openGym: new service

[jackspiering]

Description

Adds openGym, a self-hosted gym and body-weight tracker, as a new stack in services/opengym/, with a row in the root README.md (Food and wellness).

• Two application containers share the Tailscale sidecar's network: application (nginx web server, Serve target on port 8080) and api (app-<service>-api, port 3000). Both are listed under "Deviations from the standard setup".
• A sidecar is justified: openGym has no Tailscale support, and neither image contains tailscale or tailscaled (which tailscale tailscaled returns nothing in opengym-web and opengym-api).
• Upstream is active (v1.4.1, 2026-10-10, AGPL-3.0, not archived) and publishes both images on ghcr.io/duartesantos8/.
• TAILNET_NAME is required, because passkeys are bound to the exact https://<SERVICE>.<TAILNET_NAME>.ts.net address (RP_ID and ORIGIN). The README lists it under "Before you start".
• The API gets only the settings listed in .env, not the whole .env file as in upstream's compose file, so TS_AUTHKEY stays out of the application containers.
• Both images define their own HEALTHCHECK, so compose.yaml does not override them. The checks run every five minutes, so Compose shows starting for the first five minutes.
• Upstream's TRUST_PROXY=1 is not set. Its API is reachable only through nginx there, but here it also listens on the Tailscale IP of the device, so a Tailnet client could forge the forwarded address. The README notes the consequence (added after review): every visitor reaches the API as 127.0.0.1, so the per-address limits on wrong passwords, invite codes, and device links apply to everyone together. TRUST_PROXY=1 would not change that, because the web image overwrites X-Forwarded-For with its own $remote_addr, which is Serve.

Related Issues

• Closes 🏗️ New Service: OpenGym #335.

Verification

• docker compose config --quiet from services/opengym, with a dummy value for TAILNET_NAME (exit 0)
• The stack started from a copy outside the repository, with the Tailscale test key. Tailscale, application, and api are all healthy, and the service is reachable through Tailscale Serve (https://<SERVICE>.<tailnet>.ts.net/ returns 200, /api/health returns {"ok":true,...}). The request ran inside the network namespace, because test nodes are not reachable from the host.
• Both image health commands run with docker exec (wget --spider against the web port and against /api/health). Both containers report healthy after the five-minute interval.
• Main function and persistence: with PASSWORD_LOGIN=1 and FIRST_USER_ADMIN=1 in the copy, I registered a profile (it became admin), wrote a routine, and read it back. After docker compose down and up -d, I signed in again and the routine was still there.
• Optional ports block: the page and /api/health load on 127.0.0.1:8080, and sign-in from that address is refused as cross-origin, as the README says.
• rumdl check --config .markdownlint.yml . (0.2.78) on the whole repository, and git diff --check origin/main
• Passkey registration: not tested. No browser or authenticator was available, so I used the password sign-in that upstream offers as an option.
• The test ran with TRUST_PROXY=1 set. I removed it afterwards, which restores the upstream default (off). Nothing else changed after the test except comments and the openGym spelling.

Impact on existing users

• None.

Checklist

• I have performed a self-review of my code and followed the templates structure.
• I did not commit a working auth key, password, token, or other credential.
• The service README uses the headings of the template, in the same order, and is up to date.
• I added, removed, or renamed the service in the root README.md, in alphabetical order, or this PR does not change the list of services.

Additional Context

• The compose file in the issue is out of date. Since v1.4.0 the exercise media ships inside the web image, so there is no media container and no download at first start. The images also moved from registry.gitlab.com/duartesantos8/opengym/ to ghcr.io/duartesantos8/opengym-web and opengym-api.
• The web image comes from IMAGE_URL and the API image is set in compose.yaml. Both use latest, as upstream's compose file does.
• Upstream: https://github.com/DuarteSantos8/openGym (mirror: https://gitlab.com/DuarteSantos8/opengym), self-hosting guide: https://github.com/DuarteSantos8/openGym/blob/main/docs/SELF_HOSTING.md.