$ show Dokploy/dokploy
Dokploy is a production-grade, self-hosted Platform-as-a-Service (PaaS) that orchestrates application and database deployment on Docker Swarm. The code confirms the README claims: it clones repos from Git providers (GitHub, GitLab, Bitbucket, Gitea), builds via multiple strategies (Dockerfile, Nixpacks, Railpack, Paketo, Heroku), provisions six database types (Postgres, MySQL, MariaDB, Mongo, Redis, LibSQL) as Swarm services, generates Traefik reverse-proxy configs with ACME/TLS and forward-auth middleware, runs rclone-based backups to S3-compatible storage, and streams logs/terminal/stats over WebSockets. It is not a research or data project; the only data assets are operational metrics collected by a Go agent into SQLite for monitoring dashboards.
The LLM identified 5 files worth highlighting for reuse:
A dependency-free, partitioned FIFO job queue with configurable per-partition concurrency and group-level serialization, exposing a BullMQ-compatible surface. This is genuinely transportable: it imports no internals, has dedicated unit tests for concurrency semantics, and solves the recurring problem of running a fair job queue without Redis or external brokers — extractable into any Node project needing bounded parallel workers.
A family of functions (addSuffixToServiceNames, addSuffixToAllVolumes, addSuffixToSecretsRoot, network isolation) that rewrite parsed docker-compose objects to eliminate name collisions between concurrently deployed stacks. Non-obvious because it must traverse nested compose structures (service references, volume mounts, secret sources, network aliases) without breaking references — backed by a large regression test suite. The pattern applies to any tooling that needs to namespace or sandbox compose-style declarative configs.
A clean VaultClient<T> interface with eight provider implementations (HashiCorp, Infisical, AWS Secrets Manager, AWS Parameter Store, Doppler, Azure, Scaleway, Phase), each handling auth, testConnection, listSecretNames, and getSecrets. This is textbook strategy-pattern design: a registrar picks the client by type, and the rest of the codebase consumes a uniform interface. The provider implementations use only public SDK/HTTP libraries, making the pattern directly reusable for any multi-provider secret-resolution feature.
AES-256-GCM value encryption with an ordered key-fallback chain (primary auth key, secondary derived key, restored backup keys), plus export/decrypt helpers. It solves the real operational problem of decrypting legacy/rotated secrets without downtime and demonstrates careful crypto hygiene (per-value random IVs, authenticated encryption, explicit key versioning). The export/import flow is a reusable pattern for secret-migration tools. Minor caveat: the decryption fail-open path is a deliberate tradeoff that consumers should be aware of.
A permission-resolution framework that computes effective service/project/server access from user roles, custom enterprise roles, and per-resource grants. It is exercised by an extensive matrix test suite and cleanly separates permission computation from tRPC middleware enforcement. The core logic is pure (inputs in, permissions out), making it extractable as a standalone authorization library for any multi-tenant application.