From c78d375fbf27ecdbba74dcf5e89d249fd4c500f5 Mon Sep 17 00:00:00 2001 From: Jack Spiering <46534141+jackspiering@users.noreply.github.com> Date: Wed, 14 Oct 2026 00:38:12 +0200 Subject: [PATCH 1/4] Wallabag: new service --- README.md | 1 + services/wallabag/.env | 32 ++++++++++ services/wallabag/README.md | 48 +++++++++++++++ services/wallabag/compose.yaml | 107 +++++++++++++++++++++++++++++++++ 4 files changed, 188 insertions(+) create mode 100644 services/wallabag/.env create mode 100644 services/wallabag/README.md create mode 100644 services/wallabag/compose.yaml diff --git a/README.md b/README.md index c648808d..34a3cb39 100644 --- a/README.md +++ b/README.md @@ -181,6 +181,7 @@ Every stack starts from the same [standard setup](documentation/standard-setup.m | **SubTrackr** | Subscription tracker that shows monthly and yearly costs and when each one renews. | [Details](services/subtrackr) | | **Sure** | Fork of the archived Maybe finance app, for tracking accounts, investments, and net worth. | [Details](services/sure) | | **Vikunja** | To-do and project management app with lists, boards, Gantt charts, and reminders. | [Details](services/vikunja) | +| **Wallabag** | Read-it-later app that saves web pages as clean articles you can tag, annotate, and search. | [Details](services/wallabag) | | **Wallos** | Subscription and expense tracker with payment reminders and budget help. | [Details](services/wallos) | | **XWiki** | Wiki platform for documentation and knowledge management, with extensions. | [Details](services/xwiki) | diff --git a/services/wallabag/.env b/services/wallabag/.env new file mode 100644 index 00000000..ebe2ae28 --- /dev/null +++ b/services/wallabag/.env @@ -0,0 +1,32 @@ +#URL=https://github.com/tailscale-dev/ScaleTail +# To run a second copy, copy the folder under another name and change SERVICE. + +# Service Configuration +# Service name (e.g., adguard). Used as hostname in Tailscale and for container naming. +SERVICE=wallabag +# Docker image URL from container registry (e.g., adguard/adguardhome:latest). +IMAGE_URL=wallabag/wallabag:2.6.14 + +# Network Configuration +# Port to expose to local network. Uncomment the "ports:" section in compose.yaml to enable. +SERVICEPORT=80 +# Preferred DNS server for Tailscale. Uncomment the "dns:" section in compose.yaml to enable. +DNS_SERVER=9.9.9.9 + +# Tailscale Configuration +# Auth key from https://console.tailscale.com/admin/settings/keys. See: https://tailscale.com/kb/1085/auth-keys#generate-an-auth-key for instructions. +TS_AUTHKEY= + +# Time Zone setting for containers. See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones +TZ=Europe/Amsterdam + +# Any Container environment variables are declared below. See https://docs.docker.com/compose/how-tos/environment-variables/ + +# Required: your Tailnet name, the part between the service name and ".ts.net" in https://wallabag..ts.net, for example tail1234. +TAILNET_NAME= +# Required: signs the sessions and tokens. Generate it with: openssl rand -hex 32 +WALLABAG_SECRET= +# Required: password of the wallabag database user. Generate it with: openssl rand -hex 32 +DATABASE_PASSWORD= +# Required: password of the database root user. Generate it with: openssl rand -hex 32 +MYSQL_ROOT_PASSWORD= diff --git a/services/wallabag/README.md b/services/wallabag/README.md new file mode 100644 index 00000000..ab73aa12 --- /dev/null +++ b/services/wallabag/README.md @@ -0,0 +1,48 @@ +# Wallabag + +[Wallabag](https://wallabag.org/) is a read-it-later app. It saves web pages as clean articles that you can tag, annotate, and read later, from the web interface, the mobile apps, or a browser extension. + +This stack runs Wallabag with a Tailscale sidecar, as described in [the standard setup](../../documentation/standard-setup.md). + +## At a glance + +| Item | Value | +| ------------- | ------------------------------------------- | +| Web interface | `https://wallabag..ts.net` | +| Service port | `80` | +| Images | `wallabag/wallabag` | +| | `mariadb:11.8` | +| | `redis:8-alpine` | +| Data | `./wallabag-data/db` (MariaDB database) | +| | `./wallabag-data/images` (article pictures) | + +## Before you start + +Set these values in `.env`. Compose stops with an error if one of them is empty. + +- **`TAILNET_NAME`.** Your Tailnet name, the part between the service name and `.ts.net`, for example `tail1234`. `compose.yaml` builds the address `https://..ts.net` from it. +- **`WALLABAG_SECRET`.** Signs sessions and tokens. Generate one with `openssl rand -hex 32`. Without it, the image falls back to a fixed secret that is public. +- **`DATABASE_PASSWORD`.** The password of the `wallabag` database user. Generate one with `openssl rand -hex 32`. MariaDB applies it only when it first creates the database. +- **`MYSQL_ROOT_PASSWORD`.** The password of the database root user. Generate one with `openssl rand -hex 32`. MariaDB applies it only when it first creates the database. Wallabag uses it on the first start to create its database and user. + +## Deviations from the standard setup + +- **Extra containers.** The stack runs a `db` container with MariaDB and a `redis` container with Redis, as in the upstream Compose example. Wallabag reaches them by their Compose service names over the Docker network, and neither is reachable from your Tailnet. Redis serves the optional asynchronous import of articles, and keeps no data on disk. +- **Image health check.** The Wallabag image defines its own health check, so `compose.yaml` does not override it. +- **Base address.** `SYMFONY__ENV__DOMAIN_NAME` in `compose.yaml` is the Tailnet address of the service. Wallabag uses it for the links it generates. If you change `SERVICE` or `TAILNET_NAME`, the address changes with them. + +## First run + +Open the web interface and log in with the default account: user `wallabag`, password `wallabag`. Change the password right away on the Config page: until you do, anyone on your Tailnet can log in. After the first login, Wallabag shows a quickstart page. + +To add an article, paste its address into the add field at the top of the page. The browser extensions and the mobile apps connect to `https://wallabag..ts.net`, and the device must be connected to your Tailnet. The [Wallabag documentation](https://doc.wallabag.org/) explains how to create the API client they need. + +## Troubleshooting + +- **`WARN: MySQL database is already configured` in the logs.** The Wallabag container found its database on a later start. The message is harmless: the entrypoint creates the database only once. + +## Links + +- [Wallabag documentation](https://doc.wallabag.org/) +- [Wallabag Docker image and Compose example](https://github.com/wallabag/docker) +- [Wallabag source code](https://github.com/wallabag/wallabag) diff --git a/services/wallabag/compose.yaml b/services/wallabag/compose.yaml new file mode 100644 index 00000000..d71c7dc6 --- /dev/null +++ b/services/wallabag/compose.yaml @@ -0,0 +1,107 @@ +configs: + ts-serve: + content: | + {"TCP":{"443":{"HTTPS":true}}, + "Web":{"$${TS_CERT_DOMAIN}:443": + {"Handlers":{"/": + {"Proxy":"http://127.0.0.1:80"}}}}, + "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}} + +services: +# Make sure you have updated/checked the .env file with the correct variables. +# Every variable used in this file must be defined there, unless it has a default such as ${VAR:-value}. + # Tailscale Sidecar Configuration + tailscale: + image: tailscale/tailscale:latest # Image to be used + container_name: tailscale-${SERVICE} # Name for local container management + hostname: ${SERVICE} # Name used within your Tailscale environment + environment: + - TS_AUTHKEY=${TS_AUTHKEY} + - TS_STATE_DIR=/var/lib/tailscale + - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required + - TS_USERSPACE=false + - TS_ENABLE_HEALTH_CHECK=true # Enable healthcheck endpoint: "/healthz" + - TS_LOCAL_ADDR_PORT=127.0.0.1:41234 # The : for the healthz endpoint + #- TS_ACCEPT_DNS=true # Uncomment only if the service must resolve MagicDNS names - this replaces Docker DNS, so Compose service names no longer resolve + - TS_AUTH_ONCE=true + configs: + - source: ts-serve + target: /config/serve.json + volumes: + - ./config:/config # Config folder used to store Tailscale files - you may need to change the path + - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path + devices: + - /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work + cap_add: + - net_admin # Tailscale requirement + #ports: + # - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding the service port to the local network - may be removed if only exposure to your Tailnet is required + # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below + #dns: + # - ${DNS_SERVER} + healthcheck: + test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational + interval: 1m # How often to perform the check + timeout: 10s # Time to wait for the check to succeed + retries: 3 # Number of retries before marking as unhealthy + start_period: 10s # Time to wait before starting health checks + restart: always + + # Application + application: + image: ${IMAGE_URL} # Image to be used + network_mode: service:tailscale # Sidecar configuration to route the service through Tailscale + container_name: app-${SERVICE} # Name for local container management + environment: # Variables are declared in .env file. + - TZ=${TZ} + - SYMFONY__ENV__DOMAIN_NAME=https://${SERVICE}.${TAILNET_NAME:?Set TAILNET_NAME in .env}.ts.net + - SYMFONY__ENV__SECRET=${WALLABAG_SECRET:?Set WALLABAG_SECRET in .env} + - SYMFONY__ENV__DATABASE_DRIVER=pdo_mysql + - SYMFONY__ENV__DATABASE_HOST=db + - SYMFONY__ENV__DATABASE_PORT=3306 + - SYMFONY__ENV__DATABASE_NAME=wallabag + - SYMFONY__ENV__DATABASE_USER=wallabag + - SYMFONY__ENV__DATABASE_PASSWORD=${DATABASE_PASSWORD:?Set DATABASE_PASSWORD in .env} + - SYMFONY__ENV__DATABASE_CHARSET=utf8mb4 + - SYMFONY__ENV__REDIS_HOST=redis + # The entrypoint uses the root password to create the database and the user on the first start. + - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD:?Set MYSQL_ROOT_PASSWORD in .env} + volumes: + - ./${SERVICE}-data/images:/var/www/wallabag/web/assets/images + depends_on: + tailscale: + condition: service_healthy + db: + condition: service_healthy + redis: + condition: service_healthy + # Healthcheck: defined by the image (curl on http://localhost/api/info), so this file does not override it. + restart: always + + # Database + db: + image: mariadb:11.8 + container_name: app-${SERVICE}-db # Name for local container management + environment: + - MARIADB_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD:?Set MYSQL_ROOT_PASSWORD in .env} + volumes: + - ./${SERVICE}-data/db:/var/lib/mysql + healthcheck: + test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"] # Check if MariaDB accepts connections and InnoDB is initialized + interval: 10s # How often to perform the check + timeout: 5s # Time to wait for the check to succeed + retries: 5 # Number of retries before marking as unhealthy + start_period: 30s # Time to wait before starting health checks + restart: always + + # Cache for asynchronous imports + redis: + image: redis:8-alpine + container_name: app-${SERVICE}-redis # Name for local container management + healthcheck: + test: ["CMD", "redis-cli", "ping"] # Check if Redis answers + interval: 10s # How often to perform the check + timeout: 5s # Time to wait for the check to succeed + retries: 5 # Number of retries before marking as unhealthy + start_period: 10s # Time to wait before starting health checks + restart: always From 0f4e3f321381c95d4a13dbee6e6014e051cb510d Mon Sep 17 00:00:00 2001 From: Jack Spiering <46534141+jackspiering@users.noreply.github.com> Date: Wed, 14 Oct 2026 00:39:59 +0200 Subject: [PATCH 2/4] Wallabag: align the README row and the Redis note --- README.md | 2 +- services/wallabag/README.md | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 34a3cb39..f7361e69 100644 --- a/README.md +++ b/README.md @@ -181,7 +181,7 @@ Every stack starts from the same [standard setup](documentation/standard-setup.m | **SubTrackr** | Subscription tracker that shows monthly and yearly costs and when each one renews. | [Details](services/subtrackr) | | **Sure** | Fork of the archived Maybe finance app, for tracking accounts, investments, and net worth. | [Details](services/sure) | | **Vikunja** | To-do and project management app with lists, boards, Gantt charts, and reminders. | [Details](services/vikunja) | -| **Wallabag** | Read-it-later app that saves web pages as clean articles you can tag, annotate, and search. | [Details](services/wallabag) | +| **Wallabag** | Read-it-later app that saves web pages as articles you can tag, annotate, and search. | [Details](services/wallabag) | | **Wallos** | Subscription and expense tracker with payment reminders and budget help. | [Details](services/wallos) | | **XWiki** | Wiki platform for documentation and knowledge management, with extensions. | [Details](services/xwiki) | diff --git a/services/wallabag/README.md b/services/wallabag/README.md index ab73aa12..4f77b227 100644 --- a/services/wallabag/README.md +++ b/services/wallabag/README.md @@ -27,8 +27,7 @@ Set these values in `.env`. Compose stops with an error if one of them is empty. ## Deviations from the standard setup -- **Extra containers.** The stack runs a `db` container with MariaDB and a `redis` container with Redis, as in the upstream Compose example. Wallabag reaches them by their Compose service names over the Docker network, and neither is reachable from your Tailnet. Redis serves the optional asynchronous import of articles, and keeps no data on disk. -- **Image health check.** The Wallabag image defines its own health check, so `compose.yaml` does not override it. +- **Extra containers.** The stack runs a `db` container with MariaDB and a `redis` container with Redis, as in the upstream Compose example. Wallabag reaches them by their Compose service names over the Docker network, and neither is reachable from your Tailnet. Redis serves the optional asynchronous import of articles. The stack does not persist its data. - **Base address.** `SYMFONY__ENV__DOMAIN_NAME` in `compose.yaml` is the Tailnet address of the service. Wallabag uses it for the links it generates. If you change `SERVICE` or `TAILNET_NAME`, the address changes with them. ## First run From 8fa8e464d5132eef3743dc078045a7bc633f3604 Mon Sep 17 00:00:00 2001 From: Jack Spiering <46534141+jackspiering@users.noreply.github.com> Date: Wed, 14 Oct 2026 00:40:05 +0200 Subject: [PATCH 3/4] Wallabag: pad the root README row --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index f7361e69..8c95e573 100644 --- a/README.md +++ b/README.md @@ -181,7 +181,7 @@ Every stack starts from the same [standard setup](documentation/standard-setup.m | **SubTrackr** | Subscription tracker that shows monthly and yearly costs and when each one renews. | [Details](services/subtrackr) | | **Sure** | Fork of the archived Maybe finance app, for tracking accounts, investments, and net worth. | [Details](services/sure) | | **Vikunja** | To-do and project management app with lists, boards, Gantt charts, and reminders. | [Details](services/vikunja) | -| **Wallabag** | Read-it-later app that saves web pages as articles you can tag, annotate, and search. | [Details](services/wallabag) | +| **Wallabag** | Read-it-later app that saves web pages as articles you can tag, annotate, and search. | [Details](services/wallabag) | | **Wallos** | Subscription and expense tracker with payment reminders and budget help. | [Details](services/wallos) | | **XWiki** | Wiki platform for documentation and knowledge management, with extensions. | [Details](services/xwiki) | From 8a463e35be542b30a9e9aaf93ed369248a725ff5 Mon Sep 17 00:00:00 2001 From: Jack Spiering <46534141+jackspiering@users.noreply.github.com> Date: Thu, 15 Oct 2026 14:48:29 +0200 Subject: [PATCH 4/4] Wallabag: drop Redis and set the owner of the images folder --- README.md | 2 +- services/wallabag/README.md | 11 +++++++++-- services/wallabag/compose.yaml | 15 --------------- 3 files changed, 10 insertions(+), 18 deletions(-) diff --git a/README.md b/README.md index 8c95e573..e8c42ceb 100644 --- a/README.md +++ b/README.md @@ -181,7 +181,7 @@ Every stack starts from the same [standard setup](documentation/standard-setup.m | **SubTrackr** | Subscription tracker that shows monthly and yearly costs and when each one renews. | [Details](services/subtrackr) | | **Sure** | Fork of the archived Maybe finance app, for tracking accounts, investments, and net worth. | [Details](services/sure) | | **Vikunja** | To-do and project management app with lists, boards, Gantt charts, and reminders. | [Details](services/vikunja) | -| **Wallabag** | Read-it-later app that saves web pages as articles you can tag, annotate, and search. | [Details](services/wallabag) | +| **Wallabag** | Read-it-later app that saves web pages as articles. | [Details](services/wallabag) | | **Wallos** | Subscription and expense tracker with payment reminders and budget help. | [Details](services/wallos) | | **XWiki** | Wiki platform for documentation and knowledge management, with extensions. | [Details](services/xwiki) | diff --git a/services/wallabag/README.md b/services/wallabag/README.md index 4f77b227..554684df 100644 --- a/services/wallabag/README.md +++ b/services/wallabag/README.md @@ -12,7 +12,6 @@ This stack runs Wallabag with a Tailscale sidecar, as described in [the standard | Service port | `80` | | Images | `wallabag/wallabag` | | | `mariadb:11.8` | -| | `redis:8-alpine` | | Data | `./wallabag-data/db` (MariaDB database) | | | `./wallabag-data/images` (article pictures) | @@ -25,9 +24,17 @@ Set these values in `.env`. Compose stops with an error if one of them is empty. - **`DATABASE_PASSWORD`.** The password of the `wallabag` database user. Generate one with `openssl rand -hex 32`. MariaDB applies it only when it first creates the database. - **`MYSQL_ROOT_PASSWORD`.** The password of the database root user. Generate one with `openssl rand -hex 32`. MariaDB applies it only when it first creates the database. Wallabag uses it on the first start to create its database and user. +Create the folder for article pictures before the first start, and give it to the user that runs Wallabag inside the container, `nobody` with the ID `65534`. Docker would otherwise create it as `root`, and Wallabag could not save pictures there when you turn on "Download images locally" in the Misc section of the internal settings: + +```sh +mkdir -p wallabag-data/images +sudo chown 65534:65534 wallabag-data/images +``` + ## Deviations from the standard setup -- **Extra containers.** The stack runs a `db` container with MariaDB and a `redis` container with Redis, as in the upstream Compose example. Wallabag reaches them by their Compose service names over the Docker network, and neither is reachable from your Tailnet. Redis serves the optional asynchronous import of articles. The stack does not persist its data. +- **Extra container.** The stack runs a `db` container with MariaDB. Wallabag reaches it by its Compose service name over the Docker network, and it is not reachable from your Tailnet. +- **No Redis.** The upstream Compose example adds Redis, which Wallabag uses only for asynchronous imports, and only with a separate import worker. Wallabag imports without it, so this stack leaves both out. Keep "Enable Redis to import data asynchronously" and "Enable RabbitMQ to import data asynchronously" off in the Import section of the internal settings. - **Base address.** `SYMFONY__ENV__DOMAIN_NAME` in `compose.yaml` is the Tailnet address of the service. Wallabag uses it for the links it generates. If you change `SERVICE` or `TAILNET_NAME`, the address changes with them. ## First run diff --git a/services/wallabag/compose.yaml b/services/wallabag/compose.yaml index d71c7dc6..0b7e9712 100644 --- a/services/wallabag/compose.yaml +++ b/services/wallabag/compose.yaml @@ -63,7 +63,6 @@ services: - SYMFONY__ENV__DATABASE_USER=wallabag - SYMFONY__ENV__DATABASE_PASSWORD=${DATABASE_PASSWORD:?Set DATABASE_PASSWORD in .env} - SYMFONY__ENV__DATABASE_CHARSET=utf8mb4 - - SYMFONY__ENV__REDIS_HOST=redis # The entrypoint uses the root password to create the database and the user on the first start. - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD:?Set MYSQL_ROOT_PASSWORD in .env} volumes: @@ -73,8 +72,6 @@ services: condition: service_healthy db: condition: service_healthy - redis: - condition: service_healthy # Healthcheck: defined by the image (curl on http://localhost/api/info), so this file does not override it. restart: always @@ -93,15 +90,3 @@ services: retries: 5 # Number of retries before marking as unhealthy start_period: 30s # Time to wait before starting health checks restart: always - - # Cache for asynchronous imports - redis: - image: redis:8-alpine - container_name: app-${SERVICE}-redis # Name for local container management - healthcheck: - test: ["CMD", "redis-cli", "ping"] # Check if Redis answers - interval: 10s # How often to perform the check - timeout: 5s # Time to wait for the check to succeed - retries: 5 # Number of retries before marking as unhealthy - start_period: 10s # Time to wait before starting health checks - restart: always