Add Didacta template

[va360labs]

Adds Didacta — a fair-code, self-hosted LMS: course authoring, a public catalog with checkout, enrollment and invitation flows, gamification, certificates, reporting and a module marketplace. Tenants are isolated at the database level with PostgreSQL RLS.

Three services: the app, a Postgres and a Redis.

Why Postgres pins an image. pgvector/pgvector:pg16 is not a preference: the baseline migration runs CREATE EXTENSION "vector", so the default postgres:17 fails on first boot with no obvious clue.

One domain is enough. The container runs the API on :4000 and the web on :3000, and Next.js rewrites /api/*, /healthz and /readyz to the internal API — so domains only targets port 3000, and there is no CORS or cookie-domain setup to do.

First-run link. DIDACTA_SETUP_TOKEN is generated with randomString(32). It protects the creation of the first admin account while the instance is still empty, and generating it here means the user opens https://<domain>/setup?token=<DIDACTA_SETUP_TOKEN> (it's in the Environment tab) instead of digging it out of the container logs. That's what instructions in meta.yaml explains.

TENANT_SETTINGS_ENC_KEY is deliberately left unset: the app generates a 32-byte hex key on first boot and persists it in the data volume. Setting it from the template with a generator that does not produce exactly 64 hex characters would break secret encryption (SSO, per-tenant SMTP, Stripe) silently.

Links: didacta.io · docs · source · image ghcr.io/va360labs/didacta-community (public, no login required).

Checklist

• Logo is the icon-only square mark, 128×128 PNG.
• Screenshot shows real content (the course editor of a running instance), not an empty state.
• The image is pinned to a specific version from the official registry.
• No unused variables and no hardcoded secrets: every secret comes from randomString.
• The generated output validates against templateSchema from utils/schema.ts.

Testing

The stack behind this template was brought up end to end (same image, same topology, same environment variables):

• First boot applied migrations, enabled pgvector, applied the RLS policies and the role grants, and derived the runtime connection to the non-superuser role — which is what makes tenant isolation real.
• GET /healthz and GET /api/v1/setup/status answered through port 3000, confirming one domain covers both the web app and the API.
• Creating the first tenant and admin account through the setup token succeeded; the public catalog and sign-in pages rendered.
• The same topology was also deployed on a proxy-fronted PaaS over a real domain, where the /setup?token=… link worked as described in instructions.

Screenshot

[netlify]

✅ Deploy Preview for easypanel-templates ready!

Name	Link
🔨 Latest commit	fa968ea
🔍 Latest deploy log	https://app.netlify.com/projects/easypanel-templates/deploys/6a7c8198d6e34300086cbfcc
😎 Deploy Preview	https://deploy-preview-1520--easypanel-templates.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.