@ChillBill77 please fix: https://github.com/tailscale-dev/ScaleTail/actions/runs/34833207857/job/103941113867?pr=321

Hi @ChillBill77, thanks for the SOCFortress WAF stack and for documenting why it deviates from the template. Here is a concrete list of what's needed before we can merge. Please use CONTRIBUTING.md and the service template as the reference. I did not run this stack locally: it binds host ports 80/443 and needs a MaxMind GeoIP file, and the branch has to be split first (point 1).

1. Split the PR

This branch contains all Homebridge commits from #319, because both PRs come from your fork's main. Please create a new branch from the latest upstream main with only the WAF changes (services/socfortress-waf/ and its root README row). Merging main also clears the root README lint errors (broken anchors, double blank line), which come from the old base.

2. Make the README match the files

The README describes a different setup than the PR contains:

• It says to drop four files into a cloned waf-platform checkout.
• It refers to compose.tailscale.yml and an include of the upstream docker-compose.yml.
• It contains cp .env .env.

The PR's compose.yml is a self-contained stack, so please rewrite the steps for that. Also fix the lint errors that fail CI:

• MD031: blank lines around code blocks. rumdl fmt --config .markdownlint.yml <file> fixes these.
• MD051: the anchor #linting--validation has no matching heading.

3. Working default configuration

• TS_HOSTNAME=socfortressWAF and ALLOWED_ORIGINS=https://waf-admin.<your-tailnet>.ts.net use different names, so login fails with the defaults (CORS). Please use one lowercase name for both.
• ./GeoLite2-City.mmdb must exist before the first start. Otherwise Docker creates a directory with that name and admin-api cannot read it. Please say this in the setup steps.

4. Template conventions

The network design (Tailscale as a peer on waf-internal instead of network_mode: service:tailscale) is an exception we can accept if it's needed. Please explain it in a short "Differences from the template" section in the README. Everything else should follow the template:

• Rename compose.yml to compose.yaml.
• Use SERVICE instead of TS_HOSTNAME and set hostname: ${SERVICE}.
• Name containers tailscale-${SERVICE} and app-${SERVICE}-<part> (for example app-${SERVICE}-postgres). The generic names postgres, redis, admin-api, and caddy-waf collide with other stacks on the same host.
• Keep the template's Tailscale health check: TS_ENABLE_HEALTH_CHECK=true, TS_LOCAL_ADDR_PORT=127.0.0.1:41234, and the wget ... /healthz test. Also keep TS_AUTH_ONCE=true.
• PostgreSQL health check: use TCP, pg_isready -h 127.0.0.1 ... (CONTRIBUTING step 5).
• .env:
  • start from the template's .env, with the #version/#URL header, the TZ line, and the comment style
  • leave TS_AUTHKEY= and the passwords empty instead of tskey-auth-XXXX/CHANGE_ME placeholders
  • add a final newline
• Optional: use bind mounts under ./${SERVICE}-data/ like the other services, so the data is easy to back up.

5. Verification

After the update, please add to the PR description what you checked: container status, the admin UI login through https://<name>.<tailnet>.ts.net, and a request through the WAF.

Thanks! Happy to review again once the branch is split.