tiennm99
d4882c6f3e
Data encrypted under one secret is unreadable under another, so the secrets must move with the data instead of being regenerated by the image.
composes
My docker compose collection — one directory per service, each self-contained. Tuned to my own setup rather than written as general-purpose templates.
Services are deployed through Coolify, with Dokploy supported as an optional extra. The platform owns what a standalone compose file would otherwise declare:
- No published ports. The platform attaches the container to its proxy network and maps a domain to the internal port. Publishing one would also expose it on the host.
- No
container_name:. Compose derives it from the directory.
Every container does set restart: unless-stopped. Coolify would inject the
same value on its own, but Dokploy leaves an omitted policy alone, which in its
default compose mode means the container stays down after a reboot.
Services that publish ports or set container_name: say so in their own
README.
Layout
<service>/
compose.yml # the service definition
README.md # what it is, its variables, how it's wired
.env.example # required variables, committed
.env # real values, gitignored
Compose names the project after its directory, so code-server/ comes up as
the code-server project with its own network and volumes.
Each service README covers only its own service. Shared conventions live here
and are not repeated or linked from a service, so editing one service never
touches another's directory — each is a separate Coolify app deploying on a
<service>/** watch path.
Upstream sources
sources/ holds checkouts of the upstream repositories behind these images,
cloned as sources/<owner>/<repo> when a service needs debugging against its
real code. Only the empty directory is tracked; its contents are gitignored.
The debug-service skill in .claude/skills/ walks through the process.
Usage
In Coolify or Dokploy, point a Docker Compose resource at the service directory
and set the environment variables from its .env.example.
Locally:
cd <service>
cp .env.example .env # then fill it in
docker compose up -d
docker compose logs -f
docker compose down
.env is picked up automatically because it sits next to compose.yml. Never
commit it — the root .gitignore covers .env/*.env and re-includes
.env.example.
Services
Each links to its own README for variables, ports, and storage.
| Service | What it is |
|---|---|
| alloy | Grafana Alloy shipping host and Docker telemetry to Grafana Cloud |
| code-server | VS Code in the browser, as a remote dev box |
| couchbase | Couchbase Server |
| diun | Image-update notifier, reading the Docker API through a read-only proxy |
| gitea-mirror | Gitea + PostgreSQL + gitea-mirror, mirroring GitHub repos |
| goclaw | Multi-tenant AI agent gateway, with pgvector PostgreSQL |
| opencode | opencode coding agent, served as a browser UI |
| paseo | Paseo coding-agent daemon and web UI |
| traffmonetizer | TraffMonetizer bandwidth-sharing client |
Licensed under Apache 2.0 — see LICENSE.