Tandoor

Self-hosted recipe manager. Stores and organizes recipes with ingredients, nutrition info, and meal planning.

Where it runs

• Host: Nexus (192.168.1.226)
• UI: http://192.168.1.226:8900
• Managed by: Komodo (Stack tandoor)
• Compose file: tandoor/docker-compose.yml in homelab-docker repo

Docker

Docker on Nexus is installed via snap. Always use docker compose (with a space).

Three containers make up the stack:

Container	Image	Role
web_recipes	vabene1111/recipes:2.6.9	App server
db_recipes	postgres:18.4-alpine	Database
nginx_recipes	nginx:1.31.0-alpine	Reverse proxy (port 8900)

Nginx is configured via tandoor/nginx-recipes.conf, tracked in the repo and bind-mounted read-only into the container.

Data volumes

Path on Nexus	Purpose
/mnt/server/containers/tandoor/postgresql	Postgres data
/mnt/server/containers/tandoor/mediafiles	Uploaded recipe images
staticfiles (named volume)	Django static assets

Secrets

The runtime .env lives only on Nexus at:

/home/matt/repos/homelab-docker/tandoor/.env

It is gitignored and read directly by docker compose up -d. It is not committed to git in any form.

Warning: There is no .env.enc encrypted backup for Tandoor yet — tracked in Forgejo issue #40. If Nexus needs to be rebuilt from scratch, Tandoor secrets would need to be re-created manually. Consider creating a SOPS-encrypted backup as described in the homelab-docker README.

Renovate

Renovate tracks all three images and will open PRs when newer tags are available:

• vabene1111/recipes — Tandoor app
• postgres — database
• nginx — reverse proxy

Before merging any Renovate PR for this stack:

• Postgres major version bump (e.g. 17 → 18): requires a manual database migration. Take a full backup of /mnt/server/containers/tandoor/postgresql before merging. Do not let Docker pull the new image and restart — Postgres will refuse to start against a data directory from a different major version.
• Tandoor major version bump: back up recipe data (media files + DB) before merging, as schema migrations may not be reversible.

Manual pre-upgrade backup:

ssh matt@192.168.1.226
tar czf /mnt/server/containers/backups/tandoor-pre-upgrade-$(date +%Y%m%d).tar.gz \
  /mnt/server/containers/tandoor

Troubleshooting

# Tandoor app logs
ssh matt@192.168.1.226 'docker logs tandoor_recipes_1 --tail 50'

# Postgres logs
ssh matt@192.168.1.226 'docker logs tandoor_db_recipes_1 --tail 50'

# Nginx logs
ssh matt@192.168.1.226 'docker logs tandoor_nginx_recipes_1 --tail 50'

# Manual redeploy
ssh matt@192.168.1.226 'cd /home/matt/repos/homelab-docker/tandoor && docker compose up -d'

# Check what image tags are actually running
ssh matt@192.168.1.226 'docker ps --format "table {{.Image}}\t{{.Names}}" | grep recipes'

.env file missing or corrupted

Tandoor has no .env.enc backup yet. Options:

1. Restore from PBS — the Nexus filesystem is backed up by Proxmox Backup Server (192.168.1.223). PBS backs up the full Nexus machine; the .env file would be recoverable from there.
2. Re-create the secrets manually and reset any credentials inside the app.

This is the main reason issue #40 exists — creating a tandoor/.env.enc would eliminate this risk.

Service broken after image update — rollback

# Edit the compose file on Nexus to restore the previous tag, then redeploy
ssh matt@192.168.1.226
vi /home/matt/repos/homelab-docker/tandoor/docker-compose.yml
docker compose -f /home/matt/repos/homelab-docker/tandoor/docker-compose.yml up -d

# Or revert the merge commit in Forgejo — Komodo redeploys on next push to main