{
  "version": "3",
  "templates": [
    {
      "type": 3,
      "title": "HealthLog",
      "name": "healthlog",
      "description": "Self-hosted personal health tracker (PWA + native iOS client): weight, blood pressure, pulse, blood glucose, body composition, sleep, mood, menstrual cycle, and medications on one encrypted timeline. AES-256-GCM at rest, no vendor cloud, no telemetry. Ships app + PostgreSQL 18 as one stack.",
      "note": "Generate each secret with: openssl rand -hex 32 (a 64-char hex string). For plain-HTTP / LAN access set SESSION_COOKIE_SECURE to false, or login fails. Set NEXT_PUBLIC_APP_URL and APP_URL to how you reach the app. Full guide: https://github.com/MBombeck/HealthLog/blob/main/docs/self-hosting/getting-started.md",
      "categories": ["Tools", "Other"],
      "platform": "linux",
      "logo": "https://raw.githubusercontent.com/MBombeck/HealthLog/main/public/logo-512.png",
      "repository": {
        "url": "https://github.com/MBombeck/HealthLog",
        "stackfile": "docker-compose.yml"
      },
      "env": [
        {
          "name": "POSTGRES_PASSWORD",
          "label": "PostgreSQL password",
          "description": "Database password. Generate with: openssl rand -hex 32"
        },
        {
          "name": "ENCRYPTION_KEY",
          "label": "Encryption key (data at rest)",
          "description": "AES-256-GCM key. Generate with: openssl rand -hex 32. Back this up — losing it makes encrypted data unrecoverable."
        },
        {
          "name": "API_TOKEN_HMAC_KEY",
          "label": "API token HMAC key",
          "description": "Generate with: openssl rand -hex 32"
        },
        {
          "name": "HEALTHLOG_PLATFORM",
          "label": "Platform hint",
          "description": "Opens the admin's recovery kit on the Portainer instructions.",
          "default": "portainer"
        },
        {
          "name": "ENCRYPTION_KEY_CHECK",
          "label": "Encryption key check",
          "description": "enforce refuses to serve when the key does not open the stored data. warn only logs it: a last resort for a refusal you are certain is false; it disables a safety check.",
          "default": "enforce"
        },
        {
          "name": "SESSION_COOKIE_SECURE",
          "label": "Session cookie Secure flag",
          "description": "Set to false for plain-HTTP / LAN access, or login fails. Set to true only behind an HTTPS reverse proxy.",
          "default": "false"
        },
        {
          "name": "NEXT_PUBLIC_APP_URL",
          "label": "Public app URL",
          "description": "How users reach HealthLog, e.g. http://nas:3000 or https://healthlog.example.com",
          "default": "http://localhost:3000"
        },
        {
          "name": "APP_URL",
          "label": "Internal app URL",
          "description": "Normally identical to the public app URL.",
          "default": "http://localhost:3000"
        }
      ]
    }
  ]
}