Passbolt 5.x's isNotCreatedInTheFutureRule has zero tolerance for
clock skew — even 1 second between browser and server causes the
metadata key creation to fail during first setup. Disabling the
automatic metadata setup for new instances allows the browser
extension to complete account setup successfully.
Encrypted metadata can be enabled from the admin panel post-setup.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Passbolt 5.x does not auto-persist the server key fingerprint across
container restarts (no passbolt.php is written). The fingerprint env var
is required and corresponds to the key auto-generated on first clean start.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Use container_name passbolt_db instead of service name db (service names
are ambiguous on the shared falcon_network — 6 other stacks also have a
service named db)
- Add DATASOURCES_DEFAULT_ENCODING=utf8 to override MySQL's utf8mb4 default
- Add DATASOURCES_QUOTE_IDENTIFIER=true for PostgreSQL identifier quoting
- Set PASSBOLT_GPG_SERVER_KEY_FINGERPRINT for the auto-generated server key
- Add PASSBOLT_GPG_SERVER_KEY_EMAIL for correct server key identity
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Password manager with GPG encryption. Uses PostgreSQL for consistency
with other stacks. Backed up alongside existing databases. Vaultwarden
kept running during migration.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Removes the watchtower container in favour of a host-side script that
runs daily at 2:00 AM via systemd timer. Mirrors the _backup pattern:
auto-discovers stacks, pulls images, recreates changed containers,
prunes dangling images, and notifies via n8n → Telegram.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
No longer needed after Coolify update — verified on VPS, container
stays healthy without them.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Mount from stack directory instead of .data, consistent with how
gitea handles runner-config.yaml.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Traefik routes api.pivoine.art/freepik and /facefusion to their
respective containers with path rewriting, shared API token auth
via an nginx sidecar, and api-rate-limit middleware.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Migrated 11 services from monolithic docker-compose project into independent stacks,
each with dedicated databases, minimal .env configuration, and bind-mount data volumes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
valknar