Merge pull request #5266 from okxlin/feat/yamtrack-1panel-batch52

Add Yamtrack app
2026-09-28 08:01:07 +00:00 · 2026-07-28 23:37:54 +08:00
parent 290a7f44d7 539259f466
commit f7ae06fb59
17 changed files with 634 additions and 0 deletions
@@ -0,0 +1,7 @@
+CONTAINER_NAME=yamtrack
+PANEL_APP_BIND_ADDRESS=127.0.0.1
+PANEL_APP_PORT_HTTP=8000
+APP_DATA_DIR=./data
+YAMTRACK_SECRET=generate
+YAMTRACK_TIMEZONE=UTC
+YAMTRACK_REGISTRATION=True
@@ -0,0 +1,104 @@
+additionalProperties:
+  formFields:
+    - default: 127.0.0.1
+      edit: true
+      envKey: PANEL_APP_BIND_ADDRESS
+      labelEn: Bind Address
+      labelZh: 绑定地址
+      label:
+        en: Bind Address
+        zh: 绑定地址
+        zh-Hant: 綁定位址
+        ja: バインドアドレス
+        ko: 바인드 주소
+        ru: Адрес привязки
+        ms: Alamat ikatan
+        pt-br: Endereco de vinculacao
+      required: true
+      type: text
+    - default: 8000
+      edit: true
+      envKey: PANEL_APP_PORT_HTTP
+      labelEn: HTTP Port
+      labelZh: HTTP 端口
+      label:
+        en: HTTP Port
+        zh: HTTP 端口
+        zh-Hant: HTTP 埠
+        ja: HTTP ポート
+        ko: HTTP 포트
+        ru: HTTP-порт
+        ms: Port HTTP
+        pt-br: Porta HTTP
+      required: true
+      rule: paramPort
+      type: number
+    - default: ./data
+      edit: true
+      envKey: APP_DATA_DIR
+      labelEn: Data Directory
+      labelZh: 数据目录
+      label:
+        en: Data Directory
+        zh: 数据目录
+        zh-Hant: 資料目錄
+        ja: データディレクトリ
+        ko: 데이터 디렉터리
+        ru: Каталог данных
+        ms: Direktori data
+        pt-br: Diretorio de dados
+      required: true
+      type: text
+    - default: generate
+      edit: true
+      envKey: YAMTRACK_SECRET
+      labelEn: Application Secret
+      labelZh: 应用密钥
+      label:
+        en: Application Secret
+        zh: 应用密钥
+        zh-Hant: 應用程式金鑰
+        ja: アプリケーションシークレット
+        ko: 애플리케이션 비밀 키
+        ru: Секрет приложения
+        ms: Rahsia aplikasi
+        pt-br: Segredo do aplicativo
+      required: true
+      type: password
+    - default: UTC
+      edit: true
+      envKey: YAMTRACK_TIMEZONE
+      labelEn: Timezone
+      labelZh: 时区
+      label:
+        en: Timezone
+        zh: 时区
+        zh-Hant: 時區
+        ja: タイムゾーン
+        ko: 시간대
+        ru: Часовой пояс
+        ms: Zon waktu
+        pt-br: Fuso horario
+      required: true
+      type: text
+    - default: "True"
+      edit: true
+      envKey: YAMTRACK_REGISTRATION
+      labelEn: Allow Registration
+      labelZh: 允许用户注册
+      label:
+        en: Allow Registration
+        zh: 允许用户注册
+        zh-Hant: 允許使用者註冊
+        ja: ユーザー登録を許可
+        ko: 사용자 등록 허용
+        ru: Разрешить регистрацию
+        ms: Benarkan pendaftaran
+        pt-br: Permitir cadastro
+      required: true
+      type: select
+      values:
+        - label: "True"
+          value: "True"
+        - label: "False"
+          value: "False"
@@ -0,0 +1 @@
+
@@ -0,0 +1,59 @@
+services:
+  yamtrack:
+    image: "ghcr.io/fuzzygrim/yamtrack:0.25.3@sha256:00acf008bca8171226063bc0f8f08ef7ffe24a10bcebf8676cce335ce312c307"
+    container_name: ${CONTAINER_NAME}
+    restart: unless-stopped
+    depends_on:
+      yamtrack-redis:
+        condition: service_healthy
+    networks:
+      - 1panel-network
+      - yamtrack-internal
+    ports:
+      - "${PANEL_APP_BIND_ADDRESS}:${PANEL_APP_PORT_HTTP}:8000"
+    environment:
+      - TZ=${YAMTRACK_TIMEZONE}
+      - SECRET=${YAMTRACK_SECRET}
+      - REDIS_URL=redis://yamtrack-redis:6379
+      - REGISTRATION=${YAMTRACK_REGISTRATION}
+      - PUID=1000
+      - PGID=1000
+      - SOCIAL_PROVIDERS=
+      - SOCIALACCOUNT_ONLY=False
+    volumes:
+      - "${APP_DATA_DIR}/yamtrack:/yamtrack/db"
+    healthcheck:
+      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://127.0.0.1:8000/health/ || exit 1"]
+      interval: 10s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    security_opt:
+      - no-new-privileges:true
+    labels:
+      createdBy: "Apps"
+
+  yamtrack-redis:
+    image: "redis:8-alpine@sha256:8096655e437712b07503796fb64d81359256cfcff0ab29d95a7da72863786efb"
+    container_name: ${CONTAINER_NAME}-redis
+    restart: unless-stopped
+    networks:
+      - yamtrack-internal
+    volumes:
+      - "${APP_DATA_DIR}/redis:/data"
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 5s
+    security_opt:
+      - no-new-privileges:true
+    labels:
+      createdBy: "Apps"
+
+networks:
+  1panel-network:
+    external: true
+  yamtrack-internal:
+    internal: true
@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+ENV_FILE="${ENV_FILE:-${ROOT_DIR}/.env}"
+
+fail() {
+  printf '%s\n' "$1" >&2
+  exit 1
+}
+
+read_env_value() {
+  local key="$1"
+  local value=""
+  value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
+  case "$value" in
+    \"*\") value="${value#\"}"; value="${value%\"}" ;;
+    \'*\') value="${value#\'}"; value="${value%\'}" ;;
+  esac
+  printf '%s\n' "$value"
+}
+
+set_env_value() {
+  local key="$1"
+  local value="$2"
+  local temp_file
+  temp_file="$(mktemp "${ROOT_DIR}/.yamtrack-env.tmp.XXXXXX")"
+  awk -v key="$key" -v value="$value" '
+    BEGIN { written = 0 }
+    $0 ~ "^" key "=" {
+      if (!written) {
+        print key "=" value
+        written = 1
+      }
+      next
+    }
+    { print }
+    END {
+      if (!written) print key "=" value
+    }
+  ' "$ENV_FILE" > "$temp_file"
+  chmod 600 "$temp_file"
+  mv -f -- "$temp_file" "$ENV_FILE"
+}
+
+[[ -f "$ENV_FILE" ]] || fail "$ENV_FILE not found"
+[[ ! -L "$ENV_FILE" ]] || fail "$ENV_FILE must not be a symbolic link"
+
+data_dir_raw="$(read_env_value APP_DATA_DIR)"
+[[ -n "$data_dir_raw" ]] || data_dir_raw="./data"
+case "$data_dir_raw" in
+  /*) fail "APP_DATA_DIR must be relative to the application version directory" ;;
+  *$'\n'* | *$'\r'* | *\\* | *'$'* | *'#'* | *'"'* | *"'") fail "APP_DATA_DIR contains unsupported characters" ;;
+esac
+
+data_dir_abs="$(realpath -m -- "${ROOT_DIR}/${data_dir_raw#./}")"
+case "$data_dir_abs" in
+  "${ROOT_DIR}"/*) ;;
+  *) fail "APP_DATA_DIR must stay inside the application version directory" ;;
+esac
+[[ "$data_dir_abs" != "/" ]] || fail "APP_DATA_DIR must not be the filesystem root"
+[[ ! -e "$data_dir_abs" || -d "$data_dir_abs" ]] || fail "APP_DATA_DIR must be a directory"
+
+timezone="$(read_env_value YAMTRACK_TIMEZONE)"
+[[ "$timezone" =~ ^[A-Za-z0-9_+/-]+$ ]] || fail "YAMTRACK_TIMEZONE is invalid"
+
+registration="$(read_env_value YAMTRACK_REGISTRATION)"
+[[ "$registration" == "True" || "$registration" == "False" ]] || fail "YAMTRACK_REGISTRATION must be True or False"
+
+secret="$(read_env_value YAMTRACK_SECRET)"
+if [[ -z "$secret" || "$secret" == "generate" ]]; then
+  command -v openssl >/dev/null 2>&1 || fail "openssl is required to generate YAMTRACK_SECRET"
+  secret="$(openssl rand -hex 32)"
+fi
+[[ ${#secret} -ge 50 ]] || fail "YAMTRACK_SECRET must contain at least 50 characters"
+[[ "$secret" =~ ^[A-Za-z0-9._~!@%+=:,/-]+$ ]] || fail "YAMTRACK_SECRET contains unsupported dotenv characters"
+
+install -d -m 0750 -- "$data_dir_abs" "$data_dir_abs/yamtrack" "$data_dir_abs/redis"
+resolved_data_dir="$(realpath -e -- "$data_dir_abs")"
+case "$resolved_data_dir" in
+  "${ROOT_DIR}"/*) ;;
+  *) fail "APP_DATA_DIR resolves outside the application version directory" ;;
+esac
+
+if [[ "$(id -u)" -eq 0 ]]; then
+  chown 1000:1000 "$data_dir_abs/yamtrack"
+  chown 999:1000 "$data_dir_abs/redis"
+else
+  [[ "$(stat -c '%u:%g' "$data_dir_abs/yamtrack")" == "1000:1000" ]] || fail "Yamtrack init must run as root to prepare the data directory"
+  [[ "$(stat -c '%u:%g' "$data_dir_abs/redis")" == "999:1000" ]] || fail "Yamtrack init must run as root to prepare the Redis directory"
+fi
+chmod 750 "$data_dir_abs/yamtrack" "$data_dir_abs/redis"
+set_env_value YAMTRACK_SECRET "$secret"
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+docker-compose down
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+exec "${SCRIPT_DIR}/init.sh"
@@ -0,0 +1,56 @@
+# Yamtrack
+
+## 产品介绍
+
+Yamtrack 是一个自托管媒体追踪器，可在同一界面管理电影、电视、动漫、游戏、书籍、漫画和桌游的观看或游玩进度。
+
+## 主要功能
+
+- 搜索并追踪多种媒体类型、评分、状态和进度
+- 从 Trakt、Simkl、AniList、MyAnimeList 等服务导入记录
+- 支持 Jellyfin、Plex 和 Emby webhook
+- 提供统计、列表、日历和通知功能
+
+## 访问说明
+
+安装后通过 1Panel 反向代理访问 Yamtrack，或在可信局域网场景下修改绑定地址后使用表单中的 HTTP 端口直接访问。首次打开时创建账户；完成后如不需要其他用户注册，请在应用参数中关闭注册。
+
+## 部署说明
+
+- 本应用包使用上游默认的 SQLite + Redis 拓扑。SQLite 数据保存在 `data/yamtrack`，Redis 数据保存在 `data/redis`。
+- 默认端口只绑定到 `127.0.0.1`。请使用 1Panel 反向代理提供 HTTPS 访问；需要直接从局域网访问时再修改绑定地址。
+- 首次安装默认允许注册。创建首个账户后，如不需要其他用户注册，请在应用参数中关闭注册并重建容器。
+- 升级、迁移或卸载前，请备份整个数据目录。卸载脚本不会删除持久化数据。
+
+## 安全说明
+
+- `0.25.3` 镜像中的 PyJWT 版本存在仅影响混合对称/非对称 JWT 验证配置的安全问题。本应用包不启用或暴露社交登录配置，并明确保持 `SOCIAL_PROVIDERS` 为空。不要在此版本中手动启用 OIDC 或其他社交登录；应先升级到包含 PyJWT 2.13.0 或更高版本的上游发行版。
+- Redis 不发布主机端口，只能通过应用内部网络访问。
+- Yamtrack 内部提供 HTTP 服务。对不受信任网络开放时，应由 1Panel 反向代理终止 TLS，并配置访问控制、请求大小和速率限制。
+
+## Introduction
+
+Yamtrack is a self-hosted media tracker for movies, television, anime, games, books, comics, and board games.
+
+## Features
+
+- Track ratings, status, and progress across multiple media types
+- Import history from Trakt, Simkl, AniList, MyAnimeList, and other services
+- Receive Jellyfin, Plex, and Emby webhooks
+- Browse statistics, lists, calendars, and notifications
+
+## Deployment And Security
+
+- This package follows the upstream SQLite and Redis topology. SQLite data is stored under `data/yamtrack`, while Redis data is stored under `data/redis`.
+- The host port binds to `127.0.0.1` by default. Use a 1Panel reverse proxy for HTTPS, or explicitly change the bind address for direct LAN access.
+- Registration is enabled initially so the first account can be created. Disable registration in the app settings afterward unless additional signups are required.
+- Social authentication is deliberately disabled. Do not manually enable `SOCIAL_PROVIDERS` on version `0.25.3`; upgrade to an upstream release containing PyJWT 2.13.0 or newer first.
+- Redis is isolated on an internal network and has no published host port.
+- Back up the complete data directory before upgrades or migrations. Uninstalling the app does not delete persistent data.
+
+## References
+
+- Source: <https://github.com/FuzzyGrim/Yamtrack>
+- Documentation: <https://github.com/FuzzyGrim/Yamtrack/tree/dev/docs>
+- Environment variables: <https://github.com/FuzzyGrim/Yamtrack/blob/dev/docs/env-variables.md>
+- License: <https://github.com/FuzzyGrim/Yamtrack/blob/dev/LICENSE>
@@ -0,0 +1,32 @@
+name: Yamtrack
+tags:
+  - 多媒体
+  - 工具
+title: 自托管的电影、电视、游戏、书籍和漫画追踪器
+description: 自托管的电影、电视、游戏、书籍和漫画追踪器
+additionalProperties:
+  key: yamtrack
+  name: Yamtrack
+  tags:
+    - Media
+    - Tool
+  shortDescZh: 自托管的电影、电视、游戏、书籍和漫画追踪器
+  shortDescEn: A self-hosted tracker for movies, TV, games, books, and comics
+  description:
+    en: A self-hosted media tracker for movies, television, anime, games, books, and comics
+    zh: 用于追踪电影、电视、动漫、游戏、书籍和漫画的自托管媒体应用
+    zh-Hant: 用於追蹤電影、電視、動漫、遊戲、書籍和漫畫的自託管媒體應用
+    ja: 映画、テレビ、アニメ、ゲーム、書籍、コミックを記録するセルフホスト型メディアトラッカー
+    ko: 영화, TV, 애니메이션, 게임, 도서 및 만화를 기록하는 자체 호스팅 미디어 추적기
+    ru: Самостоятельно размещаемый трекер фильмов, сериалов, аниме, игр, книг и комиксов
+    ms: Penjejak media hos kendiri untuk filem, televisyen, anime, permainan, buku dan komik
+    pt-br: Rastreador de midia auto-hospedado para filmes, televisao, anime, jogos, livros e quadrinhos
+  type: website
+  crossVersionUpdate: true
+  limit: 1
+  website: https://github.com/FuzzyGrim/Yamtrack
+  github: https://github.com/FuzzyGrim/Yamtrack
+  document: https://github.com/FuzzyGrim/Yamtrack/tree/dev/docs
+  architectures:
+    - amd64
+    - arm64
@@ -0,0 +1,7 @@
+CONTAINER_NAME=yamtrack
+PANEL_APP_BIND_ADDRESS=127.0.0.1
+PANEL_APP_PORT_HTTP=8000
+APP_DATA_DIR=./data
+YAMTRACK_SECRET=generate
+YAMTRACK_TIMEZONE=UTC
+YAMTRACK_REGISTRATION=True
@@ -0,0 +1,104 @@
+additionalProperties:
+  formFields:
+    - default: 127.0.0.1
+      edit: true
+      envKey: PANEL_APP_BIND_ADDRESS
+      labelEn: Bind Address
+      labelZh: 绑定地址
+      label:
+        en: Bind Address
+        zh: 绑定地址
+        zh-Hant: 綁定位址
+        ja: バインドアドレス
+        ko: 바인드 주소
+        ru: Адрес привязки
+        ms: Alamat ikatan
+        pt-br: Endereco de vinculacao
+      required: true
+      type: text
+    - default: 8000
+      edit: true
+      envKey: PANEL_APP_PORT_HTTP
+      labelEn: HTTP Port
+      labelZh: HTTP 端口
+      label:
+        en: HTTP Port
+        zh: HTTP 端口
+        zh-Hant: HTTP 埠
+        ja: HTTP ポート
+        ko: HTTP 포트
+        ru: HTTP-порт
+        ms: Port HTTP
+        pt-br: Porta HTTP
+      required: true
+      rule: paramPort
+      type: number
+    - default: ./data
+      edit: true
+      envKey: APP_DATA_DIR
+      labelEn: Data Directory
+      labelZh: 数据目录
+      label:
+        en: Data Directory
+        zh: 数据目录
+        zh-Hant: 資料目錄
+        ja: データディレクトリ
+        ko: 데이터 디렉터리
+        ru: Каталог данных
+        ms: Direktori data
+        pt-br: Diretorio de dados
+      required: true
+      type: text
+    - default: generate
+      edit: true
+      envKey: YAMTRACK_SECRET
+      labelEn: Application Secret
+      labelZh: 应用密钥
+      label:
+        en: Application Secret
+        zh: 应用密钥
+        zh-Hant: 應用程式金鑰
+        ja: アプリケーションシークレット
+        ko: 애플리케이션 비밀 키
+        ru: Секрет приложения
+        ms: Rahsia aplikasi
+        pt-br: Segredo do aplicativo
+      required: true
+      type: password
+    - default: UTC
+      edit: true
+      envKey: YAMTRACK_TIMEZONE
+      labelEn: Timezone
+      labelZh: 时区
+      label:
+        en: Timezone
+        zh: 时区
+        zh-Hant: 時區
+        ja: タイムゾーン
+        ko: 시간대
+        ru: Часовой пояс
+        ms: Zon waktu
+        pt-br: Fuso horario
+      required: true
+      type: text
+    - default: "True"
+      edit: true
+      envKey: YAMTRACK_REGISTRATION
+      labelEn: Allow Registration
+      labelZh: 允许用户注册
+      label:
+        en: Allow Registration
+        zh: 允许用户注册
+        zh-Hant: 允許使用者註冊
+        ja: ユーザー登録を許可
+        ko: 사용자 등록 허용
+        ru: Разрешить регистрацию
+        ms: Benarkan pendaftaran
+        pt-br: Permitir cadastro
+      required: true
+      type: select
+      values:
+        - label: "True"
+          value: "True"
+        - label: "False"
+          value: "False"
@@ -0,0 +1 @@
+
@@ -0,0 +1,59 @@
+services:
+  yamtrack:
+    image: "ghcr.io/fuzzygrim/yamtrack:latest@sha256:00acf008bca8171226063bc0f8f08ef7ffe24a10bcebf8676cce335ce312c307"
+    container_name: ${CONTAINER_NAME}
+    restart: unless-stopped
+    depends_on:
+      yamtrack-redis:
+        condition: service_healthy
+    networks:
+      - 1panel-network
+      - yamtrack-internal
+    ports:
+      - "${PANEL_APP_BIND_ADDRESS}:${PANEL_APP_PORT_HTTP}:8000"
+    environment:
+      - TZ=${YAMTRACK_TIMEZONE}
+      - SECRET=${YAMTRACK_SECRET}
+      - REDIS_URL=redis://yamtrack-redis:6379
+      - REGISTRATION=${YAMTRACK_REGISTRATION}
+      - PUID=1000
+      - PGID=1000
+      - SOCIAL_PROVIDERS=
+      - SOCIALACCOUNT_ONLY=False
+    volumes:
+      - "${APP_DATA_DIR}/yamtrack:/yamtrack/db"
+    healthcheck:
+      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://127.0.0.1:8000/health/ || exit 1"]
+      interval: 10s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    security_opt:
+      - no-new-privileges:true
+    labels:
+      createdBy: "Apps"
+
+  yamtrack-redis:
+    image: "redis:8-alpine@sha256:8096655e437712b07503796fb64d81359256cfcff0ab29d95a7da72863786efb"
+    container_name: ${CONTAINER_NAME}-redis
+    restart: unless-stopped
+    networks:
+      - yamtrack-internal
+    volumes:
+      - "${APP_DATA_DIR}/redis:/data"
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 5s
+    security_opt:
+      - no-new-privileges:true
+    labels:
+      createdBy: "Apps"
+
+networks:
+  1panel-network:
+    external: true
+  yamtrack-internal:
+    internal: true
@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+ENV_FILE="${ENV_FILE:-${ROOT_DIR}/.env}"
+
+fail() {
+  printf '%s\n' "$1" >&2
+  exit 1
+}
+
+read_env_value() {
+  local key="$1"
+  local value=""
+  value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
+  case "$value" in
+    \"*\") value="${value#\"}"; value="${value%\"}" ;;
+    \'*\') value="${value#\'}"; value="${value%\'}" ;;
+  esac
+  printf '%s\n' "$value"
+}
+
+set_env_value() {
+  local key="$1"
+  local value="$2"
+  local temp_file
+  temp_file="$(mktemp "${ROOT_DIR}/.yamtrack-env.tmp.XXXXXX")"
+  awk -v key="$key" -v value="$value" '
+    BEGIN { written = 0 }
+    $0 ~ "^" key "=" {
+      if (!written) {
+        print key "=" value
+        written = 1
+      }
+      next
+    }
+    { print }
+    END {
+      if (!written) print key "=" value
+    }
+  ' "$ENV_FILE" > "$temp_file"
+  chmod 600 "$temp_file"
+  mv -f -- "$temp_file" "$ENV_FILE"
+}
+
+[[ -f "$ENV_FILE" ]] || fail "$ENV_FILE not found"
+[[ ! -L "$ENV_FILE" ]] || fail "$ENV_FILE must not be a symbolic link"
+
+data_dir_raw="$(read_env_value APP_DATA_DIR)"
+[[ -n "$data_dir_raw" ]] || data_dir_raw="./data"
+case "$data_dir_raw" in
+  /*) fail "APP_DATA_DIR must be relative to the application version directory" ;;
+  *$'\n'* | *$'\r'* | *\\* | *'$'* | *'#'* | *'"'* | *"'") fail "APP_DATA_DIR contains unsupported characters" ;;
+esac
+
+data_dir_abs="$(realpath -m -- "${ROOT_DIR}/${data_dir_raw#./}")"
+case "$data_dir_abs" in
+  "${ROOT_DIR}"/*) ;;
+  *) fail "APP_DATA_DIR must stay inside the application version directory" ;;
+esac
+[[ "$data_dir_abs" != "/" ]] || fail "APP_DATA_DIR must not be the filesystem root"
+[[ ! -e "$data_dir_abs" || -d "$data_dir_abs" ]] || fail "APP_DATA_DIR must be a directory"
+
+timezone="$(read_env_value YAMTRACK_TIMEZONE)"
+[[ "$timezone" =~ ^[A-Za-z0-9_+/-]+$ ]] || fail "YAMTRACK_TIMEZONE is invalid"
+
+registration="$(read_env_value YAMTRACK_REGISTRATION)"
+[[ "$registration" == "True" || "$registration" == "False" ]] || fail "YAMTRACK_REGISTRATION must be True or False"
+
+secret="$(read_env_value YAMTRACK_SECRET)"
+if [[ -z "$secret" || "$secret" == "generate" ]]; then
+  command -v openssl >/dev/null 2>&1 || fail "openssl is required to generate YAMTRACK_SECRET"
+  secret="$(openssl rand -hex 32)"
+fi
+[[ ${#secret} -ge 50 ]] || fail "YAMTRACK_SECRET must contain at least 50 characters"
+[[ "$secret" =~ ^[A-Za-z0-9._~!@%+=:,/-]+$ ]] || fail "YAMTRACK_SECRET contains unsupported dotenv characters"
+
+install -d -m 0750 -- "$data_dir_abs" "$data_dir_abs/yamtrack" "$data_dir_abs/redis"
+resolved_data_dir="$(realpath -e -- "$data_dir_abs")"
+case "$resolved_data_dir" in
+  "${ROOT_DIR}"/*) ;;
+  *) fail "APP_DATA_DIR resolves outside the application version directory" ;;
+esac
+
+if [[ "$(id -u)" -eq 0 ]]; then
+  chown 1000:1000 "$data_dir_abs/yamtrack"
+  chown 999:1000 "$data_dir_abs/redis"
+else
+  [[ "$(stat -c '%u:%g' "$data_dir_abs/yamtrack")" == "1000:1000" ]] || fail "Yamtrack init must run as root to prepare the data directory"
+  [[ "$(stat -c '%u:%g' "$data_dir_abs/redis")" == "999:1000" ]] || fail "Yamtrack init must run as root to prepare the Redis directory"
+fi
+chmod 750 "$data_dir_abs/yamtrack" "$data_dir_abs/redis"
+set_env_value YAMTRACK_SECRET "$secret"
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+docker-compose down
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+exec "${SCRIPT_DIR}/init.sh"