From aab8470d77e0e9e1be22c583af47b3e0a96a3427 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Kr=C3=BCger?= <valknar@pivoine.art>
Date: Fri, 7 Nov 2025 19:06:23 +0100
Subject: [PATCH] feat: add Stirling PDF tool to Kit stack
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added Stirling PDF (S-PDF) to the Kit toolkit at sterling.kit.pivoine.art:
- PDF manipulation tool with 100+ features
- Merge, split, convert, OCR, compress PDFs
- Privacy-focused: local processing, no data collection
- Image: frooodle/s-pdf:latest
- Exposed on port 8080 via Traefik with SSL

Configuration:
- Added sterling service to kit/compose.yaml
- Added KIT_STERLING_IMAGE and KIT_STERLING_TRAEFIK_HOST to arty.yml
- Follows same pattern as other Kit tools (Vert, Paint, Pastel)
- Watchtower enabled for automatic updates

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 arty.yml         |  2 ++
 kit/compose.yaml | 27 +++++++++++++++++++++++++--
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/arty.yml b/arty.yml
index f502402..ed91e40 100644
--- a/arty.yml
+++ b/arty.yml
@@ -121,6 +121,8 @@ envs:
     KIT_PASTEL_API_IMAGE: ghcr.io/valknarness/pastel-api:latest
     KIT_PASTEL_UI_IMAGE: ghcr.io/valknarness/pastel-ui:latest
     KIT_PASTEL_TRAEFIK_HOST: pastel.kit.pivoine.art
+    KIT_STERLING_IMAGE: frooodle/s-pdf:latest
+    KIT_STERLING_TRAEFIK_HOST: sterling.kit.pivoine.art
     # Jellyfin
     JELLY_TRAEFIK_ENABLED: true
     JELLY_COMPOSE_PROJECT_NAME: jelly
diff --git a/kit/compose.yaml b/kit/compose.yaml
index bf65eef..d8401ce 100644
--- a/kit/compose.yaml
+++ b/kit/compose.yaml
@@ -110,12 +110,10 @@ services:
       - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web.middlewares=${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-redirect-web-secure'
       - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web.rule=Host(`${KIT_PASTEL_TRAEFIK_HOST}`)'
       - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web.entrypoints=web'
-      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web.priority=1'
       # HTTPS router
       - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web-secure.rule=Host(`${KIT_PASTEL_TRAEFIK_HOST}`)'
       - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web-secure.tls.certresolver=resolver'
       - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web-secure.entrypoints=web-secure'
-      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web-secure.priority=1'
       - 'traefik.http.middlewares.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-compress.compress=true'
       - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-web-secure.middlewares=${KIT_COMPOSE_PROJECT_NAME}-pastel-ui-compress,security-headers@file'
       # Service
@@ -124,6 +122,31 @@ services:
       # Watchtower
       - 'com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}'
 
+  sterling:
+    image: ${KIT_STERLING_IMAGE:-frooodle/s-pdf:latest}
+    container_name: ${KIT_COMPOSE_PROJECT_NAME}_sterling
+    restart: unless-stopped
+    networks:
+      - compose_network
+    labels:
+      - 'traefik.enable=${KIT_TRAEFIK_ENABLED}'
+      # HTTP to HTTPS redirect
+      - 'traefik.http.middlewares.${KIT_COMPOSE_PROJECT_NAME}-sterling-redirect-web-secure.redirectscheme.scheme=https'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-sterling-web.middlewares=${KIT_COMPOSE_PROJECT_NAME}-sterling-redirect-web-secure'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-sterling-web.rule=Host(`${KIT_STERLING_TRAEFIK_HOST}`)'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-sterling-web.entrypoints=web'
+      # HTTPS router
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-sterling-web-secure.rule=Host(`${KIT_STERLING_TRAEFIK_HOST}`)'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-sterling-web-secure.tls.certresolver=resolver'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-sterling-web-secure.entrypoints=web-secure'
+      - 'traefik.http.middlewares.${KIT_COMPOSE_PROJECT_NAME}-sterling-compress.compress=true'
+      - 'traefik.http.routers.${KIT_COMPOSE_PROJECT_NAME}-sterling-web-secure.middlewares=${KIT_COMPOSE_PROJECT_NAME}-sterling-compress,security-headers@file'
+      # Service
+      - 'traefik.http.services.${KIT_COMPOSE_PROJECT_NAME}-sterling.loadbalancer.server.port=8080'
+      - 'traefik.docker.network=${NETWORK_NAME}'
+      # Watchtower
+      - 'com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}'
+
 networks:
   compose_network:
     name: ${NETWORK_NAME}