Self-Hosted Creative Suite — deploy

A web-native, CPU-only, debloated creative-production stack — a self-hosted answer to Photopea / Premiere / Figma / Google Photos and friends. Every service is audited and patched to phone home to nothing (no analytics, no telemetry, no Pro/upsell nags). See DEBLOAT.md for exactly what was stripped from each.

This repo is the orchestration/deploy layer — compose files, nginx wiring, config-only services, and docs. The source code lives in per-service fork repos (with full upstream history, so you can rebase updates) — see Per-service repos below.

Deployed live behind *.ekaii.fr on a single host (Ryzen 9 7950X / Coolify + Traefik). No VM / KVM / VNC-webtop / GPU-passthrough — plain containers, pure web apps.

Services

Subdomain	Tool	Kind	Source
paint	miniPaint	raster editor	fork: minipaint
audio	AudioMass	multitrack audio	fork: audiomass
wavacity	Wavacity (Audacity WASM)	audio	fork: wavacity
clip	Omniclip	quick-cut NLE	fork: omniclip
daw	openDAW	browser DAW	fork: opendaw
draw	Excalidraw	whiteboard	fork: excalidraw (+ excalidraw-room collab)
diagrams	drawio	diagrams	image jgraph/drawio
penpot	Penpot	Figma alternative	image penpotapp/*
pdf	Stirling-PDF	PDF toolkit	image (login disabled)
cut	OpenCut classic	full NLE	fork: opencut-classic
photos	Immich	photo management	image (ML on CPU)
rembg	rembg	background removal	image danielgatis/rembg
inpaint	IOPaint	inpaint/erase/upscale	built ai-creative/iopaint/Dockerfile
stems	demucs	stem separation	image paladini/voice-separator
sd	FastSD CPU	image generation	fork: fastsdcpu
—	Revideo	programmatic video scaffold	revideo-scaffold/
—	excalidraw-ai	text→diagram helper	built (excalidraw-ai/)

AI endpoints (rembg/inpaint/stems/sd) sit behind Traefik HTTP basic-auth (compute-abuse protection on a public domain). Everything else is open, or has its own accounts (Penpot/Immich).

Prerequisites

• Docker + Docker Compose v2.
• An external Docker network coolify with a Traefik proxy on it providing entrypoints http/https, a letsencrypt cert resolver, and a redirect-to-https middleware (Coolify convention). Adapt/strip the traefik.* labels for a different proxy. docker network create coolify if you don't have it.
• DNS: point each subdomain at the host's public IP.

Deploy

Config-only services — straight from this repo:

docker compose -f statics/compose.yaml            up -d   # nginx + drawio + excalidraw-room (see "statics" note)
docker compose -f ai-creative/compose.yaml        up -d   # rembg / iopaint / demucs  (set basic-auth first)
docker compose -f stirling-pdf/compose.yaml       up -d
docker compose -f penpot/compose.yaml             up -d   # set PENPOT_SECRET_KEY first
docker compose -f immich/docker-compose.override.yml up -d # copy immich/example.env -> immich/.env first
docker compose -f excalidraw-ai/compose.yaml      up -d   # needs excalidraw-ai/ai.env

iopaint image: docker build -t local/iopaint:cpu ai-creative/iopaint.

Fork-based services — clone the fork, then build/serve it:

git clone https://forgejo.ekaii.fr/admin_ekaii/opencut-classic && cd opencut-classic
# set BETTER_AUTH_SECRET in docker-compose.override.yml (see docker-compose.override.yml.example)
docker compose up -d --build          # -> cut.ekaii.fr

git clone https://forgejo.ekaii.fr/admin_ekaii/fastsdcpu && cd fastsdcpu
docker compose up -d --build          # -> sd.ekaii.fr

statics (statics/compose.yaml) is one nginx serving the six static apps. Its volume mounts expect each app's build output at the paths in the compose file (./minipaint, ./audiomass/src, ./wavacity, ./omniclip-src/x, ./opendaw-dist, ./excalidraw-src/excalidraw-app/build). Build each from its fork repo (each fork's README / .build.sh / finalize.sh pins the upstream and re-applies the debloat) and place/symlink the output at the expected path, then bring the nginx up. statics/nginx.conf also sets the cross-origin-isolation headers openDAW/Wavacity need and no-store for Omniclip/Excalidraw.

Per-service repos (upstream tracking)

Every code fork lives in its own Forgejo repo, cloned with full history and set up so you can pull upstream and rebase the ekaii patches. Each keeps GitHub as origin and pushes to ekaii.

Repo	Upstream	Default branch	ekaii patch
opencut-classic	github.com/opencut-app/opencut-classic	main	debloat (BotID/Databuddy/react-scan/MarbleCMS); docker-compose.override.yml.example
fastsdcpu	github.com/rupeshs/fastsdcpu	main	deploy override
excalidraw	github.com/excalidraw/excalidraw	master	analytics/GoogleFonts/DO-CDN stripped, local fonts, same-origin AI+collab, marketing menu removed + build recipe
omniclip	github.com/omni-media/omniclip	main	debloat at build (vendored CDN + PostHog neutered)
opendaw	github.com/andremichelle/openDAW	main	build recipe
wavacity	github.com/project-developers/wavacity	main	GA/Amplitude/crash-telemetry removed + wasm restored
minipaint	github.com/viliusle/miniPaint	master	pinned (clean; patch surface for branding)
audiomass	github.com/pkalogiros/AudioMass	production	pinned (clean; patch surface for branding)

Update workflow (in a fork checkout; <branch> = the default branch above):

git fetch origin                       # origin = GitHub upstream
git rebase origin/<branch>             # replay the ekaii patch on top of upstream
git push ekaii HEAD:<branch>           # ekaii = the Forgejo fork

Secrets

Nothing sensitive is committed. Provide these yourself (see .env.example):

Where	Variable	How
excalidraw-ai/ai.env	ANTHROPIC_API_KEY	your key (copy from ai.env.example)
immich/.env	DB_PASSWORD	random A-Za-z0-9 (copy from example.env)
penpot/compose.yaml	__PENPOT_SECRET_KEY__	python3 -c "import secrets;print(secrets.token_urlsafe(64))"
ai-creative/compose.yaml	__AI_BASICAUTH_BCRYPT__	htpasswd -nbB creative 'pass' → double every $ → $$
opencut-classic fork	BETTER_AUTH_SECRET	openssl rand -hex 32 (in that repo's docker-compose.override.yml)

License / provenance

Each tool keeps its own upstream license (see the fork repos). This repo adds only compose glue, build recipes, and the debloat documented in DEBLOAT.md.