Open Notebook: new service

[jackspiering]

Description

Adds Open Notebook, a self-hosted alternative to NotebookLM, as a new stack with a Tailscale sidecar and a SurrealDB database container.

Why a sidecar: the lfnovo/open_notebook image ships no tailscale or tailscaled (checked with which in the image), and upstream has no Tailscale mode. Upstream is maintained (not archived, v1.15.0 released on 2026-10-04) and publishes the image on Docker Hub, with v1-latest as the recommended tag.

Based on upstream's docker-compose.yml and its Docker Compose and reverse proxy guides, adapted to the template. Differences are documented in the README under "Deviations from the standard setup":

• Both containers use the network of the tailscale container. The database listens on 127.0.0.1 only (SURREAL_BIND), so the Tailnet cannot reach it.
• API_URL is set to the Tailnet address, as upstream's reverse proxy guide requires. Without it the browser calls port 5055, which Serve does not publish. This needs a required TAILNET_NAME, like Joplin Server.
• OPEN_NOTEBOOK_ENCRYPTION_KEY and SURREAL_PASSWORD are required and empty in .env, instead of upstream's default values (change-me-to-a-secret-string and root). OPEN_NOTEBOOK_PASSWORD is optional.
• The health check calls /health of the API on port 5055. The database check uses /surreal isready, because that image has no shell.

Related Issues

• Closes 🏗️ New Service: # Servicename: open-notebook #322.

Verification

• docker compose config --quiet from services/open-notebook, with dummy values for the required variables
• The stack started, Tailscale is healthy, and the service is reachable through the Tailnet
• The main function of the service works, and its data survives a restart. Partly run: see below.
• rumdl check --config .markdownlint.yml . (rumdl 0.2.78) on the whole repository, and git diff --check

Live test with a copy outside the repository, a test auth key, and the device rvtest-open-notebook:

• All three containers were healthy (tailscale, application, db). Each health command was run with docker exec. GET /health on port 5055 returns {"status":"healthy"}. /api/health on port 8502 returns 404, so the check uses port 5055.
• Serve answered over HTTPS inside the container's network namespace, with --resolve to the node's Tailscale IP, because test nodes cannot be reached from the test host. GET /config returned the Tailnet address as apiUrl.
• Through Serve, I created a notebook and a text source through the REST API and read the notebook back. After docker compose down and up -d, the notebook was still there.
• With OPEN_NOTEBOOK_PASSWORD set, the API answered 401 without the password and listed notebooks with it. With it empty, /api/auth/status reports authentication as disabled.
• The database answered on 127.0.0.1:8000 and refused connections on the Tailscale IP.
• A changed SURREAL_PASSWORD after the first start made the app fail with There was a problem with authentication. The README says so.

Not run: chat, embeddings, search, and podcasts, because they need an AI provider key. The web interface was not opened in a browser, so I did not check the login screen or the provider setup steps in "First run" in the UI itself. LAN access through the optional ports block was not tested.

Impact on existing users

• None.

Checklist

• I have performed a self-review of my code and followed the templates structure.
• I did not commit a working auth key, password, token, or other credential.
• The service README uses the headings of the template, in the same order, and is up to date.
• I added, removed, or renamed the service in the root README.md, in alphabetical order, or this PR does not change the list of services.

Additional Context

• The data folders are ./open-notebook-data/notebook and ./open-notebook-data/surreal. The second is owned by root, because upstream requires the database to run as root.