feat: add Gitea private secure template and Passbolt template

public/svgs/passbolt.svg

@@ -0,0 +1 @@
+<svg width="2500" height="2305" viewBox="0 0 256 236" xmlns="http://www.w3.org/2000/svg" preserveAspectRatio="xMidYMid"><path d="M249.242 102.85L159.614 7.79c-9.4-9.969-25.1-10.431-35.069-1.032L58.17 69.34c12.508 8.279 22.01 20.714 26.566 35.332h94.898c13.242 0 13.242 31.837 0 31.837h-9.345v19.57c0 12.073-41.768 12.073-41.768 0v-19.57H86.495a65.752 65.752 0 0 1-21.049 36.999l51.23 54.334c9.398 9.968 25.1 10.43 35.068 1.031l96.466-90.954c9.97-9.399 10.431-25.1 1.032-35.069zm-222.37-6.064C12.032 96.785 0 108.816 0 123.656 0 138.5 12.031 150.53 26.872 150.53s26.872-12.031 26.872-26.873c0-14.84-12.03-26.871-26.872-26.871z" fill="#D40000"/></svg>

templates/compose/gitea-private-secure.yaml

@@ -0,0 +1,74 @@
+# documentation: https://docs.gitea.com
+# slogan: Gitea is a self-hosted, lightweight Git service, offering version control, collaboration, and code hosting.
+# tags: version control, collaboration, code, hosting, lightweight
+# logo: svgs/gitea.svg
+
+services:
+  gitea:
+    image: 'gitea/gitea:latest'
+    environment:
+      - SERVICE_FQDN_GITEA_3000
+      - USER_UID=1000
+      - USER_GID=1000
+      # Domain configuration
+      - GITEA__server__ROOT_URL=${GITEA_SERVER_ROOT_URL}
+      - GITEA__server__DOMAIN=${GITEA_SERVER_DOMAIN}
+      # Basic Security
+      - GITEA__service__REQUIRE_SIGNIN_VIEW=${GITEA_SERVICE_REQUIRE_SIGNIN_VIEW:true}
+      - GITEA__service__REGISTER_MANUAL_CONFIRM=${GITEA_SERVICE_REGISTER_MANUAL_CONFIRM:true}
+      - GITEA__service__REGISTER_EMAIL_CONFIRM=${GITEA_SERVICE_REGISTER_EMAIL_CONFIRM:false}
+      - GITEA__service__ENABLE_NOTIFY_MAIL=${GITEA_SERVICE_ENABLE_NOTIFY_MAIL:true}
+      - GITEA__service__DEFAULT_ALLOW_CREATE_ORGANIZATION=${GITEA_SERVICE_DEFAULT_ALLOW_CREATE_ORGANIZATION:false}
+      - GITEA__service__DEFAULT_USER_IS_RESTRICTED=${GITEA_SERVICE_DEFAULT_USER_IS_RESTRICTED:true}
+      - GITEA__service__DEFAULT_USER_VISIBILITY=${GITEA_SERVICE_DEFAULT_USER_VISIBILITY:private}
+      
+      # Additional Security
+      - GITEA__security__INSTALL_LOCK=true # Lock the installation to prevent unauthorized access
+      - GITEA__security__MIN_PASSWORD_LENGTH=12 # Minimum password length
+      - GITEA__security__PASSWORD_COMPLEXITY=off # Disable password complexity checks
+      - GITEA__security__PASSWORD_CHECK_PWN=true # Check if the password has been leaked
+      - GITEA__security__DISABLE_GIT_HOOKS=true # Disable Git hooks to prevent code execution
+      - GITEA__security__ONLY_ALLOW_PUSH_IF_GITEA_ENVIRONMENT_SET=true
+      
+      # Brute Force Protection
+      - GITEA__security__LOGIN_REMEMBER_DAYS=7
+      - GITEA__security__MAX_FAILED_LOGIN_ATTEMPTS=5
+      - GITEA__security__BLOCK_LOGIN_FAILURES_THRESHOLD=true # Block login attempts after reaching the threshold
+      - GITEA__security__BLOCK_LOGIN_FAILURES_DURATION=15m # Block login attempts for 15 minutes after reaching the threshold
+      
+      # Session Security
+      - GITEA__session__PROVIDER=file # Use file-based session provider 
+      - GITEA__session__SAME_SITE=strict # Set SameSite attribute to strict to prevent cross-site request forgery
+      - GITEA__session__COOKIE_SECURE=true # Ensure cookies are only sent over HTTPS
+      
+      # API Protection
+      - GITEA__api__ENABLE_SWAGGER=false # Disable Swagger API documentation to prevent leaking information
+      - GITEA__api__MAX_RESPONSE_ITEMS=50 # Limit the number of items returned in API responses
+      
+      # Other Restrictions
+      - GITEA__repository__DEFAULT_PRIVATE=true # Default repository visibility to private  
+      - GITEA__repository__DEFAULT_BRANCH=main # Default branch for new repositories
+      - GITEA__repository__DISABLE_HTTP_GIT=false
+      - GITEA__repository__USE_COMPAT_SSH_URI=true # Use compatible SSH URI format
+      
+      # Attack Protection
+      - GITEA__other__SHOW_FOOTER_VERSION=false # Hide version information in footer
+      - GITEA__other__SHOW_FOOTER_TEMPLATE_LOAD_TIME=false # Hide template load time in footer
+      
+    ports:
+      - '22222:22'
+    volumes:
+      - 'gitea-data:/data'
+      - 'gitea-timezone:/etc/timezone:ro'
+      - 'gitea-localtime:/etc/localtime:ro'
+    healthcheck:
+      test:
+        - CMD
+        - curl
+        - '-f'
+        - 'http://127.0.0.1:3000'
+      interval: 2s
+      timeout: 10s
+      retries: 15
+    security_opt:
+      - no-new-privileges:true

templates/compose/passbolt.yaml

@@ -0,0 +1,58 @@
+# documentation: https://help.passbolt.com/hosting/install/ce/docker?utm_source=coolify.io
+# slogan: Open source password manager for teams.
+# tags: "password manager", "security", "open source", "team"
+# logo: svgs/passbolt.svg
+# port: 80
+
+services:
+  passbolt:
+    image: 'passbolt/passbolt:latest-ce'
+    environment:
+      - SERVICE_FQDN_PASSBOLT_80
+      - 'APP_FULL_BASE_URL=${APP_FULL_BASE_URL}'
+      -
+        DATASOURCES_DEFAULT_HOST: passbolt-db
+      -
+        DATASOURCES_DEFAULT_USERNAME: '${SERVICE_USER_MYSQL}'
+      -
+        DATASOURCES_DEFAULT_PASSWORD: '${SERVICE_PASSWORD_MYSQL}'
+      -
+        DATASOURCES_DEFAULT_DATABASE: '${MYSQL_DATABASE:-passbolt}'
+      - 'TZ=${TZ:-Europe/Paris}'
+    volumes:
+      - 'passbolt-gpg:/etc/passbolt/gpg'
+      - 'passbolt-jwt:/etc/passbolt/jwt'
+    depends_on:
+      passbolt-db:
+        condition: service_healthy
+    healthcheck:
+      test:
+        - CMD
+        - curl
+        - '-f'
+        - 'http://127.0.0.1:80'
+      interval: 2s
+      timeout: 10s
+      retries: 15
+    command:
+      - /usr/bin/wait-for.sh
+      - '-t'
+      - '0'
+      - 'passbolt-db:3306'
+      - '--'
+      - /docker-entrypoint.sh
+
+  passbolt-db:
+    image: mariadb:10.11
+    volumes:
+      - passbolt-mysql-data:/var/lib/mysql
+    environment:
+      - MYSQL_ROOT_PASSWORD=${SERVICE_PASSWORD_ROOT}
+      - MYSQL_DATABASE=${MYSQL_DATABASE:-passbolt}
+      - MYSQL_USER=${SERVICE_USER_MYSQL}
+      - MYSQL_PASSWORD=${SERVICE_PASSWORD_MYSQL}
+    healthcheck:
+      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${SERVICE_PASSWORD_ROOT}"]
+      interval: 5s
+      timeout: 20s
+      retries: 10

templates/service-templates.json

@@ -1001,6 +1001,20 @@
         "logo": "svgs/gitea.svg",
         "minversion": "0.0.0"
     },
+    "gitea-private-secure": {
+        "documentation": "https://docs.gitea.com?utm_source=coolify.io",
+        "slogan": "Gitea is a self-hosted, lightweight Git service, offering version control, collaboration, and code hosting.",
+        "compose": "c2VydmljZXM6CiAgZ2l0ZWE6CiAgICBpbWFnZTogJ2dpdGVhL2dpdGVhOmxhdGVzdCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9HSVRFQV8zMDAwCiAgICAgIC0gVVNFUl9VSUQ9MTAwMAogICAgICAtIFVTRVJfR0lEPTEwMDAKICAgICAgIyBEb21haW4gY29uZmlndXJhdGlvbgogICAgICAtIEdJVEVBX19zZXJ2ZXJfX1JPT1RfVVJMPSR7R0lURUFfU0VSVkVSX1JPT1RfVVJMfQogICAgICAtIEdJVEVBX19zZXJ2ZXJfX0RPTUFJTj0ke0dJVEVBX1NFUlZFUl9ET01BSU59CiAgICAgICMgQmFzaWMgU2VjdXJpdHkKICAgICAgLSBHSVRFQV9fc2VydmljZV9fUkVRVUlSRV9TSUdOSU5fVklFVz0ke0dJVEVBX1NFUlZJQ0VfUkVRVUlSRV9TSUdOSU5fVklFVzp0cnVlfQogICAgICAtIEdJVEVBX19zZXJ2aWNlX19SRUdJU1RFUl9NQU5VQUxfQ09ORklSTT0ke0dJVEVBX1NFUlZJQ0VfUkVHSVNURVJfTUFOVUFMX0NPTkZJUk06dHJ1ZX0KICAgICAgLSBHSVRFQV9fc2VydmljZV9fUkVHSVNURVJfRU1BSUxfQ09ORklSTT0ke0dJVEVBX1NFUlZJQ0VfUkVHSVNURVJfRU1BSUxfQ09ORklSTTpmYWxzZX0KICAgICAgLSBHSVRFQV9fc2VydmljZV9fRU5BQkxFX05PVElGWV9NQUlMPSR7R0lURUFfU0VSVklDRV9FTkFCTEVfTk9USUZZX01BSUw6dHJ1ZX0KICAgICAgLSBHSVRFQV9fc2VydmljZV9fREVGQVVMVF9BTExPV19DUkVBVEVfT1JHQU5JWkFUSU9OPSR7R0lURUFfU0VSVklDRV9ERUZBVUxUX0FMTE9XX0NSRUFURV9PUkdBTklaQVRJT046ZmFsc2V9CiAgICAgIC0gR0lURUFfX3NlcnZpY2VfX0RFRkFVTFRfVVNFUl9JU19SRVNUUklDVEVEPSR7R0lURUFfU0VSVklDRV9ERUZBVUxUX1VTRVJfSVNfUkVTVFJJQ1RFRDp0cnVlfQogICAgICAtIEdJVEVBX19zZXJ2aWNlX19ERUZBVUxUX1VTRVJfVklTSUJJTElUWT0ke0dJVEVBX1NFUlZJQ0VfREVGQVVMVF9VU0VSX1ZJU0lCSUxJVFk6cHJpdmF0ZX0KICAgICAgCiAgICAgICMgQWRkaXRpb25hbCBTZWN1cml0eQogICAgICAtIEdJVEVBX19zZWN1cml0eV9fSU5TVEFMTF9MT0NLPXRydWUgIyBMb2NrIHRoZSBpbnN0YWxsYXRpb24gdG8gcHJldmVudCB1bmF1dGhvcml6ZWQgYWNjZXNzCiAgICAgIC0gR0lURUFfX3NlY3VyaXR5X19NSU5fUEFTU1dPUkRfTEVOR1RIPTEyICMgTWluaW11bSBwYXNzd29yZCBsZW5ndGgKICAgICAgLSBHSVRFQV9fc2VjdXJpdHlfX1BBU1NXT1JEX0NPTVBMRVhJVFk9b2ZmICMgRGlzYWJsZSBwYXNzd29yZCBjb21wbGV4aXR5IGNoZWNrcwogICAgICAtIEdJVEVBX19zZWN1cml0eV9fUEFTU1dPUkRfQ0hFQ0tfUFdOPXRydWUgIyBDaGVjayBpZiB0aGUgcGFzc3dvcmQgaGFzIGJlZW4gbGVha2VkCiAgICAgIC0gR0lURUFfX3NlY3VyaXR5X19ESVNBQkxFX0dJVF9IT09LUz10cnVlICMgRGlzYWJsZSBHaXQgaG9va3MgdG8gcHJldmVudCBjb2RlIGV4ZWN1dGlvbgogICAgICAtIEdJVEVBX19zZWN1cml0eV9fT05MWV9BTExPV19QVVNIX0lGX0dJVEVBX0VOVklST05NRU5UX1NFVD10cnVlCiAgICAgIAogICAgICAjIEJydXRlIEZvcmNlIFByb3RlY3Rpb24KICAgICAgLSBHSVRFQV9fc2VjdXJpdHlfX0xPR0lOX1JFTUVNQkVSX0RBWVM9NwogICAgICAtIEdJVEVBX19zZWN1cml0eV9fTUFYX0ZBSUxFRF9MT0dJTl9BVFRFTVBUUz01CiAgICAgIC0gR0lURUFfX3NlY3VyaXR5X19CTE9DS19MT0dJTl9GQUlMVVJFU19USFJFU0hPTEQ9dHJ1ZSAjIEJsb2NrIGxvZ2luIGF0dGVtcHRzIGFmdGVyIHJlYWNoaW5nIHRoZSB0aHJlc2hvbGQKICAgICAgLSBHSVRFQV9fc2VjdXJpdHlfX0JMT0NLX0xPR0lOX0ZBSUxVUkVTX0RVUkFUSU9OPTE1bSAjIEJsb2NrIGxvZ2luIGF0dGVtcHRzIGZvciAxNSBtaW51dGVzIGFmdGVyIHJlYWNoaW5nIHRoZSB0aHJlc2hvbGQKICAgICAgCiAgICAgICMgU2Vzc2lvbiBTZWN1cml0eQogICAgICAtIEdJVEVBX19zZXNzaW9uX19QUk9WSURFUj1maWxlICMgVXNlIGZpbGUtYmFzZWQgc2Vzc2lvbiBwcm92aWRlciAKICAgICAgLSBHSVRFQV9fc2Vzc2lvbl9fU0FNRV9TSVRFPXN0cmljdCAjIFNldCBTYW1lU2l0ZSBhdHRyaWJ1dGUgdG8gc3RyaWN0IHRvIHByZXZlbnQgY3Jvc3Mtc2l0ZSByZXF1ZXN0IGZvcmdlcnkKICAgICAgLSBHSVRFQV9fc2Vzc2lvbl9fQ09PS0lFX1NFQ1VSRT10cnVlICMgRW5zdXJlIGNvb2tpZXMgYXJlIG9ubHkgc2VudCBvdmVyIEhUVFBTCiAgICAgIAogICAgICAjIEFQSSBQcm90ZWN0aW9uCiAgICAgIC0gR0lURUFfX2FwaV9fRU5BQkxFX1NXQUdHRVI9ZmFsc2UgIyBEaXNhYmxlIFN3YWdnZXIgQVBJIGRvY3VtZW50YXRpb24gdG8gcHJldmVudCBsZWFraW5nIGluZm9ybWF0aW9uCiAgICAgIC0gR0lURUFfX2FwaV9fTUFYX1JFU1BPTlNFX0lURU1TPTUwICMgTGltaXQgdGhlIG51bWJlciBvZiBpdGVtcyByZXR1cm5lZCBpbiBBUEkgcmVzcG9uc2VzCiAgICAgIAogICAgICAjIE90aGVyIFJlc3RyaWN0aW9ucwogICAgICAtIEdJVEVBX19yZXBvc2l0b3J5X19ERUZBVUxUX1BSSVZBVEU9dHJ1ZSAjIERlZmF1bHQgcmVwb3NpdG9yeSB2aXNpYmlsaXR5IHRvIHByaXZhdGUgIAogICAgICAtIEdJVEVBX19yZXBvc2l0b3J5X19ERUZBVUxUX0JSQU5DSD1tYWluICMgRGVmYXVsdCBicmFuY2ggZm9yIG5ldyByZXBvc2l0b3JpZXMKICAgICAgLSBHSVRFQV9fcmVwb3NpdG9yeV9fRElTQUJMRV9IVFRQX0dJVD1mYWxzZQogICAgICAtIEdJVEVBX19yZXBvc2l0b3J5X19VU0VfQ09NUEFUX1NTSF9VUkk9dHJ1ZSAjIFVzZSBjb21wYXRpYmxlIFNTSCBVUkkgZm9ybWF0CiAgICAgIAogICAgICAjIEF0dGFjayBQcm90ZWN0aW9uCiAgICAgIC0gR0lURUFfX290aGVyX19TSE9XX0ZPT1RFUl9WRVJTSU9OPWZhbHNlICMgSGlkZSB2ZXJzaW9uIGluZm9ybWF0aW9uIGluIGZvb3RlcgogICAgICAtIEdJVEVBX19vdGhlcl9fU0hPV19GT09URVJfVEVNUExBVEVfTE9BRF9USU1FPWZhbHNlICMgSGlkZSB0ZW1wbGF0ZSBsb2FkIHRpbWUgaW4gZm9vdGVyCiAgICAgIAogICAgcG9ydHM6CiAgICAgIC0gJzIyMjIyOjIyJwogICAgdm9sdW1lczoKICAgICAgLSAnZ2l0ZWEtZGF0YTovZGF0YScKICAgICAgLSAnZ2l0ZWEtdGltZXpvbmU6L2V0Yy90aW1lem9uZTpybycKICAgICAgLSAnZ2l0ZWEtbG9jYWx0aW1lOi9ldGMvbG9jYWx0aW1lOnJvJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjMwMDAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICAgIHNlY3VyaXR5X29wdDoKICAgICAgLSBuby1uZXctcHJpdmlsZWdlczp0cnVl",
+        "tags": [
+            "version control",
+            "collaboration",
+            "code",
+            "private hosting",
+            "lightweight"
+        ],
+        "logo": "svgs/gitea.svg",
+        "minversion": "0.0.0"
+    },
     "gitlab": {
         "documentation": "https://docs.gitlab.com/ee/install/docker.html?utm_source=coolify.io",
         "slogan": "The all-in-one DevOps platform for seamless collaboration and continuous delivery.",
@@ -2125,6 +2139,20 @@
         "minversion": "0.0.0",
         "port": "8000"
     },
+    "passbolt": {
+        "documentation": "https://help.passbolt.com/hosting/install/ce/docker?utm_source=coolify.io",
+        "slogan": "Open source password manager for teams.",
+        "compose": "c2VydmljZXM6CiAgcGFzc2JvbHQ6CiAgICBpbWFnZTogJ3Bhc3Nib2x0L3Bhc3Nib2x0OmxhdGVzdC1jZScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9QQVNTQk9MVF84MAogICAgICAtICdBUFBfRlVMTF9CQVNFX1VSTD0ke0FQUF9GVUxMX0JBU0VfVVJMfScKICAgICAgLQogICAgICAgIERBVEFTT1VSQ0VTX0RFRkFVTFRfSE9TVDogcGFzc2JvbHQtZGIKICAgICAgLQogICAgICAgIERBVEFTT1VSQ0VTX0RFRkFVTFRfVVNFUk5BTUU6ICcke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0KICAgICAgICBEQVRBU09VUkNFU19ERUZBVUxUX1BBU1NXT1JEOiAnJHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgICAgLQogICAgICAgIERBVEFTT1VSQ0VTX0RFRkFVTFRfREFUQUJBU0U6ICcke01ZU1FMX0RBVEFCQVNFOi1wYXNzYm9sdH0nCiAgICAgIC0gJ1RaPSR7VFo6LUV1cm9wZS9QYXJpc30nCiAgICB2b2x1bWVzOgogICAgICAtICdwYXNzYm9sdC1ncGc6L2V0Yy9wYXNzYm9sdC9ncGcnCiAgICAgIC0gJ3Bhc3Nib2x0LWp3dDovZXRjL3Bhc3Nib2x0L2p3dCcKICAgIGRlcGVuZHNfb246CiAgICAgIHBhc3Nib2x0LWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICAgIGNvbW1hbmQ6CiAgICAgIC0gL3Vzci9iaW4vd2FpdC1mb3Iuc2gKICAgICAgLSAnLXQnCiAgICAgIC0gJzAnCiAgICAgIC0gJ3Bhc3Nib2x0LWRiOjMzMDYnCiAgICAgIC0gJy0tJwogICAgICAtIC9kb2NrZXItZW50cnlwb2ludC5zaAoKICBwYXNzYm9sdC1kYjoKICAgIGltYWdlOiBtYXJpYWRiOjEwLjExCiAgICB2b2x1bWVzOgogICAgICAtIHBhc3Nib2x0LW15c3FsLWRhdGE6L3Zhci9saWIvbXlzcWwKICAgIGVudmlyb25tZW50OgogICAgICAtIE1ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JPT1R9CiAgICAgIC0gTVlTUUxfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotcGFzc2JvbHR9CiAgICAgIC0gTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0KICAgICAgLSBNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDogWyJDTUQiLCAibXlzcWxhZG1pbiIsICJwaW5nIiwgIi1oIiwgImxvY2FsaG9zdCIsICItdSIsICJyb290IiwgIi1wJHtTRVJWSUNFX1BBU1NXT1JEX1JPT1R9Il0KICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
+        "tags": [
+            "password manager",
+            "security",
+            "open source",
+            "team"
+        ],
+        "logo": "svgs/passbolt.svg",
+        "minversion": "0.0.0",
+        "port": "80"
+    },
     "penpot": {
         "documentation": "https://help.penpot.app/technical-guide/getting-started/#install-with-docker?utm_source=coolify.io",
         "slogan": "Penpot is the first Open Source design and prototyping platform for product teams.",