chore(plane): update template to v1.3.1 with healthchecks and bug fixes

[leogomide]

What is this PR about?

Update the Plane template from v0.27.1 to v1.3.1 (latest stable), refactor the compose file for reliability, and fix several bugs in the current template.toml.

Image bumps

• makeplane/plane-frontend, plane-space, plane-admin, plane-live, plane-backend, plane-proxy: v0.27.1 → v1.3.1
• valkey/valkey: 7.2.5-alpine → 7.2.11-alpine
• minio/minio: latest → RELEASE.2025-04-22T22-12-26Z (pinned to the last release before MinIO removed the admin console from the community edition)
• postgres, rabbitmq: kept (17-alpine, 3.13.6-management-alpine) to avoid breaking existing deployments

docker-compose.yml improvements

• Add YAML anchors (x-db-env, x-redis-env, x-app-env, ...) and <<: [*anchor] merges to eliminate duplicated env across api/worker/beat-worker/migrator/live
• Migrate from env_file: [.env] to inline environment: (matches the repo convention; Dokploy injects env via template.toml)
• Add restart: unless-stopped to every long-running service; restart: on-failure on migrator
• Add healthcheck to plane-db, plane-redis, plane-mq
• api/worker/beat-worker now wait for migrator via condition: service_completed_successfully — fixes a race where the backend booted before the Django schema was migrated
• proxy uses expose: ["80"] (no host port mapping, per the validator rule)

template.toml improvements (bug fixes)

• RABBITMQ_DEFAULT_USER was the literal string "rabbitmq_user" instead of a variable reference, so the broker user ended up as rabbitmq_user while AMQP_URL expected something else. Now fixed to plane consistently.
• WEB_URL=${Domain} was missing the https:// scheme, which broke OAuth callback URLs and email links emitted by the backend. Now WEB_URL=https://${main_domain}.
• DATABASE_URL/AMQP_URL referenced inline vars (${POSTGRES_USER}, ${MINIO_ROOT_USER}) that Dokploy does not resolve inside [config.env] — only [variables] references and helpers work. Now built directly from [variables].
• Remove dead vars: NGINX_PORT (Plane uses Caddy in v1.x), SENTRY_DSN, SENTRY_ENVIRONMENT.
• Add WEBHOOK_ALLOWED_IPS="" and WEBHOOK_ALLOWED_HOSTS="" — Plane v1.x ships an SSRF guard for webhooks that blocks private IPs by default; exposing these as empty strings makes the intended posture explicit and discoverable.
• Add APP_RELEASE to [variables] so users can pick the image tag via the Dokploy UI without editing env directly.

Logo

• blueprints/plane/plane.png updated to the current Plane brand logo.

Checklist

• I have read the suggestions in the README.md / CONTRIBUTING.md
• I have validated the template locally (docker compose config, validate-docker-compose.ts, validate-template.ts all pass with zero errors)
• meta.json processed with node build-scripts/process-meta.js (only the version bump appears in the diff)

Issues related

N/A — proactive maintenance update.

Testing notes

Validated locally with the repo's own scripts:

• docker compose -f blueprints/plane/docker-compose.yml config → exit 0
• tsx build-scripts/validate-docker-compose.ts → 13 services detected, structure valid
• tsx build-scripts/validate-template.ts → 7 variables processed, structure valid

A full end-to-end smoke test (admin signup, project + issue + MinIO upload, live WebSocket "users online") can be run from the auto-generated PR preview.

[github-actions]

built with Refined Cloudflare Pages Action

⚡ Cloudflare Pages Deployment

Name	Status	Preview	Last Commit
templates	✅ Ready (View Log)	Visit Preview	11bc16e

[leogomide]

Pushed a fix for a DNS collision bug in the internal proxy (commits 9c29df4 + 11bc16e).

Problem: the makeplane/plane-proxy image has reverse_proxy web:3000/api:8000 hardcoded in its Caddyfile. In multi-stack Dokploy deployments, those generic names collide with other stacks' containers on the shared dokploy-network (Next.js apps frequently have a web service) — the Plane domain ends up serving content from unrelated stacks.

Fix (two layers):

1. Renamed the 8 internal services with a plane-* prefix (unique cluster-wide): web→plane-web, space→plane-space, admin→plane-admin, live→plane-live, api→plane-api, worker→plane-worker, beat-worker→plane-beat-worker, migrator→plane-migrator. Updated all depends_on cascades and the API_BASE_URL in template.toml + the x-live-env anchor to point at plane-api.
2. Added a links: block on the proxy service mapping the new names back to the generic ones the Caddyfile expects (plane-web:web, plane-api:api, etc.). Docker injects these into /etc/hosts, which takes absolute priority over DNS — Caddy resolves web/api/etc. straight to our renamed containers, ignoring any collision.

No networks: declarations added — the repo validator (build-scripts/validate-docker-compose.ts:116-163) explicitly rejects them, and Dokploy manages networking automatically. The /etc/hosts approach solves the collision without needing network isolation.

Local validation (all 0 errors):

• docker compose -f blueprints/plane/docker-compose.yml config → exit 0
• tsx build-scripts/validate-docker-compose.ts -f blueprints/plane/docker-compose.yml → 13 services, valid
• tsx build-scripts/validate-template.ts -d blueprints/plane → 7 vars, 1 domain, valid