+        },
         outputs: [
           {
-            id: "ui",
-            label: "Qdrant Web UI",
-            source: "publicUrl:qdrant",
+            id: "webmail",
+            label: "Webmail",
+            source: "publicUrl:webmail",
             kind: "url",
-            help: "The dashboard is at this URL under /dashboard. Paste the API key when it asks."
-          },
-          {
-            id: "restUrl",
-            label: "REST API",
-            source: "publicUrl:qdrant"
-          },
-          {
-            id: "apiKey",
-            label: "API key",
-            source: "env:qdrant:QDRANT__SERVICE__API_KEY",
-            secret: true,
-            help: "Send it as the `api-key` header on every request."
+            envKey: "WEBMAIL_URL",
+            recommended: true,
+            help: "Sign in with an email address on your mail server and its mailbox password."
           }
         ]
-      }
+      },
+      endpoints: [
+        {
+          service: "webmail",
+          port: 4080,
+          label: "Webmail",
+          kind: "http",
+          defaultMode: "domain",
+          allowedModes: [
+            "domain"
+          ]
+        }
+      ]
     }
   ]
 };
@@ -19749,9 +21332,19 @@ function compareSemver(a, b) {
 }
 
 // ../../packages/core/src/apps/schema.ts
+var serviceBuild = external_exports.object({
+  /** Full Dockerfile contents (inline). COPY sources are `<service-name>/<path>`. */
+  dockerfile: external_exports.string(),
+  /** Extra build-context files (COPY targets, scripts); `path` is relative to
+   *  this service's subdir — COPY it as `<service-name>/<path>`. */
+  files: external_exports.array(external_exports.object({ path: external_exports.string(), content: external_exports.string() })).optional()
+});
 var serviceSpec = external_exports.object({
   name: external_exports.string(),
-  image: external_exports.string(),
+  /** Prebuilt image to pull. Exactly one of `image`/`build` must be set per service. */
+  image: external_exports.string().optional(),
+  /** Inline build context (see `serviceBuild`) — mutually exclusive with `image`. */
+  build: serviceBuild.optional(),
   ports: external_exports.array(external_exports.string()).optional(),
   exposedPort: external_exports.number().optional(),
   routes: external_exports.array(external_exports.object({ port: external_exports.number(), slugSuffix: external_exports.string().optional() })).optional(),
@@ -19931,7 +21524,24 @@ var appTemplateSchema = external_exports.object({
   provides: external_exports.array(provides).optional(),
   requires: external_exports.array(requires).optional(),
   available: external_exports.boolean().optional(),
+  // What the app needs from the machine, matched against the host's real capacity
+  // before it installs (see `fitsCapacity`). Only what a host can be PROBED for —
+  // RAM and vCPU — because a requirement we can't verify is a refusal based on a
+  // guess. Absent ⇒ no preflight, which is right for almost every app.
+  minResources: external_exports.object({
+    memoryMb: external_exports.number().positive().optional(),
+    cpuCores: external_exports.number().positive().optional()
+  }).optional(),
   verified: external_exports.boolean().optional(),
+  // Hidden from the browsable catalog while staying fully installable — for an app
+  // reached through another app's wizard rather than the grid. NOT `available:
+  // false`, which is a refusal ("app-not-available"), not a listing choice.
+  unlisted: external_exports.boolean().optional(),
+  // How the app is hosted, for an honest catalog badge + wizard notice. Absent ⇒
+  // "self-hosted" (the default: runs on the user's own server). "experimental" =
+  // self-host that runs but isn't production-grade (heavy/unsupported). Purely
+  // presentational; additive. Every catalog app is something Openship runs.
+  hosting: external_exports.enum(["self-hosted", "experimental"]).optional(),
   // Versioning / compat gate (see parseAppTemplate).
   schemaVersion: external_exports.number().optional(),
   minEngine: external_exports.string().optional(),
@@ -19975,6 +21585,17 @@ var appTemplateSchema = external_exports.object({
   if (data.flowHref !== void 0 && !data.flowHref.startsWith("/")) {
     ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["flowHref"], message: "flowHref must be an internal route starting with /" });
   }
+  (data.services ?? []).forEach((s, i) => {
+    const hasImage = typeof s.image === "string" && s.image.length > 0;
+    const hasBuild = !!s.build;
+    if (hasImage === hasBuild) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["services", i],
+        message: `service "${s.name}" must set exactly one of image|build`
+      });
+    }
+  });
   const outputIds = new Set((data.connection?.outputs ?? []).map((o) => o.id));
   (data.provides ?? []).forEach((p, i) => {
     p.outputRefs.forEach((ref, j) => {
@@ -20065,6 +21686,13 @@ var AUDIT_EVENTS = {
     tone: "warning",
     description: "A deployment was stopped before it finished."
   },
+  "deployment.no_changes": {
+    category: "deployments",
+    action: "found no changes to deploy for",
+    label: "No changes to deploy",
+    tone: "info",
+    description: "A redeploy found every service already up to date, so the current release stayed live."
+  },
   "deployment:write": {
     category: "deployments",
     action: "started a deploy for",
@@ -20182,6 +21810,13 @@ var AUDIT_EVENTS = {
     tone: "success",
     description: "An outage ended and the container is healthy again."
   },
+  "service.exec": {
+    category: "apps",
+    action: "ran a command in",
+    label: "Command executed in container",
+    tone: "warning",
+    description: "A shell command was run inside a service's container. The command is recorded; its output is not, because output is unbounded and may contain secrets the command read."
+  },
   /* ---------------- Domains & SSL ---------------- */
   "domain.added": {
     category: "domains",
@@ -20209,12 +21844,30 @@ var AUDIT_EVENTS = {
     tone: "warning",
     description: "DNS records for this domain don't point here yet."
   },
+  // The name the AUDIT row carries — `verify` and `verifyStream` both write it,
+  // while the notification namespace uses `verification_failed` above. Both are
+  // catalogued rather than renamed: the event type is a stored, queryable column,
+  // so a rename would orphan every row already written on an operator's instance.
+  "domain.verify_failed": {
+    category: "domains",
+    action: "failed to verify the domain",
+    label: "Domain verification failed",
+    tone: "warning",
+    description: "DNS records for this domain don't point here yet."
+  },
   "domain.set_primary": {
     category: "domains",
     action: "made primary the domain",
     label: "Primary domain changed",
     description: "The domain other addresses now redirect to."
   },
+  "domain.dns_provisioned": {
+    category: "domains",
+    action: "provisioned DNS for",
+    label: "DNS records provisioned",
+    tone: "info",
+    description: "Openship wrote this domain's records at the connected DNS provider. The counts of applied and failed records are in the details."
+  },
   "domain.cert_uploaded": {
     category: "domains",
     action: "uploaded a certificate for",
@@ -20228,6 +21881,20 @@ var AUDIT_EVENTS = {
     tone: "danger",
     description: "Automatic renewal failed \u2014 the certificate will expire unless this is fixed."
   },
+  "dns_credential.connected": {
+    category: "domains",
+    action: "connected the DNS provider",
+    label: "DNS provider connected",
+    tone: "info",
+    description: "An API token that lets Openship write this organization's DNS records was stored. The token itself is never recorded."
+  },
+  "dns_credential.disconnected": {
+    category: "domains",
+    action: "disconnected the DNS provider",
+    label: "DNS provider disconnected",
+    tone: "warning",
+    description: "Openship can no longer write DNS records for domains in that provider's zones; records already written are left in place."
+  },
   "domain:write": {
     category: "domains",
     action: "changed the domain",
@@ -20258,6 +21925,13 @@ var AUDIT_EVENTS = {
     label: "Server removed",
     tone: "danger"
   },
+  "server.exec": {
+    category: "servers",
+    action: "ran a command on the server",
+    label: "Command executed",
+    tone: "warning",
+    description: "A shell command was run on the host. The command is recorded; its output is not, because output is unbounded and may contain secrets the command read."
+  },
   "server.unreachable": {
     category: "servers",
     action: "reported unreachable",
@@ -20423,6 +22097,20 @@ var AUDIT_EVENTS = {
     tone: "warning",
     description: "An existing grant was overwritten with a different scope."
   },
+  "mcp.authorized": {
+    category: "members",
+    action: "authorized the MCP client",
+    label: "MCP client authorized",
+    tone: "info",
+    description: "An AI agent was connected and given a scope to act within."
+  },
+  "mcp.scope_changed": {
+    category: "members",
+    action: "changed the access of the MCP client",
+    label: "MCP access changed",
+    tone: "warning",
+    description: "A connected agent's scope was edited. It takes effect on the agent's next request \u2014 no reconnect."
+  },
   "grant.materialized": {
     category: "members",
     action: "received their pending permissions,",
@@ -20700,6 +22388,18 @@ var AUDIT_EVENTS = {
     label: "Backup failed",
     tone: "danger"
   },
+  "backup_restore.completed": {
+    category: "system",
+    action: "restored",
+    label: "Restore completed",
+    tone: "success"
+  },
+  "backup_restore.failed": {
+    category: "system",
+    action: "failed to restore",
+    label: "Restore failed",
+    tone: "danger"
+  },
   "backup.webhook.fired": {
     category: "system",
     action: "triggered a backup of",
@@ -20750,6 +22450,316 @@ var EVENT_TYPES_BY_CATEGORY = (() => {
   return map2;
 })();
 
+// ../../packages/core/src/access-grants.ts
+var ORG_SINGLETON_RESOURCE_TYPES = [
+  "billing",
+  "audit",
+  "analytics",
+  "github",
+  "permissions",
+  "settings",
+  "job",
+  "cloud",
+  "terminal",
+  "notifications",
+  "updates"
+];
+var ORG_SINGLETON_SET = new Set(ORG_SINGLETON_RESOURCE_TYPES);
+function isOrgSingletonResourceType(type) {
+  return ORG_SINGLETON_SET.has(type);
+}
+var GRANTABLE_RESOURCE_TYPES = [
+  "project",
+  // Authorized by canUseGitHubRepo, NOT by checkPermission — see github-access.ts.
+  "github_installation",
+  "github_repository",
+  "server",
+  "mail_server",
+  "backup_destination",
+  // Platform features, granted at resourceId "*".
+  "job",
+  "notifications",
+  "analytics",
+  "updates",
+  "settings",
+  "cloud",
+  "audit",
+  "billing"
+];
+var GRANTABLE_SET = new Set(GRANTABLE_RESOURCE_TYPES);
+var RESOURCE_GRANT_TYPES = GRANTABLE_RESOURCE_TYPES.filter((t) => !isOrgSingletonResourceType(t));
+var PLATFORM_GRANT_TYPES = GRANTABLE_RESOURCE_TYPES.filter((t) => isOrgSingletonResourceType(t));
+var PRIMARY_GRANT_TYPES = [
+  "project",
+  "github_installation",
+  "github_repository"
+];
+var PRIMARY_SET = new Set(PRIMARY_GRANT_TYPES);
+var INFRASTRUCTURE_GRANT_TYPES = RESOURCE_GRANT_TYPES.filter((t) => !PRIMARY_SET.has(t));
+var SENSITIVE_GRANT_TYPES = ["billing", "audit"];
+var SENSITIVE_SET = new Set(SENSITIVE_GRANT_TYPES);
+var SELF_HOSTED_ONLY_GRANT_TYPES = [
+  "server",
+  "mail_server",
+  // The jobs router is `localOnly`, so on the hosted control plane every job route
+  // 404s regardless of the grant.
+  "job"
+];
+var CLOUD_ONLY_GRANT_TYPES = ["billing"];
+var SELF_HOSTED_ONLY_SET = new Set(SELF_HOSTED_ONLY_GRANT_TYPES);
+var CLOUD_ONLY_SET = new Set(CLOUD_ONLY_GRANT_TYPES);
+
+// ../../packages/core/src/host-profile.ts
+var FAMILY_BY_DISTRO = {
+  ubuntu: "debian",
+  debian: "debian",
+  rhel: "rhel",
+  centos: "rhel",
+  fedora: "rhel",
+  rocky: "rhel",
+  almalinux: "rhel",
+  oracle: "rhel",
+  amzn: "rhel",
+  alpine: "alpine",
+  opensuse: "suse",
+  arch: "arch"
+};
+var DISTRO_BY_ID = {
+  ubuntu: "ubuntu",
+  debian: "debian",
+  rhel: "rhel",
+  "rhel server": "rhel",
+  redhat: "rhel",
+  centos: "centos",
+  fedora: "fedora",
+  rocky: "rocky",
+  almalinux: "almalinux",
+  alma: "almalinux",
+  ol: "oracle",
+  // Oracle Linux. The ID that looks like nothing.
+  oracle: "oracle",
+  amzn: "amzn",
+  alpine: "alpine",
+  opensuse: "opensuse",
+  "opensuse-leap": "opensuse",
+  "opensuse-tumbleweed": "opensuse",
+  sles: "opensuse",
+  arch: "arch",
+  archarm: "arch"
+};
+var FAMILY_BY_ID_LIKE = {
+  debian: "debian",
+  ubuntu: "debian",
+  rhel: "rhel",
+  fedora: "rhel",
+  centos: "rhel",
+  "rhel-fedora": "rhel",
+  alpine: "alpine",
+  suse: "suse",
+  opensuse: "suse",
+  arch: "arch"
+};
+function parseOsRelease(text) {
+  const out = {};
+  for (const rawLine of text.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const key = line.slice(0, eq).trim().toUpperCase();
+    let value = line.slice(eq + 1).trim();
+    if (value.length >= 2 && (value.startsWith('"') || value.startsWith("'"))) {
+      const quote = value[0];
+      if (value.endsWith(quote)) value = value.slice(1, -1);
+    }
+    out[key] = value;
+  }
+  return out;
+}
+function classifyDistro(id, idLike) {
+  const normalizedId = id?.trim().toLowerCase() ?? "";
+  const distro = DISTRO_BY_ID[normalizedId] ?? "unknown";
+  if (distro !== "unknown") return { distro, family: FAMILY_BY_DISTRO[distro] };
+  for (const token of (idLike ?? "").trim().toLowerCase().split(/\s+/)) {
+    const family = token ? FAMILY_BY_ID_LIKE[token] : void 0;
+    if (family) return { distro: "unknown", family };
+  }
+  return { distro: "unknown", family: "unknown" };
+}
+function parseSystemOs(uname) {
+  const value = uname?.trim().toLowerCase();
+  if (value === "linux") return "linux";
+  if (value === "darwin") return "darwin";
+  return "unknown";
+}
+function parseSystemArch(uname) {
+  const value = uname?.trim().toLowerCase();
+  if (!value) return "unknown";
+  if (["x86_64", "amd64", "x64"].includes(value)) return "amd64";
+  if (["aarch64", "arm64", "armv8l"].includes(value)) return "arm64";
+  return "unknown";
+}
+var SUPPORTED = { supported: true, unsupportedReason: null };
+function refuse(reason) {
+  return { supported: false, unsupportedReason: reason };
+}
+function assessHostSupport(facts) {
+  if (facts.probeError) {
+    return refuse(
+      `Openship could not measure this host: the probe never finished, so nothing below is a fact about the box. A loaded machine, a dropped SSH channel or a shell that cannot run a script all look like this. Openship's own diagnostic: ${JSON.stringify(facts.probeError)}`
+    );
+  }
+  if (facts.forcedCommand) {
+    return refuse(
+      `This host answered Openship's probe with something other than the probe's output, so nothing about it could be measured. An sshd forced command (\`ForceCommand\`, or \`command=\` in authorized_keys) is the usual cause \u2014 AWS AMIs ship one on root's key and expect you to connect as ec2-user instead. It said: ${JSON.stringify(facts.forcedCommand)}`
+    );
+  }
+  if (facts.os === "unknown") {
+    const observed = facts.osRaw?.trim();
+    return refuse(
+      observed ? `Openship drives Linux hosts (and macOS locally); this one reports \`uname -s\` as ${JSON.stringify(observed)}, which it has no provisioning path for.` : "Could not determine this host's operating system (`uname -s` returned nothing usable)."
+    );
+  }
+  if (facts.arch === "unknown") {
+    const observed = facts.archRaw?.trim();
+    return refuse(
+      observed ? `Openship has no build for this host's CPU architecture (\`uname -m\` reported ${JSON.stringify(observed)}), and it will not guess \u2014 every release artifact it downloads is architecture-specific. x86_64/amd64 and aarch64/arm64 are supported.` : "Could not determine this host's CPU architecture (`uname -m` returned nothing usable), and Openship will not guess \u2014 the release artifacts it downloads are architecture-specific."
+    );
+  }
+  if (facts.os === "darwin") return SUPPORTED;
+  switch (facts.distroFamily) {
+    case "debian":
+    case "rhel":
+    case "alpine":
+      break;
+    case "suse":
+      return refuse(
+        `Openship doesn't drive openSUSE/SLES hosts${idSuffix(facts.distroId)} \u2014 it has no zypper provisioning path. Debian/Ubuntu, the RHEL family (including Amazon Linux) and Alpine are supported.`
+      );
+    case "arch":
+      return refuse(
+        `Openship doesn't drive Arch hosts${idSuffix(facts.distroId)} \u2014 it has no pacman provisioning path. Debian/Ubuntu, the RHEL family (including Amazon Linux) and Alpine are supported.`
+      );
+    case "unknown":
+      if (facts.packageManager === "none") {
+        return refuse(
+          `Unrecognized Linux distribution${idSuffix(facts.distroId)} with no usable package manager. Openship could not match it to a supported family from its os-release ID or ID_LIKE, and found none of apt-get, dnf, yum or apk. Debian/Ubuntu, the RHEL family (including Amazon Linux) and Alpine are supported.`
+        );
+      }
+      return SUPPORTED;
+    default: {
+      const unwired = facts.distroFamily;
+      return refuse(
+        `Openship has no provisioning path for this host's Linux family (${JSON.stringify(String(unwired))})${idSuffix(facts.distroId)}. Debian/Ubuntu, the RHEL family (including Amazon Linux) and Alpine are supported.`
+      );
+    }
+  }
+  if (facts.packageManager === "none") {
+    return refuse(
+      `No usable package manager found on this host (expected one of apt-get, dnf, yum or apk for a ${facts.distroFamily}-family system).`
+    );
+  }
+  return SUPPORTED;
+}
+function idSuffix(distroId) {
+  return distroId ? ` (os-release ID=${JSON.stringify(distroId)})` : "";
+}
+
+// ../../packages/adapters/src/system/errors.ts
+var SSH_AUTH_ERROR_PATTERNS = [
+  "All configured authentication methods failed"
+];
+var RETRYABLE_CONNECTION_ERROR_PATTERNS = [
+  "ECONNRESET",
+  "ECONNREFUSED",
+  "ETIMEDOUT",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "Timed out",
+  "Not connected",
+  "Connection lost",
+  "read ECONNRESET",
+  "Handshake failed",
+  "keepalive timeout",
+  "SSH connection closed before ready",
+  // ssh2 emits "Channel open failure: open failed" / "Channel open failure: …"
+  // when the SSH SERVER refuses a new channel - typically because the cached
+  // connection has gone half-dead (peer-side LOGOUT, network blip,
+  // remote sshd MaxSessions). The inner SshExecutor retries `exec`/
+  // `streamExec` on this, but `pipeLocal`, `transferIn`, and any other
+  // channel-bearing op bubble it up. Listing it here lets `withExecutor`
+  // drop the dead connection and retry transparently - fixes the
+  // "first redeploy fails, second click works" pattern.
+  "Channel open failure",
+  "open failed"
+  // NOT "socket hang up": it is what an HTTP client reports for ANY far end that vanished
+  // mid-request, including a permission-denied Docker socket and a wedged channel, neither
+  // of which a fresh connection fixes. A match here makes `withExecutor` replay its whole
+  // callback — and those callbacks install mail, create mailboxes and ensure the edge, so a
+  // non-retryable cause becomes a repeated mutation. `core/connectivity.ts` labels it
+  // without retrying, `api/lib/remote-state.ts` still maps it to a 503, and the bridge's
+  // 502 carries the real reason — so leaving it out here costs no diagnosis.
+];
+var SshDisconnectedError = class extends Error {
+  constructor(message = "SSH connection lost") {
+    super(message);
+    this.name = "SshDisconnectedError";
+  }
+};
+function isSshDisconnectedError(err) {
+  return err instanceof SshDisconnectedError || err instanceof Error && err.name === "SshDisconnectedError";
+}
+function isSshAuthError(err) {
+  if (!(err instanceof Error)) return false;
+  return SSH_AUTH_ERROR_PATTERNS.some((pattern) => err.message.includes(pattern));
+}
+var HostChannelUnavailableError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "HostChannelUnavailableError";
+    this.code = code;
+  }
+};
+function isRetryableRemoteConnectionError(err) {
+  if (isSshDisconnectedError(err)) return true;
+  if (!(err instanceof Error)) return false;
+  return RETRYABLE_CONNECTION_ERROR_PATTERNS.some(
+    (pattern) => err.message.includes(pattern)
+  );
+}
+function isRemoteConnectionError(err) {
+  return isSshAuthError(err) || isRetryableRemoteConnectionError(err);
+}
+var MAX_COMMAND_CHARS = 120;
+function commandForError(command) {
+  const oneLine = command.trim().replace(/\s+/g, " ");
+  return oneLine.length > MAX_COMMAND_CHARS ? `${oneLine.slice(0, MAX_COMMAND_CHARS)}\u2026 (${command.length} chars)` : oneLine;
+}
+function isRuntimeNotFoundError(err) {
+  if (!err || typeof err !== "object") return false;
+  const e = err;
+  if (e.statusCode === 404) return true;
+  return typeof e.message === "string" && /no such (container|image|volume|network)/i.test(e.message);
+}
+
+// ../../packages/adapters/src/system/debug.ts
+function isTruthy(value) {
+  if (!value) return false;
+  return ["1", "true", "yes", "on", "debug"].includes(value.toLowerCase());
+}
+function isSystemDebugEnabled() {
+  return isTruthy(process.env.SYSTEM_DEBUG_LOGS);
+}
+function systemDebug(scope, message) {
+  if (!isSystemDebugEnabled()) return;
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  console.log(`[system-debug] ${timestamp} [${scope}] ${message}`);
+}
+function formatDuration(startMs) {
+  return `${Date.now() - startMs}ms`;
+}
+
 export {
   LANGUAGES,
   STACKS,
@@ -20758,8 +22768,14 @@ export {
   PACKAGE_ROOT_ONLY_EXCLUDES,
   packageManagerEnsureCommand,
   appVolumeTargets,
+  parseComposeNamespace,
+  ownsNetworkEndpoint,
+  composeMountToSpec,
+  composeMountIssues,
+  composePortToSpec,
   isAwsS3Endpoint,
   DEFAULT_IMAGE_REGISTRY,
+  shellQuote,
   shellSplitWords,
   commandToArgv,
   buildEdgeImageRef,
@@ -20769,6 +22785,7 @@ export {
   isValidEmail,
   formatBytes,
   withTimeout,
+  wrapText,
   AppError,
   DeployError,
   safeErrorMessage,
@@ -20787,5 +22804,38 @@ export {
   PROXY_DIRECTIVES,
   sanitizeProxySettings,
   resolveProxyDirectives,
-  parseProxyValue
+  parseProxyValue,
+  answered,
+  refused,
+  FAMILY_BY_DISTRO,
+  parseOsRelease,
+  classifyDistro,
+  parseSystemOs,
+  parseSystemArch,
+  assessHostSupport,
+  firewallManager,
+  firewallPersists,
+  firewallAllowSteps,
+  HOST_CHANNEL_UNAFFECTED,
+  HOST_CHANNEL_BLOCKED,
+  HOST_CHANNEL_SYMPTOM,
+  HOST_CHANNEL_PROVISION_COMMAND,
+  HOST_CHANNEL_RECHECK,
+  HOST_CHANNEL_NOT_PROVISIONED,
+  HOST_CHANNEL_UNPROVISIONED,
+  HOST_CHANNEL_OPT_OUT,
+  explainHostChannelCause,
+  summarizeHostChannelCause,
+  hostChannelRuleScope,
+  hostFirewallRule,
+  hostFirewallRuleRemoval,
+  SshDisconnectedError,
+  isSshAuthError,
+  HostChannelUnavailableError,
+  isRetryableRemoteConnectionError,
+  isRemoteConnectionError,
+  commandForError,
+  isRuntimeNotFoundError,
+  systemDebug,
+  formatDuration
 };