Compose Stack Builder

How the merge works & honest caveats

1. Shared databases are deduplicated. If two or more selected apps declare needs: postgres (or redis/mariadb), exactly one instance is emitted and every dependent app gets a depends_on with a service_healthy condition. The app keeps its own logical DB name but reuses the one server.
2. Host ports are de-collided. Each catalog port has a documented default. When two apps want the same host port (or one collides with a shared service), the second is bumped to the next free port and flagged. Container ports never change.
3. Reverse proxy is wired both ways. Pick Traefik and web apps lose their published host port, join a shared proxy network, and get router/service labels. Pick Caddy and you also get a Caddyfile. Pick none and host ports are published as-is.
4. Secrets are externalised. Every value flagged secret becomes a ${VAR} reference in the compose file and a placeholder line in .env. Nothing real is generated — you must replace every CHANGE_ME_*.

This is a scaffold generator, not a turnkey deployment. It deliberately omits workload-specific wiring some apps need in production (Immich's ML container and pgvecto-rs image, Home Assistant's host networking for discovery, hardware /dev/dri passthrough for transcoding). Those are called out per app and left for you to add, because guessing them would produce a file that looks complete but isn't. Image tags reflect a current stable major at model version 1.0; registries move tags, so docker compose pull and review before relying on it. Generated YAML is validated structurally in your browser, not by a real Compose parser — always run docker compose config.

Catalog & image data live in src/data/compose-catalog.json. Decision-support only.