Release v2.6.0: stable Dokploy/Docker deployment bundle.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -2,11 +2,18 @@
 APP_PORT=5000
 SECRET_KEY=change-me-to-a-long-random-string
 
-# PostgreSQL (used by docker-compose)
+# PostgreSQL (docker-compose — same password for db + panel via DATABASE_URL)
 POSTGRES_USER=amnezia
-POSTGRES_PASSWORD=amnezia
+POSTGRES_PASSWORD=change-me-strong-password
 POSTGRES_DB=amnezia_panel
 POSTGRES_PORT=5432
 
+# Set once before first deploy. Changing POSTGRES_PASSWORD later requires resetting
+# the amnezia_pgdata volume or the panel cannot connect (Postgres keeps the old password).
+
 # Full DSN (override if panel runs outside compose)
-# DATABASE_URL=postgresql://amnezia:amnezia@db:5432/amnezia_panel
+# DATABASE_URL=postgresql://amnezia:change-me-strong-password@db:5432/amnezia_panel
+
+# Dokploy / reverse proxy (optional — set in compose for Docker)
+# PANEL_IN_DOCKER=1
+# PANEL_BEHIND_PROXY=1

.gitattributes

@@ -0,0 +1 @@
+*.sh text eol=lf

Dockerfile

@@ -20,11 +20,10 @@ COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
 COPY . .
-RUN chmod +x scripts/docker-entrypoint.sh
 
 EXPOSE 5000
 
 HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
   CMD curl -fsS "http://127.0.0.1:5000/health" >/dev/null || exit 1
 
-ENTRYPOINT ["/app/scripts/docker-entrypoint.sh"]
+CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "5000", "--proxy-headers", "--forwarded-allow-ips", "*"]

README.md

@@ -194,30 +194,53 @@ docker compose up -d --build
 
 Panel: `http://localhost:5000` (or `APP_PORT` from `.env`).
 
-### Dokploy
+### Dokploy (recommended)
 
 The compose file connects the panel to Dokploy's Traefik network (`dokploy-network`) and exposes the app on **container port 5000** (not 80).
 
 1. Deploy as **Docker Compose** from this repo (Dokploy creates `dokploy-network` automatically).
-2. In Dokploy → your app → **Domains**:
+2. In Dokploy → your app → **Environment** (set **before first deploy**):
+   - `SECRET_KEY` — long random string
+   - `POSTGRES_PASSWORD` — strong password (same value is used for `db` and `amnezia_panel`)
+3. In Dokploy → **Domains**:
    - **Service**: `amnezia_panel` (not `db`)
    - **Container port**: `5000`
    - **Path**: `/`
-3. Set env vars in Dokploy: `SECRET_KEY` (long random string), strong `POSTGRES_PASSWORD`.
+4. **Deploy / Rebuild** (not Restart) after code or env changes.
-4. Redeploy after changing domains or env.
 
-If the domain shows **404 page not found** (plain text, Go-style), Traefik has no route to a healthy backend. After redeploying **v2.5.8+**, on the server run:
+**Verify on the server** (replace `PROJECT` and path with yours):
 
 ```bash
-# 1) Panel must answer HTTP inside the container
+COMPOSE_DIR=/etc/dokploy/compose/home-vpn-g6rfpd/code
-docker compose -p home-vpn-g6rfpd exec amnezia_panel curl -fsS http://127.0.0.1:5000/health
+PROJECT=home-vpn-g6rfpd
 
-# 2) Panel container must be on dokploy-network (required for Traefik)
+docker compose -p $PROJECT -f $COMPOSE_DIR/docker-compose.yml exec amnezia_panel \
-docker inspect "$(docker compose -p home-vpn-g6rfpd ps -q amnezia_panel)" \
+  curl -fsS http://127.0.0.1:5000/health
+# → {"status":"ok","version":"v2.6.0"}
+
+docker inspect ${PROJECT}-amnezia_panel-1 \
   --format '{{range $k,$v := .NetworkSettings.Networks}}{{$k}} {{end}}'
+# must include: dokploy-network
 ```
 
-You should see `dokploy-network` in the network list. If it is missing, Dokploy cannot route the domain — redeploy with the latest `docker-compose.yml` or run `docker network connect dokploy-network <container>` and redeploy Traefik.
+**Full redeploy after git update:**
+
+```bash
+cd $COMPOSE_DIR && git pull origin main
+docker compose -p $PROJECT -f $COMPOSE_DIR/docker-compose.yml down
+docker compose -p $PROJECT -f $COMPOSE_DIR/docker-compose.yml build --no-cache amnezia_panel
+docker compose -p $PROJECT -f $COMPOSE_DIR/docker-compose.yml up -d --force-recreate
+```
+
+**Postgres `password authentication failed`:** the volume keeps the password from the **first** deploy. If you change `POSTGRES_PASSWORD` in Dokploy later, reset the DB volume (wipes panel DB data):
+
+```bash
+docker compose -p $PROJECT -f $COMPOSE_DIR/docker-compose.yml down
+docker volume rm ${PROJECT}_amnezia_pgdata
+docker compose -p $PROJECT -f $COMPOSE_DIR/docker-compose.yml up -d --build
+```
+
+**Domain shows `404 page not found` (plain text):** Traefik has no route to the panel — check Domains (service `amnezia_panel`, port `5000`) and that the container is on `dokploy-network` (see verify commands above).
 
 | File | Purpose |
 | --- | --- |
@@ -254,6 +277,19 @@ GitHub Actions workflows in `.github/workflows/`:
 
 ## 📋 Fix / changelog (this fork)
 
+### v2.6.0 — stable Dokploy / Docker release
+*   **Dokploy-ready compose** — `dokploy-network`, Traefik labels, port **5000**, no fixed `container_name`.
+*   **Docker startup** — `uvicorn` with proxy headers; SSL inside container disabled when `PANEL_IN_DOCKER` / `PANEL_BEHIND_PROXY`.
+*   **Postgres healthcheck** — verifies password (catches `POSTGRES_PASSWORD` vs volume mismatch).
+*   **Rollback move-connections** — removed server-to-server config move (v2.5.4); restored `ToggleConnectionRequest` (fixes crash loop on deploy).
+*   **Docs** — full Dokploy deploy/redeploy/password-reset guide in README.
+
+### v2.5.11
+*   **Postgres healthcheck** — verifies DB password (surfaces `POSTGRES_PASSWORD` / volume mismatch before panel starts).
+
+### v2.5.10
+*   **Docker startup** — run `uvicorn` directly in `CMD` (no shell entrypoint); rebuild required after deploy.
+
 ### v2.5.9
 *   **Remove move connections between servers** — feature rolled back; fixes startup crash (`ToggleConnectionRequest` was missing after v2.5.4).
 

app.py

@@ -103,7 +103,7 @@ else:
     application_path = os.path.dirname(__file__)
 
 DATA_FILE = os.path.join(application_path, 'data.json')  # legacy JSON; used only for one-shot import / export
-CURRENT_VERSION = "v2.5.9"
+CURRENT_VERSION = "v2.6.0"
 RELEASES_REPO_URL = repo_url()
 RELEASES_API_LATEST = api_latest_url()
 BIN_DIR = os.environ.get('TUNNEL_BIN_DIR', os.path.join(application_path, 'bin'))

docker-compose.yml

@@ -11,7 +11,11 @@ services:
     networks:
       - internal
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-amnezia} -d ${POSTGRES_DB:-amnezia_panel}"]
+      test:
+        [
+          "CMD-SHELL",
+          "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB} && PGPASSWORD=$${POSTGRES_PASSWORD} psql -U $${POSTGRES_USER} -d $${POSTGRES_DB} -c 'SELECT 1' >/dev/null",
+        ]
       interval: 10s
       timeout: 5s
       retries: 10

scripts/docker-entrypoint.sh

@@ -1,38 +0,0 @@
-#!/bin/sh
-set -e
-
-PORT="${PORT:-${APP_PORT:-5000}}"
-
-echo "Waiting for PostgreSQL at ${DATABASE_URL%%@*}@…"
-python3 - <<'PY'
-import os
-import sys
-import time
-
-url = os.environ.get("DATABASE_URL", "").strip()
-if not url:
-    print("DATABASE_URL is not set", file=sys.stderr)
-    sys.exit(1)
-
-import psycopg
-
-deadline = time.time() + 120
-last_err = None
-while time.time() < deadline:
-    try:
-        with psycopg.connect(url, connect_timeout=5):
-            break
-    except Exception as exc:
-        last_err = exc
-        time.sleep(2)
-else:
-    print(f"PostgreSQL not ready: {last_err}", file=sys.stderr)
-    sys.exit(1)
-PY
-
-echo "Starting Amnezia Web Panel on 0.0.0.0:${PORT}"
-exec uvicorn app:app \
-  --host 0.0.0.0 \
-  --port "${PORT}" \
-  --proxy-headers \
-  --forwarded-allow-ips='*'