Merge pull request #541 from jcastro/feature/proxmenux-oci-apps-20261027

Add Umami OCI application profile

lang/de.json

@@ -161,6 +161,7 @@
   "A self-hosted vehicle maintenance and fuel log.": "Ein selbst gehostetes Protokoll für Fahrzeugwartung und Kraftstoffverbrauch.",
   "A self-hosted workflow scheduler with a web interface.": "Selbst gehosteter Workflow-Scheduler mit Weboberfläche.",
   "A self-hosted, goal-free habit tracking tool.": "Ein selbst gehostetes, zielfreies Habit-Tracking-Tool.",
+  "A self-hosted, no-code database and application platform.": "Selbst gehostete No-Code-Plattform für Datenbanken und Anwendungen.",
   "A self-improving AI agent with memory, skills, messaging, and a web dashboard.": "Ein sich selbst verbessernder KI-Agent mit Speicher, Fähigkeiten, Messaging und einem Web-Dashboard.",
   "A server reboot is recommended for all changes to take full effect.": "Damit alle Änderungen vollständig wirksam werden, wird ein Neustart des Servers empfohlen.",
   "A shared directory was replaced during the installation": "Ein gemeinsames Verzeichnis wurde während der Installation ersetzt",
@@ -3326,6 +3327,7 @@
   "Initial Redmine administrator": "Erster Redmine-Administrator",
   "Initial Stirling-PDF account": "Erstes Stirling-PDF-Konto",
   "Initial Tandoor administrator": "Initial Tandoor Administrator",
+  "Initial Umami administrator": "Erster Administrator für Umami",
   "Initial administrator created:": "Erster Administrator erstellt:",
   "Initial administrator user": "Erster Administrator",
   "Initializing Borg repository if needed...": "Initialisierung des Borg-Repositorys bei Bedarf ...",
@@ -5245,6 +5247,7 @@
   "Primary upstream DNS server": "Primärer Upstream-DNS-Server",
   "Privacy-first finance app with envelope budgeting and multi-device sync.": "Privacy-First Finance App mit Umschlag budgeting und Multi-Device-Sync.",
   "Privacy-first, self-hosted PDF toolkit": "Privacy-First, selbst gehostetes PDF-Toolkit",
+  "Privacy-focused, self-hosted web analytics.": "Datenschutzorientierte, selbst gehostete Webanalyse.",
   "Private installation record saved": "Private Installationsaufzeichnung gespeichert",
   "Private network assigned automatically:": "Privates Netzwerk automatisch zugewiesen:",
   "Private network kept, because other containers still use it:": "Privates Netzwerk beibehalten, da es weiterhin von anderen Containern verwendet wird:",
@@ -5368,6 +5371,7 @@
   "Public UDP port clients connect to": "Öffentliche UDP Port Clients verbinden sich mit",
   "Public UDP port peers connect to": "Öffentliche UDP-Port Peers verbinden sich mit",
   "Public URL of phpMyAdmin when it is served behind a reverse proxy": "Öffentliche URL von phpMyAdmin, wenn sie hinter einem Reverse-Proxy bereitgestellt wird",
+  "Public URL used to access Baserow (for example https://baserow.example.com)": "Öffentliche URL für den Zugriff auf Baserow (zum Beispiel https://baserow.example.com)",
   "Public address clients connect to (vpn.example.com or a public IP)": "Öffentliche Adress-Clients verbinden sich mit (vpn.example.com oder eine öffentliche IP)",
   "Public address peers connect to, or auto to detect it (vpn.example.com)": "Public Adress Peers verbinden, oder Auto, um es zu erkennen (vpn.example.com)",
   "Publish each directory from Resources: open it, switch on SMB, NFS or both, and save.": "Veröffentlichen Sie jedes Verzeichnis über Ressourcen: Öffnen Sie es, schalten Sie SMB, NFS oder beide ein und speichern Sie es.",
@@ -7151,6 +7155,7 @@
   "The oci-compose is incomplete: it does not say which image to install.": "Das oci-compose ist unvollständig: Es gibt nicht an, welches Image installiert werden soll.",
   "The oci-compose is not valid JSON:": "Das oci-compose ist kein gültiges JSON:",
   "The official Tandoor startup executable is missing": "Die offizielle Tandoor Startup Executable fehlt",
+  "The official Umami and PostgreSQL Compose services do not request privileged mode or relaxed host confinement.": "Die offiziellen Compose-Dienste von Umami und PostgreSQL fordern weder den privilegierten Modus noch eine gelockerte Isolation des Hostsystems an.",
   "The official inventory contains no NVIDIA devices": "Das offizielle Inventar enthält keine NVIDIA Geräte",
   "The official inventory contains no NVIDIA driver components": "Das offizielle Inventar enthält keine NVIDIA Treiberkomponenten",
   "The official startup cannot be reproduced": "Das offizielle Startup kann nicht reproduziert werden",

lang/es.json

@@ -160,6 +160,7 @@
   "A self-hosted vehicle maintenance and fuel log.": "Un registro autoalojado del mantenimiento y consumo de combustible de tus vehículos.",
   "A self-hosted workflow scheduler with a web interface.": "Planificador autoalojado de flujos de trabajo con interfaz web.",
   "A self-hosted, goal-free habit tracking tool.": "Una herramienta autoalojada de seguimiento de hábitos, sin objetivos.",
+  "A self-hosted, no-code database and application platform.": "Plataforma autoalojada de bases de datos y aplicaciones sin necesidad de programar.",
   "A self-improving AI agent with memory, skills, messaging, and a web dashboard.": "Un agente de IA que mejora por sí mismo, con memoria, habilidades, mensajería y un panel web.",
   "A server reboot is recommended for all changes to take full effect.": "Se recomienda reiniciar el servidor para que todos los cambios surtan efecto.",
   "A shared directory was replaced during the installation": "Un directorio compartido fue reemplazado durante la instalación",
@@ -3323,6 +3324,7 @@
   "Initial Redmine administrator": "Administrador inicial de Redmine",
   "Initial Stirling-PDF account": "Cuenta inicial de Stirling-PDF",
   "Initial Tandoor administrator": "Administrador inicial de Tandoor",
+  "Initial Umami administrator": "Administrador inicial de Umami",
   "Initial administrator created:": "Administrador inicial creado:",
   "Initial administrator user": "Usuario administrador inicial",
   "Initializing Borg repository if needed...": "Inicializando el repositorio de Borg si es necesario...",
@@ -5237,6 +5239,7 @@
   "Printer": "Impresora",
   "Privacy-first finance app with envelope budgeting and multi-device sync.": "Aplicación de finanzas que da prioridad a la privacidad, con presupuestos por sobres y sincronización entre dispositivos.",
   "Privacy-first, self-hosted PDF toolkit": "Kit de herramientas PDF autoalojado que da prioridad a la privacidad",
+  "Privacy-focused, self-hosted web analytics.": "Analítica web autoalojada y centrada en la privacidad.",
   "Private installation record saved": "Registro de instalación privado guardado",
   "Private network assigned automatically:": "Red privada asignada automáticamente:",
   "Private network kept, because other guests still use it:": "Red privada conservada, porque otras VM o CT la siguen usando:",
@@ -5359,6 +5362,7 @@
   "Public UDP port clients connect to": "Puerto UDP público al que se conectan los clientes",
   "Public UDP port peers connect to": "Puerto UDP público al que se conectan los peers",
   "Public URL of phpMyAdmin when it is served behind a reverse proxy": "URL pública de phpMyAdmin cuando se sirve detrás de un proxy inverso",
+  "Public URL used to access Baserow (for example https://baserow.example.com)": "URL pública para acceder a Baserow (por ejemplo, https://baserow.example.com)",
   "Public address clients connect to (vpn.example.com or a public IP)": "Dirección pública a la que se conectan los clientes (vpn.example.com o una IP pública)",
   "Public address peers connect to, or auto to detect it (vpn.example.com)": "Dirección pública a la que se conectan los peers, o auto para detectarla (vpn.example.com)",
   "Publish each directory from Resources: open it, switch on SMB, NFS or both, and save.": "Publica cada directorio desde Recursos: ábrelo, activa SMB, NFS o ambos y guarda.",
@@ -7130,6 +7134,7 @@
   "The oci-compose is incomplete: it does not say which image to install.": "El oci-compose está incompleto: no dice qué imagen instalar.",
   "The oci-compose is not valid JSON:": "El oci-compose no es JSON válido:",
   "The official Tandoor startup executable is missing": "Falta el ejecutable oficial de arranque de Tandoor",
+  "The official Umami and PostgreSQL Compose services do not request privileged mode or relaxed host confinement.": "Los servicios oficiales de Umami y PostgreSQL en Compose no solicitan el modo privilegiado ni una relajación del aislamiento del host.",
   "The official inventory contains no NVIDIA devices": "El inventario oficial no contiene dispositivos NVIDIA",
   "The official inventory contains no NVIDIA driver components": "El inventario oficial no contiene componentes de controlador NVIDIA",
   "The official startup cannot be reproduced": "La startup oficial no puede reproducirse",

lang/fr.json

@@ -161,6 +161,7 @@
   "A self-hosted vehicle maintenance and fuel log.": "Un carnet auto-hébergé pour suivre l’entretien et la consommation de vos véhicules.",
   "A self-hosted workflow scheduler with a web interface.": "Planificateur de workflows auto-hébergé avec interface web.",
   "A self-hosted, goal-free habit tracking tool.": "Un outil de suivi de l'habitude autonome et sans but.",
+  "A self-hosted, no-code database and application platform.": "Plateforme auto-hébergée de bases de données et d’applications sans code.",
   "A self-improving AI agent with memory, skills, messaging, and a web dashboard.": "Un agent d'IA auto-améliorant avec mémoire, compétences, messagerie, et un tableau de bord web.",
   "A server reboot is recommended for all changes to take full effect.": "Un redémarrage du serveur est recommandé pour que toutes les modifications prennent pleinement effet.",
   "A shared directory was replaced during the installation": "Un répertoire partagé a été remplacé pendant l'installation",
@@ -3326,6 +3327,7 @@
   "Initial Redmine administrator": "Premier administrateur Redmine",
   "Initial Stirling-PDF account": "Compte initial Stirling-PDF",
   "Initial Tandoor administrator": "Administrateur Tandoor initial",
+  "Initial Umami administrator": "Administrateur initial d’Umami",
   "Initial administrator created:": "Administrateur initial créé :",
   "Initial administrator user": "Administrateur initial",
   "Initializing Borg repository if needed...": "Initialisation du référentiel Borg si nécessaire...",
@@ -5245,6 +5247,7 @@
   "Primary upstream DNS server": "Serveur DNS amont principal",
   "Privacy-first finance app with envelope budgeting and multi-device sync.": "Privacy-first finance app avec enveloppe budgeting et synchronisation multi-appareils.",
   "Privacy-first, self-hosted PDF toolkit": "Boîte à outils PDF pour la première fois en matière de protection de la vie privée",
+  "Privacy-focused, self-hosted web analytics.": "Analyse web auto-hébergée axée sur la confidentialité.",
   "Private installation record saved": "Enregistrement d'installation privé enregistré",
   "Private network assigned automatically:": "Réseau privé assigné automatiquement:",
   "Private network kept, because other containers still use it:": "Réseau privé conservé, car d'autres conteneurs l'utilisent encore :",
@@ -5368,6 +5371,7 @@
   "Public UDP port clients connect to": "Les clients du port UDP public se connectent à",
   "Public UDP port peers connect to": "Les pairs du port UDP public se connectent à",
   "Public URL of phpMyAdmin when it is served behind a reverse proxy": "URL publique de phpMyAdmin quand elle est servie derrière un proxy inversé",
+  "Public URL used to access Baserow (for example https://baserow.example.com)": "URL publique pour accéder à Baserow (par exemple https://baserow.example.com)",
   "Public address clients connect to (vpn.example.com or a public IP)": "Les clients d'adresses publiques se connectent à (vpn.example.com ou à un IP public)",
   "Public address peers connect to, or auto to detect it (vpn.example.com)": "Pairs d'adresse publique se connectent, ou auto pour le détecter (vpn.example.com)",
   "Publish each directory from Resources: open it, switch on SMB, NFS or both, and save.": "Publiez chaque répertoire à partir des ressources : ouvrez-le, activez SMB, NFS ou les deux et enregistrez.",
@@ -7150,6 +7154,7 @@
   "The oci-compose is incomplete: it does not say which image to install.": "L'oci-compose est incomplet : il n'indique pas quelle image installer.",
   "The oci-compose is not valid JSON:": "L'oci-compose n'est pas un JSON valide :",
   "The official Tandoor startup executable is missing": "La startup officielle Tandoor exécutable est manquante",
+  "The official Umami and PostgreSQL Compose services do not request privileged mode or relaxed host confinement.": "Les services Compose officiels d’Umami et de PostgreSQL ne demandent ni le mode privilégié ni un assouplissement de l’isolation de l’hôte.",
   "The official inventory contains no NVIDIA devices": "L'inventaire officiel ne contient pas de dispositifs NVIDIA",
   "The official inventory contains no NVIDIA driver components": "L'inventaire officiel ne contient pas de composants conducteurs NVIDIA",
   "The official startup cannot be reproduced": "Le démarrage officiel ne peut pas être reproduit",

lang/it.json

@@ -161,6 +161,7 @@
   "A self-hosted vehicle maintenance and fuel log.": "Un registro self-hosted per la manutenzione dei veicoli e il consumo di carburante.",
   "A self-hosted workflow scheduler with a web interface.": "Pianificatore di workflow self-hosted con interfaccia web.",
   "A self-hosted, goal-free habit tracking tool.": "Uno strumento self-hosted per monitorare le abitudini senza obiettivi prefissati.",
+  "A self-hosted, no-code database and application platform.": "Piattaforma self-hosted per creare database e applicazioni senza scrivere codice.",
   "A self-improving AI agent with memory, skills, messaging, and a web dashboard.": "Un agente IA che si migliora autonomamente, con memoria, competenze, messaggistica e una dashboard web.",
   "A server reboot is recommended for all changes to take full effect.": "Si consiglia di riavviare il server affinché tutte le modifiche abbiano pieno effetto.",
   "A shared directory was replaced during the installation": "Una directory condivisa è stata sostituita durante l'installazione",
@@ -3326,6 +3327,7 @@
   "Initial Redmine administrator": "Primo amministratore Redmine",
   "Initial Stirling-PDF account": "Account iniziale di Stirling-PDF",
   "Initial Tandoor administrator": "Amministratore iniziale Tandoor",
+  "Initial Umami administrator": "Amministratore iniziale di Umami",
   "Initial administrator created:": "Amministratore iniziale creato:",
   "Initial administrator user": "Utente amministratore iniziale",
   "Initializing Borg repository if needed...": "Inizializzazione del repository Borg, se necessario...",
@@ -5245,6 +5247,7 @@
   "Primary upstream DNS server": "Server DNS upstream principale",
   "Privacy-first finance app with envelope budgeting and multi-device sync.": "App finanziaria attenta alla privacy con gestione del budget a buste e sincronizzazione tra dispositivi.",
   "Privacy-first, self-hosted PDF toolkit": "Strumenti PDF self-hosted orientati alla privacy",
+  "Privacy-focused, self-hosted web analytics.": "Analisi web self-hosted, attenta alla privacy.",
   "Private installation record saved": "Record privato di installazione salvato",
   "Private network assigned automatically:": "Rete privata assegnata automaticamente:",
   "Private network kept, because other containers still use it:": "Rete privata mantenuta, perché altri contenitori la utilizzano ancora:",
@@ -5368,6 +5371,7 @@
   "Public UDP port clients connect to": "Porta UDP pubblica a cui si connettono i client",
   "Public UDP port peers connect to": "Porta UDP pubblica a cui si connettono i peer",
   "Public URL of phpMyAdmin when it is served behind a reverse proxy": "URL pubblico di phpMyAdmin quando viene servito dietro un proxy inverso",
+  "Public URL used to access Baserow (for example https://baserow.example.com)": "URL pubblico usato per accedere a Baserow (ad esempio https://baserow.example.com)",
   "Public address clients connect to (vpn.example.com or a public IP)": "Indirizzo pubblico a cui si connettono i client (vpn.example.com o un IP pubblico)",
   "Public address peers connect to, or auto to detect it (vpn.example.com)": "Indirizzo pubblico a cui si connettono i peer, oppure auto per rilevarlo (vpn.example.com)",
   "Publish each directory from Resources: open it, switch on SMB, NFS or both, and save.": "Pubblica ciascuna directory da Risorse: aprila, attiva SMB, NFS o entrambi e salva.",
@@ -7151,6 +7155,7 @@
   "The oci-compose is incomplete: it does not say which image to install.": "L'oci-compose è incompleto: non indica quale immagine installare.",
   "The oci-compose is not valid JSON:": "L'oci-compose non è un JSON valido:",
   "The official Tandoor startup executable is missing": "Manca l'eseguibile ufficiale per l'avvio di Tandoor",
+  "The official Umami and PostgreSQL Compose services do not request privileged mode or relaxed host confinement.": "I servizi Compose ufficiali di Umami e PostgreSQL non richiedono l'uso della modalità privilegiata né l'allentamento dell'isolamento dell'host.",
   "The official inventory contains no NVIDIA devices": "L'inventario ufficiale non contiene dispositivi NVIDIA",
   "The official inventory contains no NVIDIA driver components": "L'inventario ufficiale non contiene componenti driver NVIDIA",
   "The official startup cannot be reproduced": "Non è possibile riprodurre l'avvio previsto dall'immagine ufficiale",

lang/pt.json

@@ -161,6 +161,7 @@
   "A self-hosted vehicle maintenance and fuel log.": "Um registo autoalojado de manutenção de veículos e consumo de combustível.",
   "A self-hosted workflow scheduler with a web interface.": "Agendador self-hosted de fluxos de trabalho com interface web.",
   "A self-hosted, goal-free habit tracking tool.": "Uma ferramenta de rastreamento de hábitos auto-alojada e livre de objetivos.",
+  "A self-hosted, no-code database and application platform.": "Plataforma autoalojada para criar bases de dados e aplicações sem escrever código.",
   "A self-improving AI agent with memory, skills, messaging, and a web dashboard.": "Um agente de IA auto-melhorando com memória, habilidades, mensagens e um painel web.",
   "A server reboot is recommended for all changes to take full effect.": "Uma reinicialização do servidor é recomendada para que todas as alterações tenham efeito total.",
   "A shared directory was replaced during the installation": "Um diretório compartilhado foi substituído durante a instalação",
@@ -3326,6 +3327,7 @@
   "Initial Redmine administrator": "Administrador inicial do Redmine",
   "Initial Stirling-PDF account": "Conta inicial do Stirling-PDF",
   "Initial Tandoor administrator": "Administrador inicial Tandoor",
+  "Initial Umami administrator": "Administrador inicial do Umami",
   "Initial administrator created:": "Administrador inicial criado:",
   "Initial administrator user": "Utilizador de administrador inicial",
   "Initializing Borg repository if needed...": "Inicializando o repositório Borg, se necessário...",
@@ -5245,6 +5247,7 @@
   "Primary upstream DNS server": "Servidor DNS a montante principal",
   "Privacy-first finance app with envelope budgeting and multi-device sync.": "App Privacy-first finance com envelope budgeting e sincronização multidispositivo.",
   "Privacy-first, self-hosted PDF toolkit": "Privacy-primeiro, auto-hosted PDF toolkit",
+  "Privacy-focused, self-hosted web analytics.": "Análise web auto-hospedada, com foco na privacidade.",
   "Private installation record saved": "Gravação de instalação privada salva",
   "Private network assigned automatically:": "Rede privada atribuída automaticamente:",
   "Private network kept, because other containers still use it:": "Mensagem técnica para Proxmox e TI.Traduzindo: Rede privada mantida, pois outros containers ainda a utilizam:",
@@ -5368,6 +5371,7 @@
   "Public UDP port clients connect to": "Clientes públicos de porta UDP se conectam",
   "Public UDP port peers connect to": "Os pares públicos de portas UDP se conectam",
   "Public URL of phpMyAdmin when it is served behind a reverse proxy": "URL público do phpMyAdmin quando é servido por trás de um proxy reverso",
+  "Public URL used to access Baserow (for example https://baserow.example.com)": "URL público usado para aceder ao Baserow (por exemplo https://baserow.example.com)",
   "Public address clients connect to (vpn.example.com or a public IP)": "Clientes de endereço público (vpn.example.com ou IP público)",
   "Public address peers connect to, or auto to detect it (vpn.example.com)": "Os pares de endereços públicos se conectam ou se autopara detectá-lo (vpn.example.com)",
   "Publish each directory from Resources: open it, switch on SMB, NFS or both, and save.": "Publique cada diretório de Recursos: abra-o, ative SMB, NFS ou ambos e salve.",
@@ -7151,6 +7155,7 @@
   "The oci-compose is incomplete: it does not say which image to install.": "O oci-compose está incompleto: não diz qual imagem instalar.",
   "The oci-compose is not valid JSON:": "O oci-compose não é JSON válido:",
   "The official Tandoor startup executable is missing": "Falta o executável oficial de inicialização Tandoor",
+  "The official Umami and PostgreSQL Compose services do not request privileged mode or relaxed host confinement.": "Os serviços Compose oficiais do Umami e do PostgreSQL não exigem modo privilegiado nem que o confinamento do host seja flexibilizado.",
   "The official inventory contains no NVIDIA devices": "O inventário oficial não contém dispositivos NVIDIA",
   "The official inventory contains no NVIDIA driver components": "O inventário oficial não contém componentes do driver NVIDIA",
   "The official startup cannot be reproduced": "A inicialização oficial não pode ser reproduzida",

lang/sk.json

@@ -161,6 +161,7 @@
   "A self-hosted vehicle maintenance and fuel log.": "Záznamník údržby vozidiel a spotreby paliva prevádzkovaný vo vlastnej réžii.",
   "A self-hosted workflow scheduler with a web interface.": "Vlastný plánovač pracovných postupov s webovým rozhraním.",
   "A self-hosted, goal-free habit tracking tool.": "Nástroj na sledovanie návykov bez stanovovania cieľov, prevádzkovaný na vlastnom serveri.",
+  "A self-hosted, no-code database and application platform.": "Databázová a aplikačná platforma bez kódu, ktorú si hostujete sami.",
   "A self-improving AI agent with memory, skills, messaging, and a web dashboard.": "Zdokonaľujúci sa agent AI s pamäťou, zručnosťami, komunikáciou a webovým panelom.",
   "A server reboot is recommended for all changes to take full effect.": "Odporúča sa reštart servera, aby sa všetky zmeny naplno prejavili.",
   "A shared directory was replaced during the installation": "Počas inštalácie bol vymenený zdieľaný adresár",
@@ -3326,6 +3327,7 @@
   "Initial Redmine administrator": "Počiatočný správca Redmine",
   "Initial Stirling-PDF account": "Počiatočný účet Stirling-PDF",
   "Initial Tandoor administrator": "Počiatočný správca Tandoor",
+  "Initial Umami administrator": "Počiatočný správca Umami",
   "Initial administrator created:": "Pôvodný správca vytvorený:",
   "Initial administrator user": "Počiatočné používateľské meno správcu",
   "Initializing Borg repository if needed...": "Pripravujem Borg repozitár, ak je to potrebné...",
@@ -5247,6 +5249,7 @@
   "Primary upstream DNS server": "Primárny nadradený server DNS",
   "Privacy-first finance app with envelope budgeting and multi-device sync.": "Finančná aplikácia s dôrazom na súkromie, obálkovým rozpočtom a synchronizáciou viacerých zariadení.",
   "Privacy-first, self-hosted PDF toolkit": "Súprava nástrojov PDF na vlastnom serveri s dôrazom na súkromie",
+  "Privacy-focused, self-hosted web analytics.": "Webová analytika s dôrazom na ochranu súkromia, ktorú prevádzkujete na vlastnom serveri.",
   "Private installation record saved": "Uložené súkromné záznamy o inštalácii",
   "Private network assigned automatically:": "Automaticky pridelená súkromná sieť:",
   "Private network kept, because other containers still use it:": "Súkromná sieť ponechaná, pretože ju stále používajú iné kontajnery:",
@@ -5370,6 +5373,7 @@
   "Public UDP port clients connect to": "Verejný port UDP na pripojenie klientov",
   "Public UDP port peers connect to": "Verejný port UDP na pripojenie účastníkov",
   "Public URL of phpMyAdmin when it is served behind a reverse proxy": "Verejné URL phpMyAdmin, keď sa podáva za reverzným proxy",
+  "Public URL used to access Baserow (for example https://baserow.example.com)": "Verejná adresa URL na prístup k Baserow (napríklad https://baserow.example.com)",
   "Public address clients connect to (vpn.example.com or a public IP)": "Verejná adresa na pripojenie klientov (vpn.example.com alebo verejná IP adresa)",
   "Public address peers connect to, or auto to detect it (vpn.example.com)": "Verejná adresa, ku ktorej sa pripájajú účastníci, alebo auto na jej zistenie (vpn.example.com)",
   "Publish each directory from Resources: open it, switch on SMB, NFS or both, and save.": "Zverejnite každý adresár zo zdrojov: otvorte ho, zapnite SMB, NFS alebo oboje a uložte.",
@@ -7152,6 +7156,7 @@
   "The oci-compose is incomplete: it does not say which image to install.": "oci-compose je neúplný: nehovorí, ktorý obraz sa má nainštalovať.",
   "The oci-compose is not valid JSON:": "oci-compose nie je platný JSON:",
   "The official Tandoor startup executable is missing": "Oficiálny spúšťač Tandoor chýba",
+  "The official Umami and PostgreSQL Compose services do not request privileged mode or relaxed host confinement.": "Oficiálne služby Umami a PostgreSQL v Compose nevyžadujú privilegovaný režim ani zmiernenie izolácie hostiteľa.",
   "The official inventory contains no NVIDIA devices": "Oficiálny inventár neobsahuje žiadne zariadenia NVIDIA",
   "The official inventory contains no NVIDIA driver components": "Oficiálny inventár neobsahuje žiadne komponenty ovládača NVIDIA",
   "The official startup cannot be reproduced": "Oficiálny štart nie je možné reprodukovať",

lang/sv.json

@@ -161,6 +161,7 @@
   "A self-hosted vehicle maintenance and fuel log.": "En loggbok som du driftar själv för fordonsunderhåll och bränsleförbrukning.",
   "A self-hosted workflow scheduler with a web interface.": "Självhostad arbetsflödesplanerare med webbgränssnitt.",
   "A self-hosted, goal-free habit tracking tool.": "En självhäftad, målfri vana spårningsverktyg.",
+  "A self-hosted, no-code database and application platform.": "Självhostad plattform för databaser och applikationer utan kodning.",
   "A self-improving AI agent with memory, skills, messaging, and a web dashboard.": "En självförbättrande AI-agent med minne, färdigheter, meddelanden och en webbdashboard.",
   "A server reboot is recommended for all changes to take full effect.": "En omstart av servern rekommenderas för att alla ändringar ska få full effekt.",
   "A shared directory was replaced during the installation": "En delad katalog ersattes under installationen",
@@ -3326,6 +3327,7 @@
   "Initial Redmine administrator": "Första Redmine-administratören",
   "Initial Stirling-PDF account": "Första Stirling-PDF-kontot",
   "Initial Tandoor administrator": "Initial Tandoor administratör",
+  "Initial Umami administrator": "Umamis första administratör",
   "Initial administrator created:": "Initial administratör skapad:",
   "Initial administrator user": "Initial administratör användare",
   "Initializing Borg repository if needed...": "Initierar Borg-arkivet om det behövs...",
@@ -5245,6 +5247,7 @@
   "Primary upstream DNS server": "Primär uppströms DNS-server",
   "Privacy-first finance app with envelope budgeting and multi-device sync.": "Privacy-first finans app med kuvert budgeting och multi-device sync.",
   "Privacy-first, self-hosted PDF toolkit": "Privacy-first, självhäftad PDF-verktyg",
+  "Privacy-focused, self-hosted web analytics.": "Självhostad webbanalys med fokus på integritet.",
   "Private installation record saved": "Privat installationsrekord sparad",
   "Private network assigned automatically:": "Privat nätverk tilldelas automatiskt:",
   "Private network kept, because other containers still use it:": "Privat nätverk behålls, eftersom andra behållare fortfarande använder det:",
@@ -5368,6 +5371,7 @@
   "Public UDP port clients connect to": "Offentliga UDP-portklienter ansluter till",
   "Public UDP port peers connect to": "Offentliga UDP-portpeers ansluter till",
   "Public URL of phpMyAdmin when it is served behind a reverse proxy": "Public URL av phpMyAdmin när den serveras bakom en omvänd proxy",
+  "Public URL used to access Baserow (for example https://baserow.example.com)": "Offentlig URL för åtkomst till Baserow (till exempel https://baserow.example.com)",
   "Public address clients connect to (vpn.example.com or a public IP)": "Offentliga adressklienter ansluter till (vpn.example.com eller en offentlig IP)",
   "Public address peers connect to, or auto to detect it (vpn.example.com)": "Offentliga adresspeers ansluter till, eller auto för att upptäcka det (vpn.example.com)",
   "Publish each directory from Resources: open it, switch on SMB, NFS or both, and save.": "Publicera varje katalog från Resurser: öppna den, slå på SMB, NFS eller båda och spara.",
@@ -7151,6 +7155,7 @@
   "The oci-compose is incomplete: it does not say which image to install.": "oci-compose är ofullständig: den anger inte vilken avbild som ska installeras.",
   "The oci-compose is not valid JSON:": "oci-compose är inte giltig JSON:",
   "The official Tandoor startup executable is missing": "Den officiella Tandoor start körbar saknas",
+  "The official Umami and PostgreSQL Compose services do not request privileged mode or relaxed host confinement.": "De officiella Compose-tjänsterna för Umami och PostgreSQL begär varken privilegierat läge eller en mindre strikt isolering av värdsystemet.",
   "The official inventory contains no NVIDIA devices": "Den officiella inventeringen innehåller inga NVIDIA-enheter",
   "The official inventory contains no NVIDIA driver components": "Den officiella inventeringen innehåller inga NVIDIA-komponenter",
   "The official startup cannot be reproduced": "Den officiella starten kan inte reproduceras",

oci/VALIDATION.md

@@ -2,7 +2,7 @@
 
 <!-- Generated from oci/catalog/verification.json by .github/scripts/oci_validation.py. Do not edit by hand. -->
 
-43 of 525 applications in the OCI catalog have been tested for real: 41 in the ProxMenux lab and 2 by the community. The OCI installer shows them as verified, with a ✓ in the lists.
+43 of 526 applications in the OCI catalog have been tested for real: 41 in the ProxMenux lab and 2 by the community. The OCI installer shows them as verified, with a ✓ in the lists.
 
 Each test describes the scenario that was run and names the image it ran on. It does not cover every possible configuration of the application, and a newer image has not been tested until someone reports it.
 

oci/catalog/apps/umami.json

@@ -0,0 +1,428 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-umami",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Umami"
+    },
+    "tagline": {
+      "en_US": "Privacy-focused, self-hosted web analytics."
+    },
+    "description": {
+      "en_US": "Umami is a privacy-focused web analytics platform. This recipe uses the official Umami image with a separate PostgreSQL LXC for persistent analytics data."
+    },
+    "category": "monitoring",
+    "category_label": "Monitoring & Analytics",
+    "author": "Umami Software",
+    "developer": "Umami Software",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/umami.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 3000,
+      "path": "/"
+    },
+    "website": "https://umami.is/",
+    "documentation": "https://docs.umami.is/docs/install",
+    "repository": "https://github.com/umami-software/umami",
+    "tips": [
+      "The initial administrator login is admin / umami. Change the password immediately after the first sign-in.",
+      "Umami runs in one LXC and PostgreSQL in a separate private LXC. The PostgreSQL managed volume stores analytics data; the Umami service has no data volume.",
+      "The official Compose healthcheck probes /api/heartbeat. ProxMenux performs its standard first-start HTTP check against the web root; verify /api/heartbeat and sign-in separately during runtime validation.",
+      "The Compose file uses official Umami and PostgreSQL images. ProxMenux generates a unique database password, APP_SECRET, and 64-character TWO_FACTOR_ENCRYPTION_KEY."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": "2026-10-23"
+  },
+  "source": {
+    "provider": "umami",
+    "repository": "https://github.com/umami-software/umami",
+    "default_branch": "master",
+    "revision": "559e3c607c23d2c72d9bd4f6481bda428255323c",
+    "image_repository_url": "https://github.com/umami-software/umami/pkgs/container/umami",
+    "readme_pushed_at": "",
+    "compose_sha256": "fb542a641c14fc2b1ff0d59558a197ed4f607b6608bf812afd20dad662ae0e8c",
+    "generated_at": "2026-10-27T09:38:05+00:00",
+    "readme_raw_url": "https://raw.githubusercontent.com/umami-software/umami/559e3c607c23d2c72d9bd4f6481bda428255323c/docker-compose.yml"
+  },
+  "container_contract": {
+    "service_name": "umami",
+    "container_name": "umami",
+    "image": {
+      "reference": "ghcr.io/umami-software/umami:latest",
+      "registry": "ghcr.io",
+      "repository": "ghcr.io/umami-software/umami",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "DATABASE_URL",
+        "example": "postgresql://umami:${GENERATED_DB_PASSWORD}@db:5432/umami",
+        "required": true,
+        "sensitive": true,
+        "source": "official-docker-compose"
+      },
+      {
+        "name": "APP_SECRET",
+        "example": "${GENERATED_APP_SECRET}",
+        "required": true,
+        "sensitive": true,
+        "source": "official-documentation"
+      },
+      {
+        "name": "TWO_FACTOR_ENCRYPTION_KEY",
+        "example": "${GENERATED_TWO_FACTOR_ENCRYPTION_KEY}",
+        "required": true,
+        "sensitive": true,
+        "source": "official-docker-compose"
+      }
+    ],
+    "volumes": [],
+    "ports": [
+      {
+        "container_port": 3000,
+        "published_example": 3000,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [
+      {
+        "name": "db",
+        "image": "postgres:15-alpine"
+      }
+    ],
+    "restart": "always",
+    "stop_grace_period": null,
+    "original_compose": "---\nservices:\n  umami:\n    image: ghcr.io/umami-software/umami:latest\n    ports:\n      - \"3000:3000\"\n    environment:\n      DATABASE_URL: postgresql://umami:umami@db:5432/umami\n      APP_SECRET: replace-me-with-a-random-string\n      # Required for two-factor authentication, generate with: openssl rand -hex 32\n      TWO_FACTOR_ENCRYPTION_KEY: replace-me-with-a-64-character-hex-string\n    depends_on:\n      db:\n        condition: service_healthy\n    init: true\n    restart: always\n    healthcheck:\n      test: [\"CMD-SHELL\", \"curl http://localhost:3000/api/heartbeat\"]\n      interval: 5s\n      timeout: 5s\n      retries: 5\n  db:\n    image: postgres:15-alpine\n    environment:\n      POSTGRES_DB: umami\n      POSTGRES_USER: umami\n      POSTGRES_PASSWORD: umami\n    volumes:\n      - umami-db-data:/var/lib/postgresql/data\n    restart: always\n    healthcheck:\n      test: [\"CMD-SHELL\", \"pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}\"]\n      interval: 5s\n      timeout: 5s\n      retries: 5\nvolumes:\n  umami-db-data:\n"
+  },
+  "compose_stack": {
+    "project_name": "umami",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "umami",
+    "service_count": 2,
+    "services": [
+      {
+        "name": "db",
+        "image": "postgres:15-alpine",
+        "is_main": false,
+        "role": "dependency",
+        "vmid_offset": 1,
+        "depends_on": [],
+        "frontend_network": false,
+        "private_network": true,
+        "compose": {
+          "image": "postgres:15-alpine",
+          "environment": {
+            "POSTGRES_DB": "umami",
+            "POSTGRES_USER": "umami",
+            "POSTGRES_PASSWORD": "${GENERATED_DB_PASSWORD}"
+          },
+          "volumes": [
+            "umami-db-data:/var/lib/postgresql/data"
+          ],
+          "restart": "always",
+          "healthcheck": {
+            "test": [
+              "CMD-SHELL",
+              "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"
+            ],
+            "interval": "5s",
+            "timeout": "5s",
+            "retries": 5
+          }
+        }
+      },
+      {
+        "name": "umami",
+        "image": "ghcr.io/umami-software/umami:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [
+          "db"
+        ],
+        "frontend_network": true,
+        "private_network": true,
+        "compose": {
+          "image": "ghcr.io/umami-software/umami:latest",
+          "ports": [
+            "3000:3000"
+          ],
+          "environment": {
+            "DATABASE_URL": "postgresql://umami:${GENERATED_DB_PASSWORD}@db:5432/umami",
+            "APP_SECRET": "${GENERATED_APP_SECRET}",
+            "TWO_FACTOR_ENCRYPTION_KEY": "${GENERATED_TWO_FACTOR_ENCRYPTION_KEY}"
+          },
+          "depends_on": {
+            "db": {
+              "condition": "service_healthy"
+            }
+          },
+          "init": true,
+          "restart": "always",
+          "healthcheck": {
+            "test": [
+              "CMD-SHELL",
+              "curl http://localhost:3000/api/heartbeat"
+            ],
+            "interval": "5s",
+            "timeout": "5s",
+            "retries": 5
+          }
+        }
+      }
+    ],
+    "top_level": {
+      "name": "umami",
+      "volumes": {
+        "umami-db-data": {}
+      }
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": true,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-replace-compose-service-dns",
+      "dependency_external_access": "disabled",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "umami-database-data",
+        "service": "db",
+        "container_path": "/var/lib/postgresql/data",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "default": "managed-volume",
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ]
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 2,
+      "start_order": [
+        "db",
+        "umami"
+      ],
+      "stop_order": [
+        "umami",
+        "db"
+      ],
+      "dependency_readiness": "postgres-healthcheck-before-application",
+      "rollback_on_failure": "preserve-created-containers-and-volumes-for-diagnosis"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": [
+        {
+          "id": "db-password",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "db",
+              "environment_variable": "POSTGRES_PASSWORD"
+            },
+            {
+              "service": "umami",
+              "environment_variable": "DATABASE_URL"
+            }
+          ]
+        },
+        {
+          "id": "app-secret",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "umami",
+              "environment_variable": "APP_SECRET"
+            }
+          ]
+        },
+        {
+          "id": "two-factor-encryption-key",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "umami",
+              "environment_variable": "TWO_FACTOR_ENCRYPTION_KEY"
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Web UI",
+        "scheme": "http",
+        "port": 3000,
+        "path": "/",
+        "source": "official-docker-compose"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "Initial Umami administrator",
+        "type": "static-default",
+        "username": "admin",
+        "password": "umami",
+        "change_required": true,
+        "source": "official-documentation",
+        "retrieval": null
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-zfs",
+      "volume_storage": "local-zfs",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 60
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "compose-dependency-network",
+        "upstream_behavior": "Docker Compose resolves the db service name on the project network and waits until PostgreSQL is healthy.",
+        "native_lxc_behavior": "ProxMenux creates a private Proxmox bridge, gives each service its own LXC, maps the db alias, and waits for PostgreSQL readiness before first starting Umami.",
+        "reason": "The two official Compose services run in separate native OCI LXCs.",
+        "behavioral_impact": "PostgreSQL stays on the private service network and has no published port.",
+        "validation": "passed"
+      },
+      {
+        "id": "generated-compose-secrets",
+        "upstream_behavior": "The official Compose file uses example values for APP_SECRET, TWO_FACTOR_ENCRYPTION_KEY, and PostgreSQL credentials.",
+        "native_lxc_behavior": "ProxMenux generates a unique PostgreSQL password, APP_SECRET, and a 64-character hexadecimal two-factor key for each installation.",
+        "reason": "Do not reuse example credentials between installations.",
+        "behavioral_impact": "The administrator still changes Umami’s documented initial admin password after first sign-in.",
+        "validation": "passed"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "The official Compose file probes /api/heartbeat every five seconds for Umami and uses pg_isready for PostgreSQL.",
+        "native_lxc_behavior": "The stack waits for PostgreSQL readiness, then ProxMenux performs its standard first-start HTTP check at the Umami web root. It does not install a continuous health monitor.",
+        "reason": "The current generic installer uses the application endpoint for its first-start check.",
+        "behavioral_impact": "Runtime validation should separately check /api/heartbeat and the interactive login.",
+        "validation": "passed"
+      }
+    ],
+    "installer_profile": {
+      "stack_driver": "generic-multi-lxc-stack"
+    },
+    "security_profile": {
+      "requires_privileged_lxc": false,
+      "source_requests_privileged_lxc": false,
+      "optional_privileged_lxc": false,
+      "requires_host_pid_namespace": false,
+      "source_requests_relaxed_confinement": false,
+      "requires_relaxed_confinement": false,
+      "optional_relaxed_confinement": false,
+      "risk_level": "normal",
+      "confirmation_required": false,
+      "warning": "The official Umami and PostgreSQL Compose services do not request privileged mode or relaxed host confinement."
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "depends_on",
+      "environment",
+      "healthcheck",
+      "image",
+      "init",
+      "ports",
+      "restart",
+      "volumes"
+    ],
+    "untranslated_blockers": [],
+    "policy": "The official two-service Compose model is represented as two native OCI LXCs with a private PostgreSQL dependency and managed database storage. ProxMenux applies a first-start web-root check; validate the official heartbeat endpoint and login separately."
+  },
+  "validation": {
+    "schema": "passed",
+    "clean_install": "passed",
+    "service_health": "passed",
+    "restart_persistence": "passed",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending",
+    "remove": "passed",
+    "advanced_configuration": "pending",
+    "storage_modes": "pending",
+    "modify": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false,
+    "dependency_lifecycle": {
+      "implementation": "proxmox-hookscript",
+      "trigger": "main-lxc-pre-start",
+      "waits_for_dependency_healthchecks": true,
+      "stops_dependencies_with_main": false
+    }
+  }
+}

oci/catalog/categories.json

@@ -380,6 +380,7 @@
     "tvheadend": "media",
     "typesense": "databases",
     "ubooquity": "media",
+    "umami": "monitoring",
     "ungoogled-chromium": "desktop",
     "unifi-network-application": "network",
     "unpackerr": "arr",

oci/catalog/curated/umami.json

@@ -0,0 +1,428 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-umami",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Umami"
+    },
+    "tagline": {
+      "en_US": "Privacy-focused, self-hosted web analytics."
+    },
+    "description": {
+      "en_US": "Umami is a privacy-focused web analytics platform. This recipe uses the official Umami image with a separate PostgreSQL LXC for persistent analytics data."
+    },
+    "category": "monitoring",
+    "category_label": "Monitoring & Analytics",
+    "author": "Umami Software",
+    "developer": "Umami Software",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/umami.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 3000,
+      "path": "/"
+    },
+    "website": "https://umami.is/",
+    "documentation": "https://docs.umami.is/docs/install",
+    "repository": "https://github.com/umami-software/umami",
+    "tips": [
+      "The initial administrator login is admin / umami. Change the password immediately after the first sign-in.",
+      "Umami runs in one LXC and PostgreSQL in a separate private LXC. The PostgreSQL managed volume stores analytics data; the Umami service has no data volume.",
+      "The official Compose healthcheck probes /api/heartbeat. ProxMenux performs its standard first-start HTTP check against the web root; verify /api/heartbeat and sign-in separately during runtime validation.",
+      "The Compose file uses official Umami and PostgreSQL images. ProxMenux generates a unique database password, APP_SECRET, and 64-character TWO_FACTOR_ENCRYPTION_KEY."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": "2026-10-23"
+  },
+  "source": {
+    "provider": "umami",
+    "repository": "https://github.com/umami-software/umami",
+    "default_branch": "master",
+    "revision": "559e3c607c23d2c72d9bd4f6481bda428255323c",
+    "image_repository_url": "https://github.com/umami-software/umami/pkgs/container/umami",
+    "readme_pushed_at": "",
+    "compose_sha256": "fb542a641c14fc2b1ff0d59558a197ed4f607b6608bf812afd20dad662ae0e8c",
+    "generated_at": "2026-10-27T09:38:05+00:00",
+    "readme_raw_url": "https://raw.githubusercontent.com/umami-software/umami/559e3c607c23d2c72d9bd4f6481bda428255323c/docker-compose.yml"
+  },
+  "container_contract": {
+    "service_name": "umami",
+    "container_name": "umami",
+    "image": {
+      "reference": "ghcr.io/umami-software/umami:latest",
+      "registry": "ghcr.io",
+      "repository": "ghcr.io/umami-software/umami",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "DATABASE_URL",
+        "example": "postgresql://umami:${GENERATED_DB_PASSWORD}@db:5432/umami",
+        "required": true,
+        "sensitive": true,
+        "source": "official-docker-compose"
+      },
+      {
+        "name": "APP_SECRET",
+        "example": "${GENERATED_APP_SECRET}",
+        "required": true,
+        "sensitive": true,
+        "source": "official-documentation"
+      },
+      {
+        "name": "TWO_FACTOR_ENCRYPTION_KEY",
+        "example": "${GENERATED_TWO_FACTOR_ENCRYPTION_KEY}",
+        "required": true,
+        "sensitive": true,
+        "source": "official-docker-compose"
+      }
+    ],
+    "volumes": [],
+    "ports": [
+      {
+        "container_port": 3000,
+        "published_example": 3000,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [
+      {
+        "name": "db",
+        "image": "postgres:15-alpine"
+      }
+    ],
+    "restart": "always",
+    "stop_grace_period": null,
+    "original_compose": "---\nservices:\n  umami:\n    image: ghcr.io/umami-software/umami:latest\n    ports:\n      - \"3000:3000\"\n    environment:\n      DATABASE_URL: postgresql://umami:umami@db:5432/umami\n      APP_SECRET: replace-me-with-a-random-string\n      # Required for two-factor authentication, generate with: openssl rand -hex 32\n      TWO_FACTOR_ENCRYPTION_KEY: replace-me-with-a-64-character-hex-string\n    depends_on:\n      db:\n        condition: service_healthy\n    init: true\n    restart: always\n    healthcheck:\n      test: [\"CMD-SHELL\", \"curl http://localhost:3000/api/heartbeat\"]\n      interval: 5s\n      timeout: 5s\n      retries: 5\n  db:\n    image: postgres:15-alpine\n    environment:\n      POSTGRES_DB: umami\n      POSTGRES_USER: umami\n      POSTGRES_PASSWORD: umami\n    volumes:\n      - umami-db-data:/var/lib/postgresql/data\n    restart: always\n    healthcheck:\n      test: [\"CMD-SHELL\", \"pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}\"]\n      interval: 5s\n      timeout: 5s\n      retries: 5\nvolumes:\n  umami-db-data:\n"
+  },
+  "compose_stack": {
+    "project_name": "umami",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "umami",
+    "service_count": 2,
+    "services": [
+      {
+        "name": "db",
+        "image": "postgres:15-alpine",
+        "is_main": false,
+        "role": "dependency",
+        "vmid_offset": 1,
+        "depends_on": [],
+        "frontend_network": false,
+        "private_network": true,
+        "compose": {
+          "image": "postgres:15-alpine",
+          "environment": {
+            "POSTGRES_DB": "umami",
+            "POSTGRES_USER": "umami",
+            "POSTGRES_PASSWORD": "${GENERATED_DB_PASSWORD}"
+          },
+          "volumes": [
+            "umami-db-data:/var/lib/postgresql/data"
+          ],
+          "restart": "always",
+          "healthcheck": {
+            "test": [
+              "CMD-SHELL",
+              "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"
+            ],
+            "interval": "5s",
+            "timeout": "5s",
+            "retries": 5
+          }
+        }
+      },
+      {
+        "name": "umami",
+        "image": "ghcr.io/umami-software/umami:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [
+          "db"
+        ],
+        "frontend_network": true,
+        "private_network": true,
+        "compose": {
+          "image": "ghcr.io/umami-software/umami:latest",
+          "ports": [
+            "3000:3000"
+          ],
+          "environment": {
+            "DATABASE_URL": "postgresql://umami:${GENERATED_DB_PASSWORD}@db:5432/umami",
+            "APP_SECRET": "${GENERATED_APP_SECRET}",
+            "TWO_FACTOR_ENCRYPTION_KEY": "${GENERATED_TWO_FACTOR_ENCRYPTION_KEY}"
+          },
+          "depends_on": {
+            "db": {
+              "condition": "service_healthy"
+            }
+          },
+          "init": true,
+          "restart": "always",
+          "healthcheck": {
+            "test": [
+              "CMD-SHELL",
+              "curl http://localhost:3000/api/heartbeat"
+            ],
+            "interval": "5s",
+            "timeout": "5s",
+            "retries": 5
+          }
+        }
+      }
+    ],
+    "top_level": {
+      "name": "umami",
+      "volumes": {
+        "umami-db-data": {}
+      }
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": true,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-replace-compose-service-dns",
+      "dependency_external_access": "disabled",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "umami-database-data",
+        "service": "db",
+        "container_path": "/var/lib/postgresql/data",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "default": "managed-volume",
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ]
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 2,
+      "start_order": [
+        "db",
+        "umami"
+      ],
+      "stop_order": [
+        "umami",
+        "db"
+      ],
+      "dependency_readiness": "postgres-healthcheck-before-application",
+      "rollback_on_failure": "preserve-created-containers-and-volumes-for-diagnosis"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": [
+        {
+          "id": "db-password",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "db",
+              "environment_variable": "POSTGRES_PASSWORD"
+            },
+            {
+              "service": "umami",
+              "environment_variable": "DATABASE_URL"
+            }
+          ]
+        },
+        {
+          "id": "app-secret",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "umami",
+              "environment_variable": "APP_SECRET"
+            }
+          ]
+        },
+        {
+          "id": "two-factor-encryption-key",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "umami",
+              "environment_variable": "TWO_FACTOR_ENCRYPTION_KEY"
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Web UI",
+        "scheme": "http",
+        "port": 3000,
+        "path": "/",
+        "source": "official-docker-compose"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "Initial Umami administrator",
+        "type": "static-default",
+        "username": "admin",
+        "password": "umami",
+        "change_required": true,
+        "source": "official-documentation",
+        "retrieval": null
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-zfs",
+      "volume_storage": "local-zfs",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 60
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "compose-dependency-network",
+        "upstream_behavior": "Docker Compose resolves the db service name on the project network and waits until PostgreSQL is healthy.",
+        "native_lxc_behavior": "ProxMenux creates a private Proxmox bridge, gives each service its own LXC, maps the db alias, and waits for PostgreSQL readiness before first starting Umami.",
+        "reason": "The two official Compose services run in separate native OCI LXCs.",
+        "behavioral_impact": "PostgreSQL stays on the private service network and has no published port.",
+        "validation": "passed"
+      },
+      {
+        "id": "generated-compose-secrets",
+        "upstream_behavior": "The official Compose file uses example values for APP_SECRET, TWO_FACTOR_ENCRYPTION_KEY, and PostgreSQL credentials.",
+        "native_lxc_behavior": "ProxMenux generates a unique PostgreSQL password, APP_SECRET, and a 64-character hexadecimal two-factor key for each installation.",
+        "reason": "Do not reuse example credentials between installations.",
+        "behavioral_impact": "The administrator still changes Umami’s documented initial admin password after first sign-in.",
+        "validation": "passed"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "The official Compose file probes /api/heartbeat every five seconds for Umami and uses pg_isready for PostgreSQL.",
+        "native_lxc_behavior": "The stack waits for PostgreSQL readiness, then ProxMenux performs its standard first-start HTTP check at the Umami web root. It does not install a continuous health monitor.",
+        "reason": "The current generic installer uses the application endpoint for its first-start check.",
+        "behavioral_impact": "Runtime validation should separately check /api/heartbeat and the interactive login.",
+        "validation": "passed"
+      }
+    ],
+    "installer_profile": {
+      "stack_driver": "generic-multi-lxc-stack"
+    },
+    "security_profile": {
+      "requires_privileged_lxc": false,
+      "source_requests_privileged_lxc": false,
+      "optional_privileged_lxc": false,
+      "requires_host_pid_namespace": false,
+      "source_requests_relaxed_confinement": false,
+      "requires_relaxed_confinement": false,
+      "optional_relaxed_confinement": false,
+      "risk_level": "normal",
+      "confirmation_required": false,
+      "warning": "The official Umami and PostgreSQL Compose services do not request privileged mode or relaxed host confinement."
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "depends_on",
+      "environment",
+      "healthcheck",
+      "image",
+      "init",
+      "ports",
+      "restart",
+      "volumes"
+    ],
+    "untranslated_blockers": [],
+    "policy": "The official two-service Compose model is represented as two native OCI LXCs with a private PostgreSQL dependency and managed database storage. ProxMenux applies a first-start web-root check; validate the official heartbeat endpoint and login separately."
+  },
+  "validation": {
+    "schema": "passed",
+    "clean_install": "passed",
+    "service_health": "passed",
+    "restart_persistence": "passed",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending",
+    "remove": "passed",
+    "advanced_configuration": "pending",
+    "storage_modes": "pending",
+    "modify": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false,
+    "dependency_lifecycle": {
+      "implementation": "proxmox-hookscript",
+      "trigger": "main-lxc-pre-start",
+      "waits_for_dependency_healthchecks": true,
+      "stops_dependencies_with_main": false
+    }
+  }
+}

oci/catalog/index.json

@@ -16789,6 +16789,39 @@
       "hidden": false,
       "template_id": "linuxserver-ubooquity"
     },
+    {
+      "id": "umami",
+      "provider": "umami",
+      "template_family": "curated-profile",
+      "title": "Umami",
+      "repository": "https://github.com/umami-software/umami",
+      "description": "Umami is a privacy-focused web analytics platform. This recipe uses the official Umami image with a separate PostgreSQL LXC for persistent analytics data.",
+      "website": "https://umami.is/",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/umami.webp",
+      "architectures": [
+        "amd64",
+        "arm64"
+      ],
+      "updated_at": "2026-10-23",
+      "main_image": "ghcr.io/umami-software/umami:latest",
+      "category": "monitoring",
+      "category_label": "Monitoring & Analytics",
+      "replaces_discovered_ids": [],
+      "curated_path": "catalog/curated/umami.json",
+      "template": "apps/umami.json",
+      "template_status": "generated-unvalidated",
+      "hidden": false,
+      "automatic_install_candidate": true,
+      "untranslated_blockers": [],
+      "requires_privileged_lxc": false,
+      "optional_privileged_lxc": false,
+      "requires_host_pid_namespace": false,
+      "requires_relaxed_confinement": false,
+      "optional_relaxed_confinement": false,
+      "requires_security_confirmation": false,
+      "multi_container": true,
+      "template_id": "image-umami"
+    },
     {
       "id": "ungoogled-chromium",
       "provider": "linuxserver.io",