Add Nebulynk Template

[sapientorius]

What is this PR about?

Add a complete Dokploy template for Nebulynk, a self-hosted collaboration platform for teams with chat, file sharing, voice/video meetings, LiveKit media, notifications, and optional AI-assisted features.

The template includes:

• Frontend and backend services
• PostgreSQL and Redis
• Garage as S3-compatible object storage
• LiveKit and LiveKit Egress for meetings and recordings
• Native Dokploy domains for:
  • Frontend: port 8080
  • Backend: port 3030
  • LiveKit: port 7880
  • Garage/S3: port 3900

The template follows Dokploy's deployment requirements:

• Uses expose for services handled through Dokploy routing
• Enables isolated deployments
• Does not define container_name
• Does not add dokploy-network, custom networks, or Traefik labels
• Uses Dokploy's native domain configuration
• Generates unique deployment secrets during import
• Defaults to the reviewed stable branch, with support for pinning NEBULYNK_SOURCE_REF to an immutable release tag

Optional configuration variables are visible in the imported environment without using placeholder credentials. This includes Klipy, Web Push/VAPID, SMTP, AI endpoint allowlists, session settings, rate limiting, logging, upload limits, and meeting timeouts.

LiveKit media ports

The ports section is intentionally used only for LiveKit WebRTC media transport:

• 7881:7881/tcp
• 7882:7882/udp

The LiveKit HTTP/signalling endpoint on port 7880 remains exposed through Dokploy's native domain routing. Direct TCP/UDP host ports are required for browser audio and video connectivity and cannot be replaced by the standard HTTP reverse proxy alone.

Production and security notes

The template intentionally starts with NODE_ENV=development and HTTP-based generated sslip.io domains so that the initial import can be smoke-tested without certificates.

Before exposing an instance publicly, operators should:

1. Replace the generated domains with DNS names they control.
2. Enable HTTPS and Let's Encrypt certificates in Dokploy.
3. Set NODE_ENV=production.
4. Update FRONTEND_URL, VITE_API_URL, LIVEKIT_PUBLIC_URL, STORAGE_S3_PUBLIC_ENDPOINT, and PASSKEY_RP_ID.
5. Allow LiveKit media traffic on 7881/tcp and 7882/udp.
6. Configure backups for PostgreSQL and both Garage volumes.

The complete production procedure is documented in docs/DOKPLOY.md. General guidance for secrets, TLS, firewalls, backups, and access control is available in Secure Self-Hosting.

Checklist

Before submitting this PR, please make sure that:

• I have read the suggestions in the README.md file https://github.com/Dokploy/templates?tab=readme-ov-file#general-requirements-when-creating-a-template
• I have tested the template in my instance, so the maintainers don't spend time trying to figure out what's wrong.
• I have added tests that demonstrate that my correction works or that my new feature works.

This is a declarative template contribution, so validation was performed through Dokploy's preview, Base64 import, and deployment workflow rather than through template-specific unit tests.

Additional source-repository validation:

• npm run dokploy:template:check
• node --test backend/test/security-config.test.js — 21 tests passed
• The generated Base64 configuration was successfully imported and deployed in a Dokploy instance.

Issues related (if applicable)

No related issue.

Screenshots or Videos

The generated Base64 configuration was successfully imported into a Dokploy instance. The Compose configuration, environment variables, and native domains were imported successfully, and the deployment completed without errors.

[github-actions]

built with Refined Cloudflare Pages Action

⚡ Cloudflare Pages Deployment

Name	Status	Preview	Last Commit
templates	✅ Ready (View Log)	Visit Preview	7994b28

[Siumauricio]

Tested this on a Dokploy instance (hostinger.dokploy.com) by importing blueprints/nebulynk from this branch (merged with canary). It deploys and works; I pushed one small cleanup and have a few non-blocking suggestions below.

Upstream / legitimacy

• sapientorius/Nebulynk: created 2026-03-06, 79 commits, releases v0.2.0 → v0.5.0 (2026-08-01 → 2026-08-19), ci.yml + release.yml green, Dependabot PRs, BSL 1.1 license (source-available, named licensor), ~3.7 MB of JS/Vue + a Rust (Tauri) PTT helper, website nebulynk.net live. Author account dates from 2015. 114★ but 0 forks / 0 watchers; GitHub's stargazer listing was returning 404 for every repo at review time, so I could not audit the stargazers. No prebuilt images: everything is built from the repo (build.context: https://github.com/sapientorius/Nebulynk.git#stable), so image↔repo correspondence is inherent.

Conventions

• No container_name, no dokploy-network, no Traefik labels, expose for HTTP services, secrets via ${password:N}/${hash:N}, per-template meta.json with logo. Host ports 7881/tcp + 7882/udp are only for LiveKit WebRTC media and are declared with the # dokploy: allow-host-ports marker (same pattern as fonoster/mailu/etc.). generate-meta.js --check, validate-docker-compose.ts and validate-template.ts all pass.
• I pushed 08e0637 removing blueprints/nebulynk/import.base64 — the build scripts don't use it and it duplicates the compose/toml (and would go stale on every edit).

Deploy results (fix-nebulynk, deploy done in 123 s, builds included)

• Containers: frontend, backend, livekit, livekit-egress, garage, postgres, redis all running, RestartCount 0; garage-volume-init exited 0.
• Logs: backend Ran 70 migration(s), Storage initialized (bucket: nebulynk-files), Socket.IO initialized, Nebulynk API started on http://localhost:3030; garage Creating default access key / Creating default bucket nebulynk-files and a successful authenticated HEAD /nebulynk-files/ from the backend; livekit starting LiveKit server v1.13.4 with the public IP found via STUN; egress service ready.
• Via Traefik: frontend / → 200 «Nebulynk»; backend / → Feathers JSON 404 (app-level), POST /authentication → 401 Invalid login, GET /users → 401 Not authenticated, CORS preflight from the frontend origin → 204 with access-control-allow-origin: http://<frontend-domain> (FRONTEND_URL wiring OK); livekit / → OK, /rtc websocket upgrade → 401 (expects a token, correct); garage / → 403 AccessDenied (S3 API reachable, anonymous access denied); host port 7881/tcp reachable from outside.

Non-blocking suggestions

1. source_ref = "stable" (and meta.json "version": "stable") is a moving branch — the equivalent of :latest. Consider defaulting to the release tag (v0.5.0) and bumping it per release so deployments are reproducible; stable can stay documented as the opt-in channel.
2. garage, livekit and livekit-egress are built from source only to COPY a config file into the official image. The same can be done without any build by using the official pinned images plus [[config.mounts]] in template.toml (filePath = "livekit.yaml" etc.) mounted into the container — it removes three image builds from every deploy.
3. NODE_ENV=development as the shipped default is unusual for a template; if the only reason is plain-HTTP cookies, it may be worth gating that behaviour on a dedicated flag instead so production can be the default.
4. version: "3.8" at the top of the compose file is obsolete (harmless).
5. One note for maintainers: the project is BSL 1.1 (source-available, not OSI), in case that matters for inclusion.

Service left running for a few minutes for inspection and then removed.