Skip to main content
StackKits never locks you into a single tool. For each capability there is a smart default (what you get if you change nothing) and alternatives you can select in stack-spec.yaml. Defaults are resolved from your context (local vs cloud), compute tier, and domain — you can always override them.
This page is the canonical, implementation-backed catalog. The Base Kit ships the platform services below; add-ons layer optional capabilities on top of any kit.

​
Platform services (Base Kit)

These run in every Base Kit deployment, selected by the resolver per context and compute tier.
CapabilitySmart defaultAlternatives you can select
Reverse proxy & TLSTraefik v3— (standard edge for all kits)
App platform (PaaS)CoolifyDokploy, Komodo
Container / compose UIPortainer (high tier)Dockge
Forward-auth gatewayTinyAuthAuthelia (via authelia add-on)
Identity / SSO (OIDC)PocketID—
Internal PKIstep-ca—
Uptime monitoringUptime Kuma—
Server metricsNetdataBeszel, Glances (low tier)
Log viewerDozzle—
Full metrics stackPrometheus + Grafana (high tier)monitoring add-on (VictoriaMetrics + Grafana + Loki + Alloy)
Password managerVaultwarden—
Media serverJellyfin—
PhotosImmich—
The app platform is context-resolved — the Base Kit release default does not hard-pin Dokploy or Coolify. On standard and low tiers the resolver enables Coolify; switch with an explicit override in your spec.
stack-spec.yaml
stackkit: base-kit

# Override a smart default — e.g. use Dokploy instead of Coolify
services:
  platform:
    provider: dokploy   # coolify | dokploy | komodo

​
Add-ons (optional capabilities)

Add-ons are composable modules you stack on any kit. Each declares its compatible StackKits and is enabled in the addons: list.
CapabilityAdd-onWhat it deploys
ObservabilitymonitoringVictoriaMetrics + Grafana + Loki + Alloy
BackupbackupKopia encrypted backups, DB hooks, 3-2-1 targets
Backup fan-inbackup-repo-serverKopia Repository Server (multi-host / multi-tenant)
MediamediaJellyfin + *arr stack
PhotosphotosImmich photo & video management
Password vaultvaultVaultwarden (Bitwarden-compatible)
Smart homesmart-homeHome Assistant + MQTT + Zigbee2MQTT
AI / LLMai-workloadsOllama + Open WebUI (local inference)
Dev platformdev-platformGitea + Woodpecker CI
Calendar / CardDAVcalendarRadicale + Bloben web UI
MailmailStalwart all-in-one (IMAP/JMAP/SMTP + CalDAV)
File sharingfile-sharingSelf-hosted file sharing and sync
Remote desktopremote-desktopApache Guacamole (browser-based)
Game servergameserverSelf-hosted game server
Advanced authautheliaAdvanced auth server (replaces TinyAuth)
Mesh VPNvpn-overlayMesh VPN overlay
External accesstunnelBypass CGNAT/DS-Lite to expose local services
High availabilityhaLoad balancing, VIP failover, database HA
stack-spec.yaml
stackkit: base-kit

addons:
  - monitoring       # full observability stack
  - backup           # encrypted 3-2-1 backups
  - media            # Jellyfin + *arr

​
How defaults are chosen

The resolver picks each tool from three inputs, in order of precedence:
1

Explicit override

Anything you set in stack-spec.yaml wins.
2

Context (local / cloud / pi)

Cloud contexts favor public-DNS + Let’s Encrypt defaults; pi / low-resource contexts drop heavier services (e.g. Glances instead of Netdata, no Prometheus).
3

Compute tier (low / standard / high)

Higher tiers enable more by default — e.g. Portainer, Prometheus, and Grafana are added on the high tier.

Choosing a kit

Pick the right architecture pattern first.

Spec format

Full stack-spec.yaml reference.