MikaPST — Unraid Community Apps

Docker application templates for Unraid

Self-hosted applications and integrations for the Unraid community.

Table of Contents

• Applications
  • Sablier
    • Installing Sablier on Unraid
    • Docker network
    • Traefik integration
      • Enable the Sablier plugin
      • Create a Sablier middleware
    • Activating Sablier on an application
    • Custom Sablier themes
    • Sablier Theme Editor
    • Sablier architecture
    • Sablier useful links
  • DockDash
    • Installing DockDash on Unraid
    • Security warning
    • Authentication
    • DockDash configuration
    • DockDash update monitoring
    • DockDash architecture
    • DockDash useful links
  • Portabase Agent
    • Installing Portabase Agent on Unraid
    • Portabase Agent configuration
    • Network and database access
    • Portabase Agent useful links
  • Web-Check
    • Installing Web-Check on Unraid
    • Web-Check configuration
    • Web-Check useful links
• Repository structure
• Support
• License

Applications

This repository provides Docker application templates designed for Unraid Community Applications.

The goal is to provide simple, documented and maintainable templates for useful self-hosted applications and integrations.

Available applications

Application	Description	Category	License
Sablier	Docker-aware middleware for automatically starting and stopping containers based on incoming requests	Docker / FinOps	Apache-2.0
DockDash	Docker dashboard for monitoring containers, resources, image updates and GitHub release notes	Docker / Monitoring	AGPL-3.0
Portabase Agent	Agent connecting databases to Portabase for backup and restore operations	Backup / Database	See upstream project
Web-Check	Open-source OSINT tool for analysing websites and domains	Security / OSINT	MIT

Sablier

Docker-aware middleware for automatically starting and stopping containers
🌐 sablierapp.dev

Sablier is a lightweight Docker-aware middleware that can automatically start and stop containers based on incoming requests.

It is designed to work with reverse proxies such as Traefik, helping reduce resource consumption by stopping applications that are not being used.

• Docker image: sablierapp/sablier:1.15.0
• Default HTTP/API port: 10000
• Docker provider: enabled
• Reverse proxy integration: Traefik, Caddy and other compatible proxies
• License: Apache-2.0

Installing Sablier on Unraid

The templates/sablier.xml file is intended for use with Unraid Community Applications.

The template configures:

• Sablier Docker image
• Docker socket access
• Sablier configuration file
• Optional custom themes directory
• HTTP port 10000
• Traefik labels
• start --provider.name=docker startup command

Docker network

The template uses the Docker network:

traefik

by default, because this is a common configuration when Sablier is used with Traefik.

If you use another reverse proxy, you can change the Docker network to the network used by your reverse proxy.

Sablier itself is not limited to Traefik.

Traefik integration

Sablier can be integrated with Traefik through the official Sablier Traefik plugin.

1. Enable the Sablier plugin in Traefik

Add the following configuration to your traefik.yml:

# =========================
# PLUGINS
# =========================
experimental:
  plugins:
    sablier:
      moduleName: github.com/sablierapp/sablier-traefik-plugin
      version: v1.3.0

Restart Traefik after changing this configuration.

The plugin used in this example is Sablier Traefik Plugin v1.3.0.

Official Traefik plugin page:

https://plugins.traefik.io/plugins/69104ac3b7d4dd76110a1a09/sablier

2. Create a Sablier middleware

Once the plugin is enabled, configure a middleware in your Traefik dynamic configuration, for example in middlewares.yml.

Example:

# =========================
# SABLIER APP
# =========================
sablier-bentopdf:
  plugin:
    sablier:
      sablierUrl: "http://sablier:10000"
      group: "bentopdf"
      sessionDuration: 5m
      ignoreUserAgent: "kuma"
      dynamic:
        displayName: "BentoPDF"
        showDetails: true
        theme: ghost_fr
        refreshFrequency: 10s

Configuration explained

The sablierUrl assumes that the Sablier container is reachable as sablier on the same Docker network as Traefik.

Activating Sablier on an application

Once the middleware has been created, the application that should be managed by Sablier needs the appropriate Traefik and Sablier labels.

For example, for BentoPDF:

labels:
  - "traefik.http.routers.bentopdf.middlewares=sablier-bentopdf@file"
  - "sablier.enable=true"
  - "sablier.group=bentopdf"
  - "traefik.docker.allownonrunning=true"

The important elements are:

traefik.http.routers.bentopdf.middlewares=sablier-bentopdf@file

This attaches the previously created Traefik middleware to the application's router.

sablier.enable=true

This enables Sablier management for the container.

sablier.group=bentopdf

This associates the container with the same Sablier group configured in the middleware.

traefik.docker.allownonrunning=true

This allows Traefik to consider the container even when it is stopped, which is important for Sablier's start-on-request behavior.

Replace bentopdf with the name/group appropriate for your application.

Custom Sablier themes

Sablier supports custom themes for its dynamic pages.

The Unraid template provides an optional directory:

/mnt/user/appdata/sablier/themes

which is mounted inside the container as:

/etc/sablier/themes

For example, custom themes can be stored locally as:

/mnt/user/appdata/sablier/themes/ghost_fr.html
/mnt/user/appdata/sablier/themes/hacker-terminal_fr.html
/mnt/user/appdata/sablier/themes/shuffle_fr.html

They can then be referenced from the Traefik middleware configuration:

dynamic:
  theme: ghost_fr

or:

dynamic:
  theme: hacker-terminal_fr

This makes it possible to customize the Sablier page displayed while an application is starting.

Sablier Theme Editor

Sablier provides an official online theme editor that makes it easy to create, customize and preview Sablier themes.

Official Sablier Theme Editor:

https://editor.sablierapp.dev/

Once your theme is created, you can export it and place the resulting .html file in the Sablier themes directory:

/mnt/user/appdata/sablier/themes/

You can then reference the theme from your Traefik middleware configuration using the filename without the .html extension.

For example:

ghost_fr.html

becomes:

dynamic:
  theme: ghost_fr

Sablier architecture

A typical Traefik + Sablier setup looks like this:

                         Internet
                             │
                             ▼
                         Traefik
                             │
                 Sablier Traefik Plugin
                             │
                             ▼
                          Sablier
                     ┌───────┴───────┐
                     │ Docker API    │
                     ▼               │
              Docker containers     │
                     │               │
          ┌──────────┼──────────┐    │
          ▼          ▼          ▼    │
       BentoPDF   Shelfmark   Caesium │

Traefik receives the request, the Sablier middleware checks the application state, and Sablier can start the associated container when necessary.

Sablier useful links

• Official website: https://sablierapp.dev/
• Official documentation / tutorials: https://sablierapp.dev/tutorials/
• GitHub repository: https://github.com/sablierapp/sablier
• Traefik plugin: https://plugins.traefik.io/plugins/69104ac3b7d4dd76110a1a09/sablier

DockDash

Container and service monitoring dashboard
🌐 github.com/dougmaitelli/DockDash

DockDash is a self-hosted dashboard for visualizing Docker containers and network services.

It automatically discovers Docker services, monitors their health and resources, detects available container image updates and displays the corresponding GitHub release notes.

DockDash is particularly useful for keeping track of versioned Docker images without having to manually visit the GitHub repository of every application.

• Docker image: ghcr.io/dougmaitelli/dockdash:latest
• Default container port: 3001
• Unraid host port: 4001
• Docker network: bridge
• Docker provider: Docker socket
• Update monitoring: semantic-version aware
• GitHub release notes: supported
• Authentication: not enforced by default
• License: AGPL-3.0

Installing DockDash on Unraid

The templates/dockdash.xml file is intended for use with Unraid Community Applications.

The template configures:

• DockDash Docker image
• Standard Docker bridge network
• Docker socket access
• Persistent application data
• HTTP port 4001 → 3001
• Update monitoring
• Network discovery
• Health monitoring
• Resource monitoring

The default configuration stores DockDash application data in:

/mnt/user/appdata/dockdash

and mounts it inside the container as:

/app/data

The Docker socket is mounted as:

/var/run/docker.sock

⚠️ Security warning

DockDash does not enforce authentication by default.

This is particularly important because DockDash requires access to the Docker socket and provides powerful Docker management features.

Depending on the configuration, DockDash can:

• start, stop and restart containers
• execute commands inside containers
• access container filesystems
• view Docker logs
• monitor resources
• manage Docker services

Access to the Docker socket can effectively provide root-level control over the Docker host.

Therefore:

Do not expose DockDash directly to the Internet or to an untrusted network without an authentication layer.

For a typical self-hosted installation, protect DockDash using either its built-in OIDC authentication or an authenticated reverse proxy.

Authentication

DockDash supports two main approaches for protecting the interface.

Option 1 — Built-in OIDC

DockDash supports OpenID Connect authentication with providers such as:

• Authentik
• Authelia
• Keycloak
• Google
• Other compatible OIDC providers

OIDC can be configured using environment variables such as:

OIDC_ISSUER
OIDC_CLIENT_ID
OIDC_CLIENT_SECRET
SESSION_SECRET

Refer to the official DockDash documentation for the complete OIDC configuration.

Option 2 — Reverse proxy authentication

DockDash can also be placed behind a reverse proxy and protected by an external authentication layer.

Examples include:

• Traefik + Authentik
• Traefik + Authelia
• Caddy + authentication middleware
• Nginx + authentication
• oauth2-proxy
• TinyAuth
• Other trusted authentication solutions

This approach can be particularly convenient in an existing self-hosted infrastructure where authentication is already centralized.

DockDash configuration

The Unraid template exposes the most useful DockDash configuration parameters.

Basic configuration

Advanced configuration

The NETWORK_CIDRS value should be adapted to the local network if necessary.

For example:

192.168.0.0/24

or another CIDR corresponding to your local network.

DockDash update monitoring

One of DockDash's main features is its semantic-version-aware Docker image update monitoring.

Instead of simply reporting that a Docker image has changed, DockDash can compare the version actually running with newer compatible versions published by the registry.

For example:

Running:
1.25.0

Available:
1.26.0

DockDash can report:

1.25.0 → 1.26.0

It can then resolve the source repository and retrieve the corresponding GitHub release notes.

This makes it possible to see:

Application
Current version → Available version
          │
          ▼
      GitHub Release
          │
          ▼
       Changelog

This is particularly useful when managing a large number of self-hosted applications.

Instead of manually checking each GitHub repository, DockDash provides the update information and associated release notes directly from the dashboard.

DockDash also supports digest-based detection for floating tags such as:

latest
stable
dev

DockDash architecture

A basic Unraid installation looks like this:

                         Unraid
                            │
                            ▼
                    ┌───────────────┐
                    │    DockDash   │
                    │    :3001      │
                    └───────┬───────┘
                            │
                     Docker Socket
                            │
                            ▼
                     Docker Engine
                            │
        ┌───────────────────┼───────────────────┐
        ▼                   ▼                   ▼
    Sablier             Traefik            Vaultwarden
        │                   │                   │
        ▼                   ▼                   ▼
      Other              Other               Other
    containers          containers          containers

DockDash reads Docker information through:

/var/run/docker.sock

and provides a centralized view of the Docker environment.

It can monitor:

• container health
• CPU and memory usage
• network and disk I/O
• Docker image versions
• available updates
• GitHub changelogs
• Docker logs
• container filesystem
• container terminal
• service topology

Docker socket hardening

For advanced deployments, the Docker socket can be exposed through a restricted Docker socket proxy rather than mounting the host socket directly.

A solution such as:

tecnativa/docker-socket-proxy

can be used to limit the Docker API operations available to DockDash.

This is an advanced configuration and is not required for the standard Unraid template.

DockDash useful links

• GitHub repository: https://github.com/dougmaitelli/DockDash
• Docker image: https://github.com/dougmaitelli/DockDash/pkgs/container/dockdash
• Security policy: https://github.com/dougmaitelli/DockDash/blob/main/SECURITY.md

Portabase Agent

Database backup and restore agent for Portabase
🌐 portabase.io

Portabase Agent is a background service that connects a Portabase Dashboard to database servers and executes backup and restore tasks configured through the dashboard.

• Docker image: portabase/agent:latest
• Container type: background service
• Web interface: none
• Published ports: none required by the template
• Authentication: EDGE_KEY generated by the Portabase Dashboard
• Timezone default: Europe/Paris
• Polling interval default: 5 seconds

Installing Portabase Agent on Unraid

The templates/portabase-agent.xml file is intended for use with Unraid Community Applications.

The template configures:

• Portabase Agent Docker image
• Required EDGE_KEY environment variable, masked in the Unraid interface
• Timezone configuration
• Optional task polling interval
• Persistent agent data directory
• Optional agent configuration directory
• Standard Docker bridge network by default
• No published web port and no WebUI, because the agent runs in the background

Generate an Edge Key for the agent in your Portabase Dashboard and enter it during installation. Treat this key as a secret: do not publish it in screenshots, XML templates, source control or logs shared publicly.

Portabase Agent configuration

The Unraid template exposes the following parameters:

The template uses Docker's bridge network by default. You can change the network in Unraid if your deployment requires the agent to communicate directly with other containers on a custom Docker network.

Network and database access

The agent must be able to reach:

1. The Portabase Dashboard URL encoded in its Edge Key, typically over HTTPS.
2. Each database server configured in Portabase.

If a database runs in another Docker container, ensure that the agent can reach it through a shared Docker network or a suitable host-reachable address and published database port. Do not expose database services to the public Internet just to make them reachable by the agent.

Use dedicated database credentials with only the permissions needed for the backup and restore operations you intend to perform. The exact permissions depend on the database engine, the backup/restore method and the restore options. Test restoration against a separate test database before relying on the setup for production data.

The agent does not need a public HTTP port or a reverse-proxy route. Keep EDGE_KEY confidential and regenerate it from Portabase if it is exposed or compromised.

Portabase Agent useful links

• Official website: https://portabase.io/
• GitHub repository: https://github.com/Portabase/portabase
• Official documentation: https://portabase.io/docs/
• Docker image: https://hub.docker.com/r/portabase/agent

Web-Check

Comprehensive, on-demand open source intelligence for any website
🌐 web-check.xyz

Web-Check is an open-source OSINT tool for analysing websites and domains.

It provides a broad range of checks covering IP addresses, SSL certificates, DNS records, HTTP headers, cookies, redirects, open ports, traceroute, DNS security, performance, trackers, associated hostnames and other website intelligence.

• Docker image: lissy93/web-check:latest
• Default container port: 3000
• Docker network: bridge
• API keys: optional
• License: MIT

Installing Web-Check on Unraid

The templates/web-check.xml file is intended for use with Unraid Community Applications.

The template configures:

• Web-Check Docker image
• Standard Docker bridge network
• HTTP port 3000
• Optional API keys
• Optional API and scan configuration

Web-Check does not require a persistent application volume for its standard deployment.

Web-Check configuration

The template exposes optional API keys and advanced configuration parameters for users who want to enable additional checks or adapt Web-Check to their environment.

Web-Check and external services

Web-Check can use optional third-party APIs to enrich its results. API keys are not required for the core functionality.

If API keys are configured, review the relevant provider's terms and data handling before using them in a production environment.

Web-Check useful links

• Official website: https://web-check.xyz/
• GitHub repository: https://github.com/Lissy93/web-check
• Docker image: https://hub.docker.com/r/lissy93/web-check

Repository structure

.
├── ca_profile.xml
├── README.md
├── LICENSE
├── icons/
│   ├── icon.png
│   ├── icon-sablier.png
│   ├── icon-dockdash.png
│   ├── icon-portabase.png
│   └── icon-web-check.png
└── templates/
    ├── sablier.xml
    ├── dockdash.xml
    ├── portabase-agent.xml
    └── web-check.xml

Each Docker application has its own XML template under:

templates/

For example:

templates/sablier.xml
templates/dockdash.xml
templates/portabase-agent.xml

Application icons and the repository logo are stored in the icons/ directory and referenced directly by their corresponding templates and README entries.

Support

For issues concerning an application itself, please refer to the official project repository.

Sablier

https://github.com/sablierapp/sablier

DockDash

https://github.com/dougmaitelli/DockDash

Web-Check

https://github.com/Lissy93/web-check

Portabase Agent

https://portabase.io/

For issues specifically related to the Unraid templates maintained in this repository, please open an issue in this GitHub repository.

License

This repository contains Unraid application templates maintained by MikaPST.

Each application remains subject to its own upstream license:

• Sablier: Apache License 2.0
• DockDash: GNU Affero General Public License v3.0
• Web-Check: MIT License
• Portabase Agent: refer to the upstream project for its current license terms.

The repository itself is distributed under the license specified in LICENSE.