feat: add Atuin shell history synchronization service

- Add Atuin v18.10.0 service with PostgreSQL 14 database backend - Configure Atuin server on port 4018 with open registration for demo - Add PostgreSQL database service with proper health checks - Update demo-stack.sh status display to include Atuin URL - Update README.md service table with Atuin entry - Add Atuin configuration variables to demo.env - Use TCP socket health check for Atuin (no curl available in container) - Atuin server accessible and responding with version info - All services including Atuin now operational and healthy
fix: resolve health check issues and update service configurations
2025-11-14 01:07:16 -05:00 · 2025-11-14 00:49:39 -05:00 · 2025-11-14 00:14:58 -05:00 · 2025-11-13 18:41:40 -05:00 · 2025-11-13 17:35:34 -05:00
12 changed files with 3849 additions and 0 deletions
--- a/SupportStack/demo/AGENTS.md
+++ b/SupportStack/demo/AGENTS.md
@@ -0,0 +1,351 @@
+# TSYS Developer Support Stack - Development Guidelines
+
+## 🎯 Development Principles
+
+### Demo-First Architecture
+- **Demo-Only Configuration**: All services configured for demonstration purposes only
+- **No Persistent Data**: Zero data persistence between demo sessions
+- **Dynamic User Handling**: Automatic UID/GID detection and application
+- **Security-First**: Docker socket proxy for all container operations
+- **Minimal Bind Mounts**: Prefer Docker volumes over host bind mounts
+- **Consistent Naming**: `tsysdevstack-supportstack-demo-` prefix everywhere
+- **One-Command Deployment**: Single script deployment with full validation
+
+### Dynamic Environment Strategy
+- **User Detection**: Automatic current user and group ID detection
+- **Docker Group Handling**: Dynamic docker group ID resolution
+- **Variable-Driven Configuration**: All settings via environment variables
+- **Template-Based Compose**: Generate docker-compose.yml from templates
+- **Environment Isolation**: Separate demo.env for all configuration
+
+### FOSS Only Policy
+- Exclusively use free/libre/open source software
+- Verify license compatibility
+- Prefer official Docker images
+- Document any proprietary dependencies
+
+### Inner Loop Focus
+- Support daily development workflows
+- Avoid project-specific dependencies
+- Prioritize developer productivity
+- Maintain workstation-local deployment
+
+### System Interference Policy
+- **NEVER interfere with existing processes**: Do not kill, stop, or modify any running processes without explicit permission
+- **Check before acting**: Always verify what processes/screen sessions are running before taking any action
+- **Use unique identifiers**: Create uniquely named sessions/processes to avoid conflicts
+- **Ask first**: Always request permission before touching any existing work on the system
+- **Respect concurrent work**: Other users/processes may be running - do not assume exclusive access
+
+---
+
+## 🏗️ Architecture Guidelines
+
+### Service Categories
+- **Infrastructure Services**: Core platform services
+- **Monitoring & Observability**: Metrics and visualization
+- **Documentation & Diagramming**: Knowledge management
+- **Developer Tools**: Productivity enhancers
+
+### Design Patterns
+- **Service Discovery**: Automatic via Homepage dashboard
+- **Health Checks**: Comprehensive for all services
+- **Network Isolation**: Docker network per stack
+- **Resource Limits**: Memory and CPU constraints
+
+---
+
+## 🔧 Technical Standards
+
+### Docker Configuration Standards
+
+#### Demo Service Template
+```yaml
+# Standard service template (docker-compose.yml.template)
+services:
+  service-name:
+    image: official/image:tag
+    user: "${UID}:${GID}"
+    container_name: "${COMPOSE_PROJECT_NAME}-service-name"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    volumes:
+      - "${COMPOSE_PROJECT_NAME}_service_data:/path"
+    environment:
+      - PUID=${UID}
+      - PGID=${GID}
+    labels:
+      homepage.group: "Group Name"
+      homepage.name: "Display Name"
+      homepage.icon: "icon-name"
+      homepage.href: "http://localhost:${SERVICE_PORT}"
+      homepage.description: "Brief description"
+```
+
+#### Dynamic Variable Requirements
+- **UID/GID**: Current user and group detection
+- **DOCKER_GID**: Docker group ID for socket access
+- **COMPOSE_PROJECT_NAME**: `tsysdevstack-supportstack-demo`
+- **COMPOSE_NETWORK_NAME**: `tsysdevstack-supportstack-demo-network`
+- **Service Ports**: All configurable via environment variables
+
+### Port Assignment Strategy
+- Range: 4000-4099
+- Groups: Sequential allocation
+- Document in README.md port table
+- Avoid conflicts with host services
+
+### Network Configuration
+- Network name: `tsysdevstack_supportstack`
+- IP binding: `192.168.3.6:{port}` where applicable
+- Inter-service communication via container names
+- Only necessary ports exposed to host
+
+---
+
+## 📋 Quality Assurance
+
+### Testing Requirements
+- Automated health check validation
+- Port accessibility verification
+- Service discovery functionality
+- Resource usage monitoring
+- User workflow validation
+
+### Code Quality Standards
+- Clear, commented configurations
+- Consistent naming conventions
+- Comprehensive documentation
+- Atomic commits with conventional messages
+
+### Security Guidelines
+
+#### Demo Security Model
+- **Demo-Hardened Configurations**: All settings optimized for demonstration
+- **No External Network Access**: Isolated except for image pulls
+- **Production Separation**: Clear distinction from production deployments
+- **Security Documentation**: All assumptions clearly documented
+
+#### Docker Socket Security
+- **Mandatory Proxy**: All container operations through docker-socket-proxy
+- **Restricted API Access**: Minimal permissions per service requirements
+- **No Direct Socket Access**: Prevent direct Docker socket mounting
+- **Group-Based Access**: Dynamic docker group ID assignment
+
+#### File System Security
+- **Dynamic User Mapping**: Automatic UID/GID detection prevents ownership issues
+- **Volume-First Storage**: Prefer Docker volumes over bind mounts
+- **Read-Only Bind Mounts**: Minimal host filesystem access
+- **Permission Validation**: Automated file ownership verification
+
+---
+
+## 🔄 Development Workflow
+
+### Demo-First Service Addition
+1. **Research**: Verify FOSS status and official Docker image availability
+2. **Plan**: Determine port assignment and service group
+3. **Template Configuration**: Add to docker-compose.yml.template with variables
+4. **Environment Setup**: Add service variables to demo.env
+5. **Security Integration**: Configure docker-socket-proxy permissions
+6. **Dynamic Testing**: Validate with demo-stack.sh and demo-test.sh
+7. **Documentation Update**: Update README.md, PRD.md, and AGENTS.md
+8. **Atomic Commit**: Conventional commit with detailed description
+
+### Process Management Guidelines
+- **Screen Sessions**: Use descriptive, unique names (e.g., `demo-deploy-YYYYMMDD-HHMMSS`)
+- **Background Processes**: Always use logging to track progress
+- **Process Discovery**: Use `ps aux | grep` and `screen -ls` to check existing work
+- **Safe Termination**: Only terminate processes you explicitly started
+- **Permission First**: Always ask before modifying/killing any existing process
+
+### Template-Driven Development
+- **Variable Configuration**: All settings via environment variables
+- **Naming Convention**: Consistent `tsysdevstack-supportstack-demo-` prefix
+- **User Handling**: Dynamic UID/GID detection in all services
+- **Security Integration**: Docker socket proxy for container operations
+- **Volume Strategy**: Docker volumes with dynamic naming
+
+### Service Removal Process
+1. **Deprecate**: Mark service for removal in documentation
+2. **Test**: Verify stack functionality without service
+3. **Remove**: Delete from docker-compose.yml
+4. **Update**: Clean up documentation and port assignments
+5. **Commit**: Document removal in commit message
+
+### Configuration Changes
+1. **Plan**: Document change rationale and impact
+2. **Test**: Validate in development environment
+3. **Update**: Apply changes to configuration files
+4. **Verify**: Run full test suite
+5. **Document**: Update relevant documentation
+6. **Commit**: Atomic commit with detailed description
+
+---
+
+## 📊 Monitoring & Observability
+
+### Health Check Standards
+- All services must include health checks
+- Health checks complete within 10 seconds
+- HTTP endpoints preferred
+- Fallback to container status checks
+
+### Resource Limits
+- Memory: < 512MB per service (where applicable)
+- CPU: < 25% per service (idle)
+- Startup time: < 60 seconds for full stack
+- Disk usage: Temporary volumes only
+
+### Logging Standards
+- Structured logging where possible
+- Log levels: INFO, WARN, ERROR
+- Container logs accessible via `docker compose logs`
+- No persistent log storage in demo mode
+
+---
+
+## 🧪 Testing Guidelines
+
+### Demo Testing Framework
+```bash
+# ALWAYS check for existing work first
+screen -ls
+ps aux | grep demo-stack
+
+# Dynamic deployment and testing (use unique session names)
+screen -S demo-deploy-$(date +%Y%m%d-%H%M%S) -dm -L -Logfile deploy-$(date +%Y%m%d-%H%M%S).log ./demo-stack.sh deploy
+./demo-test.sh full       # Comprehensive QA/validation
+./demo-test.sh security    # Security compliance validation
+./demo-test.sh permissions # File ownership validation
+./demo-test.sh network     # Network isolation validation
+```
+
+### Automated Validation Suite
+- **File Ownership**: Verify no root-owned files on host
+- **User Mapping**: Validate UID/GID detection and application
+- **Docker Group**: Confirm docker group access for socket proxy
+- **Service Health**: All services passing health checks
+- **Port Accessibility**: Verify all ports accessible from host
+- **Network Isolation**: Confirm services isolated in demo network
+- **Volume Permissions**: Validate Docker volume permissions
+- **Security Compliance**: Docker socket proxy restrictions enforced
+
+### Manual Testing Checklist
+- [ ] All web interfaces accessible via browser
+- [ ] Demo credentials work correctly
+- [ ] Service discovery functional in Homepage
+- [ ] Inter-service communication working through proxy
+- [ ] Resource usage within defined limits
+- [ ] No port conflicts on host system
+- [ ] All health checks passing
+- [ ] No root-owned files created on host
+- [ ] Docker socket proxy functioning correctly
+- [ ] Dynamic user detection working properly
+
+### Performance Testing
+- Startup time measurement
+- Memory usage monitoring
+- CPU usage validation
+- Network connectivity testing
+- Resource leak detection
+
+---
+
+## 📚 Documentation Standards
+
+### README.md Requirements
+- Quick start instructions
+- Service overview table
+- Technical configuration details
+- Troubleshooting guide
+- Security notes and warnings
+
+### PRD.md Requirements
+- Product vision and goals
+- Functional requirements
+- User experience requirements
+- Acceptance criteria
+- Success metrics
+
+### AGENTS.md Requirements
+- Development principles
+- Technical standards
+- Quality assurance guidelines
+- Development workflow
+- Testing procedures
+
+---
+
+## 🔒 Security Considerations
+
+### Demo Security Model
+- Hardcoded credentials clearly marked
+- No encryption or security hardening
+- Network isolation within Docker
+- No external access except image pulls
+
+### Security Checklist
+- [ ] All services use demo credentials
+- [ ] No persistent sensitive data
+- [ ] Network properly isolated
+- [ ] Only necessary ports exposed
+- [ ] Security warnings documented
+- [ ] Production deployment guidance included
+
+---
+
+## 🚀 Deployment Guidelines
+
+### Local Development
+```bash
+# Check for existing work BEFORE starting
+screen -ls
+ps aux | grep demo-stack
+
+# Start development stack with unique session name
+screen -S demo-deploy-$(date +%Y%m%d-%H%M%S) -dm -L -Logfile deploy-$(date +%Y%m%d-%H%M%S).log ./demo-stack.sh deploy
+
+# Monitor startup
+docker compose logs -f
+
+# Validate deployment
+./test-stack.sh
+```
+
+### Demo Preparation
+1. Clean all containers and volumes
+2. Pull latest images
+3. Verify all health checks
+4. Test complete user workflows
+5. Document any known issues
+
+### Production Migration
+- Replace demo credentials with secure ones
+- Implement persistent data storage
+- Add encryption and security hardening
+- Configure backup and recovery
+- Set up monitoring and alerting
+
+---
+
+## 📞 Development Support
+
+### Getting Help
+1. Check troubleshooting section in README.md
+2. Review service logs: `docker compose logs {service}`
+3. Consult individual service documentation
+4. Check health status: `docker compose ps`
+5. **CRITICAL**: Always check for existing processes before starting new ones: `screen -ls` and `ps aux | grep demo-stack`
+
+### Issue Reporting
+- Include full error messages
+- Provide system information
+- Document reproduction steps
+- Include relevant configuration snippets
+- Specify demo vs production context
+
+---
+
+*Last updated: 2025-11-13*
--- a/SupportStack/demo/PRD.md
+++ b/SupportStack/demo/PRD.md
@@ -0,0 +1,766 @@
+# 📋 TSYS Developer Support Stack - Product Requirements Document
+
+<div align="center">
+
+[![Document ID: PRD-SUPPORT-DEMO-001](https://img.shields.io/badge/ID-PRD--SUPPORT--DEMO--001-blue.svg)](#)
+[![Version: 1.0](https://img.shields.io/badge/Version-1.0-green.svg)](#)
+[![Status: Draft](https://img.shields.io/badge/Status-Draft-orange.svg)](#)
+[![Date: 2025-11-13](https://img.shields.io/badge/Date-2025--11--13-lightgrey.svg)](#)
+[![Author: TSYS Development Team](https://img.shields.io/badge/Author-TSYS%20Dev%20Team-purple.svg)](#)
+
+**Demo Version - Product Requirements Document**
+
+</div>
+
+---
+
+## 📖 Table of Contents
+
+- [🎯 Product Vision](#-product-vision)
+- [🏗️ Architecture Overview](#️-architecture-overview)
+- [📊 Functional Requirements](#-functional-requirements)
+- [🔧 Technical Requirements](#-technical-requirements)
+- [🎨 User Experience Requirements](#-user-experience-requirements)
+- [🔒 Security Requirements](#-security-requirements)
+- [📋 Non-Functional Requirements](#-non-functional-requirements)
+- [🧪 Testing Requirements](#-testing-requirements)
+- [📚 Documentation Requirements](#-documentation-requirements)
+- [✅ Acceptance Criteria](#-acceptance-criteria)
+- [🚀 Success Metrics](#-success-metrics)
+- [📅 Implementation Timeline](#-implementation-timeline)
+- [🔄 Change Management](#-change-management)
+- [📞 Support & Maintenance](#-support--maintenance)
+- [📋 Appendix](#-appendix)
+
+---
+
+## 🎯 Product Vision
+
+> **To create a comprehensive, demo-ready developer support services stack that enhances developer productivity and quality of life for the TSYS engineering team.**
+
+This stack is designed to:
+- 🏠 **Run locally** on every developer workstation
+- ⚡ **Support daily development workflows** with essential services
+- 🔒 **Maintain security** and simplicity
+- 🆓 **Adhere to free/libre/open source principles**
+- 🎯 **Focus on inner loop development** rather than project-specific dependencies
+
+---
+
+## 🏗️ Architecture Overview
+
+### 🎨 Design Principles
+
+<div align="center">
+
+```mermaid
+graph LR
+    A[Demo-First] --> E[TSYS Support Stack]
+    B[Service Discovery] --> E
+    C[FOSS Only] --> E
+    D[Inner Loop Focus] --> E
+    F[Workstation Local] --> E
+    G[Security Conscious] --> E
+    
+    style A fill:#ffeb3b
+    style B fill:#4caf50
+    style C fill:#2196f3
+    style D fill:#ff9800
+    style F fill:#9c27b0
+    style G fill:#f44336
+    style E fill:#e1f5fe
+```
+
+</div>
+
+| Principle | Description | Priority |
+|-----------|-------------|----------|
+| **🎭 Demo-First Architecture** | Demonstration-only deployment with dynamic user detection, no persistence, one-command deployment | 🔥 High |
+| **🔍 Service Discovery** | Automatic discovery via Homepage dashboard with Docker labels | 🔥 High |
+| **🆓 FOSS Only** | Exclusively use free/libre/open source software | 🔥 High |
+| **⚡ Inner Loop Focus** | Support daily development workflows, not project-specific dependencies | 🔥 High |
+| **🏠 Workstation Local** | Run locally on developer machines, not centralized infrastructure | 🔥 High |
+| **🔒 Security Conscious** | Demo-hardened configurations with clear production separation | 🔥 High |
+
+### 📦 Service Categories
+
+| Category | Purpose | Services |
+|----------|---------|----------|
+| **🏗️ Infrastructure Services** | Core platform and management services | DNS Management, Container Socket Proxy, Container Management |
+| **📊 Monitoring & Observability** | Data collection and visualization services | Time Series Database, Visualization Platform |
+| **📚 Documentation & Diagramming** | Knowledge management and creation tools | Diagramming Server, Diagrams as a Service |
+| **🛠️ Developer Tools** | Productivity and workflow enhancement services | Homepage, Time Tracking, Archiving, Email Testing, Habit Tracking |
+
+---
+
+## 📊 Functional Requirements
+
+### 🏗️ FR-001: Infrastructure Services
+
+#### FR-001.1: DNS Management Service
+<div align="center">
+
+```mermaid
+graph TD
+    A[DNS Management Service] --> B[Web Administration]
+    A --> C[DNS Filtering]
+    A --> D[Network Monitoring]
+    A --> E[Demo Configuration]
+    A --> F[Health Monitoring]
+    A --> G[Service Discovery]
+    
+    style A fill:#e3f2fd
+    style B fill:#bbdefb
+    style C fill:#bbdefb
+    style D fill:#bbdefb
+    style E fill:#fff3e0
+    style F fill:#e8f5e8
+    style G fill:#fce4ec
+```
+
+</div>
+
+| Requirement | Description | Acceptance |
+|-------------|-------------|------------|
+| **🌐 Web Interface** | Browser-based administration interface | ✅ Required |
+| **🛡️ DNS Filtering** | Ad blocking and content filtering capabilities | ✅ Required |
+| **📊 Network Monitoring** | Traffic analysis and reporting | ✅ Required |
+| **🎭 Demo Configuration** | Default settings for demonstration | ✅ Required |
+| **🔗 Web Access** | Assigned port for web interface | ✅ Required |
+| **❤️ Health Check** | Endpoint for service monitoring | ✅ Required |
+| **🏷️ Service Discovery** | Integration with Infrastructure group | ✅ Required |
+
+#### FR-001.2: Container Socket Proxy
+<div align="center">
+
+```mermaid
+graph TD
+    A[Container Socket Proxy] --> B[API Access Control]
+    A --> C[Request Filtering]
+    A --> D[Security Restrictions]
+    A --> E[Permission Management]
+    A --> F[Health Monitoring]
+    A --> G[Service Discovery]
+    
+    style A fill:#ffebee
+    style B fill:#ffcdd2
+    style C fill:#ffcdd2
+    style D fill:#ffcdd2
+    style E fill:#fff3e0
+    style F fill:#e8f5e8
+    style G fill:#fce4ec
+```
+
+</div>
+
+| Requirement | Description | Acceptance |
+|-------------|-------------|------------|
+| **🛡️ API Access Control** | Restrict Docker socket API endpoints | ✅ Required |
+| **🔍 Request Filtering** | Block dangerous operations by default | ✅ Required |
+| **🔒 Security Restrictions** | Granular permission management | ✅ Required |
+| **⚙️ Permission Management** | Environment-based access control | ✅ Required |
+| **❤️ Health Check** | Endpoint for service monitoring | ✅ Required |
+| **🏷️ Service Discovery** | Integration with Infrastructure group | ✅ Required |
+
+#### FR-001.3: Container Management Service
+<div align="center">
+
+```mermaid
+graph TD
+    A[Container Management Service] --> B[Container Lifecycle]
+    A --> C[Image Management]
+    A --> D[Volume & Network Management]
+    A --> E[User Authentication]
+    A --> F[Health Monitoring]
+    A --> G[Service Discovery]
+    
+    style A fill:#f3e5f5
+    style B fill:#e1bee7
+    style C fill:#e1bee7
+    style D fill:#e1bee7
+    style E fill:#fff3e0
+    style F fill:#e8f5e8
+    style G fill:#fce4ec
+```
+
+</div>
+
+| Requirement | Description | Acceptance |
+|-------------|-------------|------------|
+| **🔄 Container Lifecycle** | Start/stop/restart container operations | ✅ Required |
+| **📦 Image Management** | Registry integration and image operations | ✅ Required |
+| **💾 Volume & Network** | Storage and network configuration | ✅ Required |
+| **🔐 Authentication** | User authentication with demo credentials | ✅ Required |
+| **🔗 Web Access** | Assigned port for web interface | ✅ Required |
+| **❤️ Health Check** | Endpoint for service monitoring | ✅ Required |
+| **🏷️ Service Discovery** | Integration with Infrastructure group | ✅ Required |
+
+### 📊 FR-002: Monitoring & Observability
+
+#### FR-002.1: Time Series Database
+<div align="center">
+
+```mermaid
+graph TD
+    A[Time Series Database] --> B[HTTP API]
+    A --> C[Web Administration]
+    A --> D[Demo Database]
+    A --> E[Data Access]
+    A --> F[Health Monitoring]
+    A --> G[Service Discovery]
+    
+    style A fill:#e8f5e8
+    style B fill:#c8e6c9
+    style C fill:#c8e6c9
+    style D fill:#fff3e0
+    style E fill:#bbdefb
+    style F fill:#e8f5e8
+    style G fill:#fce4ec
+```
+
+</div>
+
+| Requirement | Description | Acceptance |
+|-------------|-------------|------------|
+| **🌐 HTTP API** | Data ingestion and querying interface | ✅ Required |
+| **🖥️ Web Interface** | Browser-based administration | ✅ Required |
+| **🎭 Demo Database** | Sample data for demonstration | ✅ Required |
+| **🔗 Data Access** | Assigned port for API and web access | ✅ Required |
+| **❤️ Health Check** | Endpoint for service monitoring | ✅ Required |
+| **🏷️ Service Discovery** | Integration with Monitoring group | ✅ Required |
+
+#### FR-002.2: Visualization Platform
+<div align="center">
+
+```mermaid
+graph TD
+    A[Visualization Platform] --> B[Data Source Connection]
+    A --> C[Demo Dashboards]
+    A --> D[Dashboard Creation]
+    A --> E[Admin Authentication]
+    A --> F[Health Monitoring]
+    A --> G[Service Discovery]
+    
+    style A fill:#fff3e0
+    style B fill:#ffe0b2
+    style C fill:#ffe0b2
+    style D fill:#ffe0b2
+    style E fill:#fff3e0
+    style F fill:#e8f5e8
+    style G fill:#fce4ec
+```
+
+</div>
+
+| Requirement | Description | Acceptance |
+|-------------|-------------|------------|
+| **🔗 Data Connection** | Pre-configured connection to time series database | ✅ Required |
+| **📊 Demo Dashboards** | System metrics visualization | ✅ Required |
+| **🎨 Dashboard Creation** | Web-based dashboard editing | ✅ Required |
+| **🔐 Admin Authentication** | Authentication with demo credentials | ✅ Required |
+| **🔗 Web Access** | Assigned port for web interface | ✅ Required |
+| **❤️ Health Check** | Endpoint for service monitoring | ✅ Required |
+| **🏷️ Service Discovery** | Integration with Monitoring group | ✅ Required |
+
+### 🛠️ FR-003: Developer Tools
+
+#### FR-003.1: Habit Tracking Service
+<div align="center">
+
+```mermaid
+graph TD
+    A[Habit Tracking Service] --> B[Personal Dashboard]
+    A --> C[Habit Management]
+    A --> D[Progress Tracking]
+    A --> E[Gamification System]
+    A --> F[Integrations Support]
+    A --> G[Health Monitoring]
+    A --> H[Service Discovery]
+    
+    style A fill:#fff3e0
+    style B fill:#ffe0b2
+    style C fill:#ffe0b2
+    style D fill:#ffe0b2
+    style E fill:#ffe0b2
+    style F fill:#e8f5e8
+    style G fill:#e8f5e8
+    style H fill:#fce4ec
+```
+
+</div>
+
+| Requirement | Description | Acceptance |
+|-------------|-------------|------------|
+| **📊 Personal Dashboard** | Visual overview of habits and progress | ✅ Required |
+| **🎯 Habit Management** | Create, edit, and delete habits | ✅ Required |
+| **📈 Progress Tracking** | Track consistency and improvements | ✅ Required |
+| **🎮 Gamification** | Points system and achievement tracking | ✅ Required |
+| **🔗 Integrations** | Support for external data providers | ✅ Optional |
+| **🔗 Web Access** | Assigned port for web interface | ✅ Required |
+| **❤️ Health Check** | Endpoint for service monitoring | ✅ Required |
+| **🏷️ Service Discovery** | Integration with Developer Tools group | ✅ Required |
+
+### 📚 FR-004: Documentation & Diagramming
+
+#### FR-004.1: Diagramming Server
+<div align="center">
+
+```mermaid
+graph TD
+    A[Diagramming Server] --> B[Browser-based Editing]
+    A --> C[Multiple Export Formats]
+    A --> D[Cloud Storage Integration]
+    A --> E[No Authentication]
+    A --> F[Health Monitoring]
+    A --> G[Service Discovery]
+    
+    style A fill:#fce4ec
+    style B fill:#f8bbd9
+    style C fill:#f8bbd9
+    style D fill:#fff3e0
+    style E fill:#e8f5e8
+    style F fill:#e8f5e8
+    style G fill:#fce4ec
+```
+
+</div>
+
+| Requirement | Description | Acceptance |
+|-------------|-------------|------------|
+| **🎨 Browser Editing** | Diagram creation and editing in browser | ✅ Required |
+| **📤 Export Formats** | PNG, SVG, PDF export capabilities | ✅ Required |
+| **☁️ Cloud Integration** | Optional cloud storage integration | ✅ Optional |
+| **🔓 No Authentication** | Demo mode without login requirements | ✅ Required |
+| **🔗 Web Access** | Assigned port for web interface | ✅ Required |
+| **❤️ Health Check** | Endpoint for service monitoring | ✅ Required |
+| **🏷️ Service Discovery** | Integration with Documentation group | ✅ Required |
+
+#### FR-004.2: Diagrams as a Service
+<div align="center">
+
+```mermaid
+graph TD
+    A[Diagrams as a Service] --> B[Multiple Diagram Types]
+    A --> C[HTTP API]
+    A --> D[Web Interface]
+    A --> E[No Authentication]
+    A --> F[Health Monitoring]
+    A --> G[Service Discovery]
+    
+    style A fill:#e0f2f1
+    style B fill:#b2dfdb
+    style C fill:#b2dfdb
+    style D fill:#b2dfdb
+    style E fill:#e8f5e8
+    style F fill:#e8f5e8
+    style G fill:#fce4ec
+```
+
+</div>
+
+| Requirement | Description | Acceptance |
+|-------------|-------------|------------|
+| **🎨 Diagram Types** | PlantUML, Mermaid, GraphViz support | ✅ Required |
+| **🌐 HTTP API** | Programmatic diagram generation | ✅ Required |
+| **🖥️ Web Interface** | Simple testing interface | ✅ Required |
+| **🔓 No Authentication** | Demo mode without login requirements | ✅ Required |
+| **🔗 API Access** | Assigned port for API and web access | ✅ Required |
+| **❤️ Health Check** | Endpoint for service monitoring | ✅ Required |
+| **🏷️ Service Discovery** | Integration with Documentation group | ✅ Required |
+
+---
+
+## 🔧 Technical Requirements
+
+### 🐳 TR-001: Containerization Standards
+
+| Requirement | Description | Priority |
+|-------------|-------------|----------|
+| **📦 Official Images** | Use official Docker images only | 🔥 High |
+| **❤️ Health Checks** | Comprehensive health monitoring | 🔥 High |
+| **🔍 Service Discovery** | Automatic dashboard integration | 🔥 High |
+| **🔄 Restart Policies** | Appropriate recovery mechanisms | 🔥 High |
+
+### 🌐 TR-002: Network Architecture
+
+| Requirement | Description | Priority |
+|-------------|-------------|----------|
+| **🔒 Dedicated Network** | Isolated network environment | 🔥 High |
+| **🔢 Port Consistency** | Sequential numbering pattern | 🔥 High |
+| **🌐 Web Access** | Standard browser interfaces | 🔥 High |
+| **🤝 Inter-service Communication** | Required service interactions | 🔥 High |
+
+### 💾 TR-003: Data Strategy
+
+| Requirement | Description | Priority |
+|-------------|-------------|----------|
+| **🚫 No Persistence** | Demo simplicity focus | 🔥 High |
+| **⏰ Temporary Data** | Service functionality support | 🔥 High |
+| **🔄 Session Reset** | Clean state between demos | 🔥 High |
+| **🔐 Demo Credentials** | Simplified authentication | 🔥 High |
+
+### 🔗 TR-004: Service Integration
+
+| Requirement | Description | Priority |
+|-------------|-------------|----------|
+| **🏷️ Dashboard Discovery** | Centralized service visibility | 🔥 High |
+| **📊 Consistent Metadata** | Standardized service information | 🔥 High |
+| **🎨 Unified Access** | Consistent user experience | 🔥 High |
+| **🔄 Standard Interfaces** | Common interaction patterns | 🔥 High |
+
+---
+
+## 🎨 User Experience Requirements
+
+### 🏠 UX-001: Unified Dashboard
+
+<div align="center">
+
+```mermaid
+graph LR
+    A[Single Entry Point] --> B[Automatic Discovery]
+    A --> C[Intuitive Organization]
+    A --> D[Consistent Design]
+    A --> E[Real-time Status]
+    
+    style A fill:#e1f5fe
+    style B fill:#b3e5fc
+    style C fill:#b3e5fc
+    style D fill:#b3e5fc
+    style E fill:#b3e5fc
+```
+
+</div>
+
+| Requirement | Description | Success Metric |
+|-------------|-------------|----------------|
+| **🚪 Single Entry Point** | One dashboard for all services | 100% service visibility |
+| **🔍 Automatic Discovery** | No manual configuration required | Zero-touch setup |
+| **📂 Intuitive Organization** | Logical service grouping | User satisfaction > 90% |
+| **🎨 Consistent Design** | Unified visual experience | Design consistency > 95% |
+| **📊 Real-time Status** | Live service health indicators | Status accuracy > 99% |
+
+### ⚡ UX-002: Zero-Configuration Access
+
+| Requirement | Description | Success Metric |
+|-------------|-------------|----------------|
+| **🌐 Browser Access** | Immediate web interface availability | 100% browser compatibility |
+| **🚫 No Manual Setup** | Eliminate configuration steps | Setup time < 30 seconds |
+| **🔐 Pre-configured Auth** | Default authentication where needed | Login success rate > 95% |
+| **💡 Clear Error Messages** | Intuitive troubleshooting guidance | Issue resolution < 2 minutes |
+
+### 🎭 UX-003: Instant Demo Experience
+
+| Requirement | Description | Success Metric |
+|-------------|-------------|----------------|
+| **⚡ Single Command** | One-command deployment | Deployment time < 60 seconds |
+| **🚀 Rapid Initialization** | Fast service startup | All services ready < 60 seconds |
+| **🎯 Immediate Features** | No setup delays for functionality | Feature availability = 100% |
+| **🔄 Clean Sessions** | Fresh state between demos | Data reset success = 100% |
+
+---
+
+## 🔒 Security Requirements
+
+### 🛡️ SEC-001: Demo-Only Security Model
+
+| Requirement | Description | Implementation |
+|-------------|-------------|----------------|
+| **🎭 Demo Configuration** | Development/demo use only | Clear documentation warnings |
+| **🔓 Hardcoded Credentials** | Clearly marked demo credentials | Obvious demo-only labeling |
+| **🚫 No External Access** | Isolated from external networks | Docker network isolation |
+| **🔓 No Hardening** | No encryption or security features | Simplified demo setup |
+
+### 🔒 SEC-002: Network Isolation
+
+| Requirement | Description | Implementation |
+|-------------|-------------|----------------|
+| **🏠 Docker Isolation** | Services contained within Docker network | Dedicated network configuration |
+| **🔌 Minimal Exposure** | Only necessary ports exposed | Port access control |
+| **🚫 No Privilege Escalation** | Prevent container privilege escalation | Security context configuration |
+| **🔗 Secure API Access** | Container socket proxy for API access | Proxy service implementation |
+
+---
+
+## 📋 Non-Functional Requirements
+
+### ⚡ NFR-001: Performance
+
+| Metric | Requirement | Target |
+|--------|-------------|--------|
+| **🚀 Startup Time** | All services must start within | 60 seconds |
+| **❤️ Health Check Speed** | Health checks must complete within | 10 seconds |
+| **💾 Memory Usage** | Per service memory limit | < 512MB |
+| **🖥️ CPU Usage** | Per service CPU usage (idle) | < 25% |
+
+### 🔄 NFR-002: Reliability
+
+| Requirement | Description | Implementation |
+|-------------|-------------|----------------|
+| **❤️ Health Checks** | All services include health monitoring | Comprehensive health endpoints |
+| **🔄 Auto Restart** | Automatic recovery on failure | Restart policy configuration |
+| **⏹️ Graceful Shutdown** | Proper service termination handling | Signal handling implementation |
+| **🔗 Dependency Management** | Service startup order management | Dependency configuration |
+
+### 🔧 NFR-003: Maintainability
+
+| Requirement | Description | Standard |
+|-------------|-------------|----------|
+| **📝 Clear Configuration** | Well-documented setup | Commented configurations |
+| **🏷️ Consistent Naming** | Standardized service organization | Naming conventions |
+| **📚 Comprehensive Docs** | Complete documentation coverage | Documentation standards |
+| **➕ Easy Service Management** | Simple addition/removal processes | Modular architecture |
+
+---
+
+## 🧪 Testing Requirements
+
+### 🤖 TST-001: Automated Testing
+
+<div align="center">
+
+```mermaid
+graph TD
+    A[Automated Testing] --> B[Health Validation]
+    A --> C[Port Verification]
+    A --> D[Service Discovery]
+    A --> E[Resource Monitoring]
+    A --> F[Comprehensive Suite]
+    
+    style A fill:#e8f5e8
+    style B fill:#c8e6c9
+    style C fill:#c8e6c9
+    style D fill:#c8e6c9
+    style E fill:#c8e6c9
+    style F fill:#c8e6c9
+```
+
+</div>
+
+| Test Type | Description | Tool/Script |
+|-----------|-------------|-------------|
+| **❤️ Health Validation** | Service health check verification | `test-stack.sh` |
+| **🔌 Port Accessibility** | Port availability and response testing | `test-stack.sh` |
+| **🔍 Service Discovery** | Dashboard integration verification | `test-stack.sh` |
+| **📊 Resource Monitoring** | Memory and CPU usage validation | `test-stack.sh` |
+| **📋 Comprehensive Suite** | Full integration testing | `test-stack.sh` |
+
+### ✋ TST-002: Manual Testing
+
+| Test Area | Description | Success Criteria |
+|-----------|-------------|------------------|
+| **🌐 Web Interfaces** | Browser interface functionality | All interfaces accessible |
+| **🔐 Demo Credentials** | Authentication verification | Login success = 100% |
+| **🔗 Service Integration** | Cross-service functionality | Integration tests pass |
+| **👤 User Workflows** | End-to-end user scenarios | Workflow completion = 100% |
+
+---
+
+## 📚 Documentation Requirements
+
+### 📖 DOC-001: Technical Documentation
+
+| Requirement | Description | Location |
+|-------------|-------------|----------|
+| **📋 README Updates** | Complete service documentation | `README.md` |
+| **🌐 Access Information** | Service URLs and credentials | `README.md` |
+| **⚙️ Configuration Details** | Technical setup specifications | `README.md` |
+| **🔧 Troubleshooting Guide** | Common issue resolution | `README.md` |
+
+### 👥 DOC-002: User Documentation
+
+| Requirement | Description | Location |
+|-------------|-------------|----------|
+| **🚀 Quick Start** | Rapid deployment instructions | `README.md` |
+| **📚 Service Descriptions** | Feature and use case documentation | `README.md` |
+| **🔐 Credential Reference** | Demo credential information | `README.md` |
+| **❓ FAQ Section** | Common questions and answers | `README.md` |
+
+---
+
+## ✅ Acceptance Criteria
+
+### 🚀 AC-001: Deployment Success
+
+| Criteria | Description | Status |
+|----------|-------------|--------|
+| **⚡ Service Startup** | All services start with `docker compose up -d` | ✅ Required |
+| **❤️ Health Validation** | All services pass health checks within 60 seconds | ✅ Required |
+| **🔍 Service Discovery** | Homepage discovers and displays all services | ✅ Required |
+| **🌐 Web Access** | All interfaces accessible via browser | ✅ Required |
+
+### 🔧 AC-002: Functionality Verification
+
+| Criteria | Description | Status |
+|----------|-------------|--------|
+| **🛡️ DNS Management** | Web interface loads and functions correctly | ✅ Required |
+| **🔄 Container Management** | Container operations work properly | ✅ Required |
+| **📊 Database Operations** | Data storage and retrieval functional | ✅ Required |
+| **📈 Visualization** | Dashboards display and update correctly | ✅ Required |
+| **🎨 Diagramming** | Creation and export functions work | ✅ Required |
+| **📐 Diagram Service** | Text-to-diagram conversion functional | ✅ Required |
+
+### 🔗 AC-003: Integration Testing
+
+| Criteria | Description | Status |
+|----------|-------------|--------|
+| **🔍 Service Discovery** | Automatic discovery works correctly | ✅ Required |
+| **🤝 Inter-service Communication** | Required communications function | ✅ Required |
+| **❤️ Health Monitoring** | Health checks trigger appropriately | ✅ Required |
+| **📊 Resource Management** | Usage remains within defined limits | ✅ Required |
+
+---
+
+## 🚀 Success Metrics
+
+### 📊 Deployment Metrics
+
+| Metric | Target | Measurement |
+|--------|--------|-------------|
+| **⏱️ Stack Readiness** | < 2 minutes | Time to full functionality |
+| **✅ Service Success Rate** | 100% | Services starting successfully |
+| **❤️ Health Check Pass Rate** | 100% | Services passing health checks |
+
+### 👥 User Experience Metrics
+
+| Metric | Target | Measurement |
+|--------|--------|-------------|
+| **⚡ Deployment Success** | 100% | Single-command deployment success |
+| **🔍 Dashboard Accessibility** | 100% | Services accessible via Homepage |
+| **🚫 Configuration Required** | None | Zero configuration for basic use |
+
+---
+
+## 📅 Implementation Timeline
+
+<div align="center">
+
+```mermaid
+gantt
+    title TSYS Developer Support Stack Implementation
+    dateFormat  YYYY-MM-DD
+    section Phase 1: Core Infrastructure
+    DNS Management Service    :active, p1-1, 2025-11-13, 3d
+    Container Management       :p1-2, after p1-1, 2d
+    Service Discovery Validation :p1-3, after p1-2, 2d
+    
+    section Phase 2: Monitoring Stack
+    Time Series Database      :p2-1, after p1-3, 2d
+    Visualization Platform     :p2-2, after p2-1, 3d
+    Dashboard Creation         :p2-3, after p2-2, 2d
+    
+    section Phase 3: Documentation Tools
+    Diagramming Server         :p3-1, after p2-3, 2d
+    Diagram Service            :p3-2, after p3-1, 2d
+    Integration Testing        :p3-3, after p3-2, 2d
+    
+    section Phase 4: Testing & Documentation
+    Comprehensive Test Suite   :p4-1, after p3-3, 3d
+    Documentation Updates      :p4-2, after p4-1, 2d
+    Final Validation           :p4-3, after p4-2, 2d
+```
+
+</div>
+
+### 📅 Phase Details
+
+| Phase | Duration | Focus | Deliverables |
+|-------|----------|-------|--------------|
+| **🏗️ Phase 1** | Week 1 | Core Infrastructure | DNS Management, Container Management, Service Discovery |
+| **📊 Phase 2** | Week 1 | Monitoring Stack | Time Series Database, Visualization Platform, Dashboards |
+| **📚 Phase 3** | Week 2 | Documentation Tools | Diagramming Server, Diagram Service, Integration |
+| **🧪 Phase 4** | Week 2 | Testing & Documentation | Test Suite, Documentation, Validation |
+
+---
+
+## 🔄 Change Management
+
+### 📝 Version Control Strategy
+
+| Practice | Description | Standard |
+|----------|-------------|----------|
+| **📊 Comprehensive Tracking** | All changes tracked via Git | 100% change coverage |
+| **📋 Structured Messages** | Conventional commit formatting | Commit message standards |
+| **⚛️ Atomic Changes** | Small, focused commits | Single-purpose commits |
+| **📝 Detailed Descriptions** | Clear change documentation | Comprehensive commit messages |
+
+### 🔍 Quality Assurance Process
+
+| Step | Description | Tool/Process |
+|------|-------------|--------------|
+| **🤖 Automated Validation** | Automated testing on all changes | Test suite execution |
+| **✋ Manual Testing** | Manual validation for new services | User acceptance testing |
+| **📚 Documentation Updates** | Synchronized documentation updates | Documentation review |
+| **✅ Requirements Validation** | Continuous validation against PRD | Requirements traceability |
+
+---
+
+## 📞 Support & Maintenance
+
+### 🔧 Troubleshooting Framework
+
+| Component | Description | Implementation |
+|-----------|-------------|----------------|
+| **📋 Comprehensive Logging** | Service logging and diagnostics | Docker log integration |
+| **📊 Real-time Monitoring** | Live health and status reporting | Health check endpoints |
+| **📖 Documented Procedures** | Resolution procedures for common issues | Troubleshooting guides |
+
+### 🔄 Maintenance Strategy
+
+| Activity | Description | Frequency |
+|----------|-------------|----------|
+| **📦 Image Updates** | Regular service image updates | Weekly |
+| **⚙️ Configuration Management** | Change tracking and validation | Continuous |
+| **🔗 Compatibility Preservation** | Maintain backward compatibility | During updates |
+| **📈 Continuous Improvement** | User feedback-based enhancements | Ongoing |
+
+---
+
+## 📋 Appendix
+
+### 📦 A. Service Categories
+
+| Category | Purpose | Example Services |
+|----------|---------|-----------------|
+| **🏗️ Infrastructure Services** | Core platform and management tools | DNS Management, Container Socket Proxy, Container Management |
+| **📊 Monitoring & Observability** | Data collection and visualization | Time Series Database, Visualization Platform |
+| **📚 Documentation & Diagramming** | Knowledge management and creation | Diagramming Server, Diagrams as a Service |
+| **🛠️ Developer Tools** | Productivity and workflow enhancement | Homepage, Time Tracking, Archiving, Habit Tracking |
+
+### 🔗 B. Integration Requirements
+
+| Requirement | Description | Implementation |
+|-------------|-------------|----------------|
+| **🏷️ Dashboard Discovery** | Centralized service visibility | Homepage integration |
+| **🤝 Inter-service Communication** | Required service interactions | Network configuration |
+| **🔐 Consistent Authentication** | Unified access patterns | Demo credential strategy |
+| **❤️ Unified Monitoring** | Standardized health checking | Health check standards |
+
+### ✅ C. Success Criteria
+
+| Criteria | Description | Measurement |
+|----------|-------------|-------------|
+| **🔍 Service Discoverability** | All services accessible from central dashboard | 100% service visibility |
+| **⚡ Rapid Demonstration** | Complete functionality demonstration within 2 minutes | Time-to-demo < 120 seconds |
+| **🎯 Intuitive Experience** | Minimal training required for basic use | User satisfaction > 90% |
+| **🔄 Cross-Platform Reliability** | Consistent operation across development environments | Platform compatibility > 95% |
+
+---
+
+<div align="center">
+
+---
+
+## 📄 Document Information
+
+**Document ID**: PRD-SUPPORT-DEMO-001  
+**Version**: 1.0  
+**Date**: 2025-11-13  
+**Author**: TSYS Development Team  
+**Status**: Draft  
+
+---
+
+*This PRD serves as the source of truth for the TSYS Developer Support Stack demo implementation and will be used for audit and quality assurance purposes.*
+
+</div>
--- a/SupportStack/demo/README.md
+++ b/SupportStack/demo/README.md
@@ -0,0 +1,415 @@
+# 🚀 TSYS Developer Support Stack - Demo
+
+<div align="center">
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![Docker](https://img.shields.io/badge/Docker-Ready-blue.svg)](https://www.docker.com/)
+[![FOSS](https://img.shields.io/badge/FOSS-Only-green.svg)](https://www.fsf.org/)
+[![Demo](https://img.shields.io/badge/Mode-Demo-orange.svg)](#)
+
+*A comprehensive, demo-ready developer support services stack that enhances productivity and quality of life for the TSYS engineering team.*
+
+</div>
+
+---
+
+## 📖 Table of Contents
+
+- [🚀 Quick Start](#-quick-start)
+- [📋 Services Overview](#-services-overview)
+- [🔧 Technical Configuration](#-technical-configuration)
+- [🔐 Demo Credentials](#-demo-credentials)
+- [📊 Service Dependencies](#-service-dependencies)
+- [🧪 Testing](#-testing)
+- [🔍 Troubleshooting](#-troubleshooting)
+- [📁 Data Management](#-data-management)
+- [🔄 Updates & Maintenance](#-updates--maintenance)
+- [📚 Documentation](#-documentation)
+- [🚨 Security Notes](#-security-notes)
+- [📞 Support](#-support)
+
+---
+
+## 🚀 Quick Start
+
+<div align="center">
+
+```bash
+# 🎯 Demo deployment with dynamic user detection
+./demo-stack.sh deploy
+
+# 🔧 Comprehensive testing and validation
+./demo-test.sh full
+```
+
+</div>
+
+🎉 **Access all services via the Homepage dashboard at** **[http://localhost:${HOMEPAGE_PORT}](http://localhost:${HOMEPAGE_PORT})**
+
+> ⚠️ **Demo Configuration Only** - This stack is designed for demonstration purposes with no data persistence.
+
+---
+
+## 🔧 Dynamic Deployment Architecture
+
+### 📋 Environment Variables
+
+All configuration is managed through `demo.env` and dynamic detection:
+
+| Variable | Description | Default |
+|-----------|-------------|----------|
+| **COMPOSE_PROJECT_NAME** | Consistent naming prefix | `tsysdevstack-supportstack-demo` |
+| **UID** | Current user ID | Auto-detected |
+| **GID** | Current group ID | Auto-detected |
+| **DOCKER_GID** | Docker group ID | Auto-detected |
+| **COMPOSE_NETWORK_NAME** | Docker network name | `tsysdevstack-supportstack-demo-network` |
+
+### 🎯 Deployment Scripts
+
+| Script | Purpose | Usage |
+|---------|---------|--------|
+| **demo-stack.sh** | Dynamic deployment with user detection | `./demo-stack.sh [deploy|stop|restart]` |
+| **demo-test.sh** | Comprehensive QA and validation | `./demo-test.sh [full|security|permissions]` |
+| **demo.env** | All environment variables | Source of configuration |
+
+---
+
+## 📋 Services Overview
+
+### 🛠️ Developer Tools
+| Service | Port | Description | 🌐 Access |
+|---------|------|-------------|-----------|
+| **Homepage** | 4000 | Central dashboard for service discovery | [Open](http://192.168.3.6:4000) |
+| **Atomic Tracker** | 4012 | Habit tracking and personal dashboard | [Open](http://192.168.3.6:4012) |
+| **Wakapi** | 4015 | Open-source WakaTime alternative for time tracking | [Open](http://192.168.3.6:4015) |
+| **MailHog** | 4017 | Web and API based SMTP testing tool | [Open](http://192.168.3.6:4017) |
+| **Atuin** | 4018 | Magical shell history synchronization | [Open](http://192.168.3.6:4018) |
+
+### 📚 Archival & Content Management
+| Service | Port | Description | 🌐 Access |
+|---------|------|-------------|-----------|
+| **ArchiveBox** | 4013 | Web archiving solution | [Open](http://192.168.3.6:4013) |
+| **Tube Archivist** | 4014 | YouTube video archiving | [Open](http://192.168.3.6:4014) |
+
+### 🏗️ Infrastructure Services
+| Service | Port | Description | 🌐 Access |
+|---------|------|-------------|-----------|
+| **Pi-hole** | 4006 | DNS-based ad blocking and monitoring | [Open](http://192.168.3.6:4006) |
+| **Portainer** | 4007 | Web-based container management | [Open](http://192.168.3.6:4007) |
+
+### 📊 Monitoring & Observability
+| Service | Port | Description | 🌐 Access |
+|---------|------|-------------|-----------|
+| **InfluxDB** | 4008 | Time series database for metrics | [Open](http://192.168.3.6:4008) |
+| **Grafana** | 4009 | Analytics and visualization platform | [Open](http://192.168.3.6:4009) |
+
+### 📚 Documentation & Diagramming
+| Service | Port | Description | 🌐 Access |
+|---------|------|-------------|-----------|
+| **Draw.io** | 4010 | Web-based diagramming application | [Open](http://192.168.3.6:4010) |
+| **Kroki** | 4011 | Diagrams as a service | [Open](http://192.168.3.6:4011) |
+
+---
+
+## 🔧 Technical Configuration
+
+### 🐳 Docker Integration
+
+<div align="center">
+
+```yaml
+# Demo service template (docker-compose.yml.template)
+services:
+  service-name:
+    image: official/image:tag
+    user: "${UID}:${GID}"
+    container_name: "${COMPOSE_PROJECT_NAME}-service-name"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    volumes:
+      - "${COMPOSE_PROJECT_NAME}_service_data:/path"
+    environment:
+      - PUID=${UID}
+      - PGID=${GID}
+    labels:
+      homepage.group: "Group Name"
+      homepage.name: "Display Name"
+      homepage.icon: "icon-name"
+      homepage.href: "http://localhost:${SERVICE_PORT}"
+      homepage.description: "Brief description"
+```
+
+</div>
+
+### ⚙️ Dynamic Configuration
+
+| Setting | Variable | Description |
+|---------|-----------|-------------|
+| **Service Naming** | `${COMPOSE_PROJECT_NAME}-{service}` | Dynamic container naming |
+| **Network** | `${COMPOSE_NETWORK_NAME}` | Dedicated Docker network |
+| **User Mapping** | `${UID}:${GID}` | Dynamic user detection |
+| **Docker Group** | `${DOCKER_GID}` | Docker socket access |
+| **Volume Naming** | `${COMPOSE_PROJECT_NAME}_{service}_data` | Consistent volumes |
+| **Restart Policy** | `unless-stopped` | Automatic recovery |
+
+### 🔍 Health Check Endpoints
+
+| Service | Health Check Path | Status |
+|---------|-------------------|--------|
+| **Pi-hole** (DNS Management) | `HTTP GET /` | ✅ Active |
+| **Portainer** (Container Management) | `HTTP GET /` | ✅ Active |
+| **InfluxDB** (Time Series Database) | `HTTP GET /ping` | ✅ Active |
+| **Grafana** (Visualization Platform) | `HTTP GET /api/health` | ✅ Active |
+| **Draw.io** (Diagramming Server) | `HTTP GET /` | ✅ Active |
+| **Kroki** (Diagrams as a Service) | `HTTP GET /health` | ✅ Active |
+
+### 🏷️ Service Discovery Labels
+
+All services include Homepage labels for auto-discovery:
+
+```yaml
+labels:
+  homepage.group: "Service category"
+  homepage.name: "Display name"
+  homepage.icon: "Appropriate icon"
+  homepage.href: "Full URL"
+  homepage.description: "Brief service description"
+```
+
+---
+
+## 🔐 Demo Credentials
+
+> ⚠️ **Demo Configuration Only** - Reset all credentials before production use
+
+| Service | Username | Password | 🔗 Access |
+|---------|----------|----------|-----------|
+| **Grafana** | `admin` | `demo_password` | [Login](http://localhost:4009) |
+| **Portainer** | `admin` | `demo_password` | [Login](http://localhost:4007) |
+
+---
+
+## 📊 Service Dependencies
+
+```mermaid
+graph TD
+    A[Homepage Dashboard] --> B[All Services]
+    C[Container Management] --> D[Container Socket Proxy]
+    E[Visualization Platform] --> F[Time Series Database]
+    G[All Other Services] --> H[No Dependencies]
+    
+    style A fill:#e1f5fe
+    style C fill:#f3e5f5
+    style E fill:#e8f5e8
+    style G fill:#fff3e0
+```
+
+| Service | Dependencies | Status |
+|---------|--------------|--------|
+| **Container Management** (Portainer) | Container Socket Proxy | 🔗 Required |
+| **Visualization Platform** (Grafana) | Time Series Database (InfluxDB) | 🔗 Required |
+| **All Other Services** | None | ✅ Standalone |
+
+---
+
+## 🧪 Testing & Validation
+
+### 🤖 Automated Demo Testing
+
+<div align="center">
+
+```bash
+# 🎯 Full deployment and validation
+./demo-stack.sh deploy && ./demo-test.sh full
+
+# 🔍 Security compliance validation
+./demo-test.sh security
+
+# 👤 File ownership validation
+./demo-test.sh permissions
+
+# 🌐 Network isolation validation
+./demo-test.sh network
+```
+
+</div>
+
+### ✅ Manual Validation Commands
+
+```bash
+# 📊 Check service status with dynamic naming
+docker compose ps
+
+# 📋 View service logs
+docker compose logs {service-name}
+
+# 🌐 Test individual endpoints with variables
+curl -f http://localhost:${HOMEPAGE_PORT}/
+curl -f http://localhost:${INFLUXDB_PORT}/ping
+curl -f http://localhost:${GRAFANA_PORT}/api/health
+
+# 🔍 Validate user permissions
+ls -la /var/lib/docker/volumes/${COMPOSE_PROJECT_NAME}_*/
+```
+
+---
+
+## 🔍 Troubleshooting
+
+### 🚨 Common Issues
+
+#### Services not starting
+```bash
+# 🔧 Check Docker daemon
+docker info
+
+# 🌐 Check network
+docker network ls | grep tsysdevstack_supportstack
+
+# 🔄 Recreate network
+docker network create tsysdevstack_supportstack
+```
+
+#### Port conflicts
+```bash
+# 🔍 Check port usage
+netstat -tulpn | grep :400
+
+# 🗑️ Kill conflicting processes
+sudo fuser -k {port}/tcp
+```
+
+#### Health check failures
+```bash
+# 🔍 Check individual service health
+docker compose exec {service} curl -f http://localhost:{internal-port}/health
+
+# 🔄 Restart specific service
+docker compose restart {service}
+```
+
+### 🛠️ Service-Specific Issues
+
+| Issue | Service | Solution |
+|-------|---------|----------|
+| **DNS issues** | Pi-hole | Ensure Docker DNS settings allow custom DNS servers<br>Check that port 53 is available on the host |
+| **Database connection** | Grafana-InfluxDB | Verify both services are on the same network<br>Check database connectivity: `curl http://localhost:4008/ping` |
+| **Container access** | Portainer | Ensure container socket is properly mounted<br>Check Container Socket Proxy service if used |
+
+---
+
+## 📁 Data Management
+
+### 🎭 Demo Mode Configuration
+
+> 💡 **No persistent data storage** - All data resets on container restart
+
+| Feature | Configuration |
+|---------|---------------|
+| **Data Persistence** | ❌ Disabled (demo mode) |
+| **Storage Type** | Docker volumes (temporary) |
+| **Data Reset** | ✅ Automatic on restart |
+| **Credentials** | 🔒 Hardcoded demo only |
+
+### 🗂️ Volume Management
+
+```bash
+# 📋 List volumes
+docker volume ls | grep tsysdevstack
+
+# 🗑️ Clean up all data
+docker compose down -v
+```
+
+---
+
+## 🔄 Updates & Maintenance
+
+### 📦 Image Updates
+
+<div align="center">
+
+```bash
+# 🔄 Pull latest images
+docker compose pull
+
+# 🚀 Recreate with new images
+docker compose up -d --force-recreate
+```
+
+</div>
+
+### ⚙️ Configuration Changes
+
+1. **Edit** `docker-compose.yml`
+2. **Apply** changes: `docker compose up -d`
+3. **Verify** with `docker compose ps`
+4. **Test** functionality
+
+---
+
+## 📚 Documentation
+
+| Document | Purpose | Link |
+|----------|---------|------|
+| **📋 Product Requirements** | Business requirements and specifications | [PRD.md](PRD.md) |
+| **🤖 Development Guidelines** | Development principles and standards | [AGENTS.md](AGENTS.md) |
+| **🌐 Service Documentation** | Individual service guides | Service web interfaces |
+
+---
+
+## 🚨 Security Notes
+
+> ⚠️ **Demo Configuration Only - Production Use Prohibited**
+
+### 🔒 Demo Security Model
+- 🔓 **Demo Credentials**: Hardcoded for demonstration only
+- 🚫 **No Hardening**: No encryption or security features
+- 🌐 **Network Isolation**: Do not expose to external networks
+- 🔄 **Ephemeral Data**: All data resets on container restart
+- 📡 **Docker Socket Proxy**: Mandatory for all container operations
+
+### 🛡️ Security Requirements
+- **Dynamic User Detection**: Prevents root file ownership issues
+- **Docker Group Access**: Required for socket proxy functionality
+- **Volume-First Storage**: Docker volumes preferred over bind mounts
+- **Read-Only Host Access**: Minimal host filesystem interaction
+- **Network Segregation**: Services isolated in demo network
+
+### ⚠️ Production Migration Warning
+- Reset all credentials before production deployment
+- Implement persistent data storage
+- Add encryption and security hardening
+- Configure proper backup and recovery
+- Set up monitoring and alerting
+
+---
+
+## 📞 Support
+
+### 🆘 Getting Help
+
+1. **📖 Check** troubleshooting section above
+2. **📋 Review** service logs: `docker compose logs`
+3. **📚 Consult** individual service documentation
+4. **🔍 Check** health status: `docker compose ps`
+
+### 🐛 Issue Reporting
+
+When reporting issues, please include:
+- 📝 Full error messages
+- 💻 System information
+- 🔄 Reproduction steps
+- ⚙️ Configuration snippets
+- 🎭 Demo vs production context
+
+---
+
+<div align="center">
+
+**🎉 Happy Developing!**
+
+*Last updated: 2025-11-13*
+
+</div>
--- a/SupportStack/demo/USER_GUIDE.md
+++ b/SupportStack/demo/USER_GUIDE.md
@@ -0,0 +1,263 @@
+# 🚀 TSYS Developer Support Stack - User Guide
+
+## 📖 Quick Start for Developers
+
+Welcome to the TSYS Developer Support Stack! This guide will help you get up and running with all the developer tools in minutes.
+
+### 🎯 Access Your Dashboard
+
+**Main Dashboard:** http://192.168.3.6:4000
+
+This is your central hub for accessing all services. The dashboard automatically discovers and displays all available services.
+
+---
+
+## 🛠️ Available Services
+
+### 🏠 Homepage Dashboard
+**URL:** http://192.168.3.6:4000
+
+Your personalized developer dashboard featuring:
+- **Service Discovery:** Automatically detects all running services
+- **Resource Monitoring:** Real-time CPU, memory, and disk usage
+- **Quick Search:** Integrated search functionality
+- **Customizable Layout:** Arrange widgets to your preference
+
+### 📚 Atuin - Shell History
+**URL:** http://192.168.3.6:4001
+
+Never lose a command again! Atuin provides:
+- **Synced Shell History:** Access your command history across machines
+- **Powerful Search:** Find commands instantly with advanced search
+- **Statistics:** Track your shell usage patterns
+- **Encryption:** Secure storage of your command history
+
+**Quick Setup:**
+```bash
+# Install Atuin client
+curl --proto '=https' --tlsv1.2 -sSf https://setup.atuin.sh | sh
+
+# Configure to use your server
+atuin register
+atuin import bash
+```
+
+### ⏱️ Wakapi - Time Tracking
+**URL:** http://192.168.3.6:4002
+
+Track your coding time automatically:
+- **Language Detection:** Automatically detects programming languages
+- **Project Tracking:** Organize time by projects
+- **Detailed Reports:** View productivity trends and statistics
+- **API Access:** Integrate with other tools
+
+**Setup with your favorite editor:**
+- **VS Code:** Install the WakaTime extension
+- **Vim/Neovim:** Use the wakatime-vim plugin
+- **JetBrains:** Install the WakaTime plugin
+
+### 🗄️ ArchiveBox - Web Archiving
+**URL:** http://192.168.3.6:4003
+
+Save web pages permanently:
+- **Complete Archives:** Saves HTML, CSS, JS, PDFs, and media
+- **Full-Text Search:** Search across all archived content
+- **Tag Organization:** Organize archives with tags and folders
+- **Scheduled Archiving:** Automatically archive websites on schedules
+
+**Quick Usage:**
+```bash
+# Archive a single URL
+echo "https://example.com" | archivebox add
+
+# Archive multiple URLs from a file
+cat urls.txt | archivebox add
+```
+
+### 📺 Tube Archivist - YouTube Media Library
+**URL:** http://192.168.3.6:4004
+
+Your personal YouTube archive:
+- **Channel/Playlist Backup:** Download entire channels or playlists
+- **Metadata Management:** Rich metadata including descriptions, thumbnails
+- **Subtitles:** Download and index subtitles for searchability
+- **Streaming:** Stream your archived videos directly from the interface
+
+**Getting Started:**
+1. Visit the web interface
+2. Add YouTube channels or playlists you want to archive
+3. Set up download schedules
+4. Enjoy your personal media library!
+
+### 📧 MailHog - Email Testing
+**URL:** http://192.168.3.6:4005
+**SMTP Port:** 1025
+
+Perfect for email development and testing:
+- **Email Capture:** Captures all emails sent to port 1025
+- **Web Interface:** View captured emails in a clean web interface
+- **HTML/Plain Text:** View both HTML and plain text versions
+- **Release Function:** Release emails to real SMTP servers for testing
+
+**Configuration for Development:**
+```python
+# Python (smtplib)
+import smtplib
+server = smtplib.SMTP('192.168.3.6', 1025)
+server.sendmail(from_addr, to_addr, message)
+```
+
+```javascript
+// Node.js (nodemailer)
+const nodemailer = require('nodemailer');
+const transporter = nodemailer.createTransporter({
+  host: '192.168.3.6',
+  port: 1025
+});
+```
+
+---
+
+## 🔧 Advanced Configuration
+
+### Customizing Homepage
+
+Edit the configuration files in the `homepage/config/` directory:
+
+**`settings.yaml`** - Main dashboard settings
+**`docker.yaml`** - Docker integration settings  
+**`bookmarks.yaml`** - Your quick links
+
+### Adding New Services
+
+1. Add your service to `docker-compose.yml`
+2. Add Homepage labels for automatic discovery:
+```yaml
+labels:
+  - "homepage.group=My Services"
+  - "homepage.name=My Service"
+  - "homepage.icon=your-icon"
+  - "homepage.description=Service description"
+```
+
+### Environment Variables
+
+Key environment variables you might want to customize:
+
+```bash
+# Database credentials
+POSTGRES_USER=atuin
+POSTGRES_PASSWORD=your_secure_password
+
+# Atuin settings
+ATUIN_HOST=http://192.168.3.6:4001
+
+# Wakapi settings  
+WAKAPI_PASSWORD_SALT=your_custom_salt
+```
+
+---
+
+## 🔍 Troubleshooting
+
+### Service Not Accessible
+
+1. **Check if service is running:**
+   ```bash
+   docker ps | grep tsysdevstack-supportstack
+   ```
+
+2. **Check service logs:**
+   ```bash
+   docker logs tsysdevstack-supportstack-service-name
+   ```
+
+3. **Verify port accessibility:**
+   ```bash
+   curl -I http://192.168.3.6:port-number
+   ```
+
+### High Resource Usage
+
+Some services are resource-intensive:
+- **Elasticsearch** (Tube Archivist): ~780MB RAM, high CPU during startup
+- **Tube Archivist**: ~145MB RAM, high CPU during video processing
+
+**Optimization Tips:**
+- Restart services that are consuming excessive resources
+- Consider limiting Tube Archivist concurrent downloads
+- Monitor Elasticsearch heap size if needed
+
+### Data Persistence
+
+All data is stored in Docker volumes:
+- PostgreSQL data: Shell history and user data
+- Wakapi data: Time tracking data  
+- ArchiveBox data: Web archives and metadata
+- Tube Archivist data: Videos and metadata
+
+**Backup Important Data:**
+```bash
+# List volumes
+docker volume ls | grep tsysdevstack
+
+# Backup a volume
+docker run --rm -v volume_name:/data -v $(pwd):/backup alpine tar czf /backup/backup.tar.gz /data
+```
+
+---
+
+## 📊 Performance Tips
+
+### Resource Usage Summary
+
+| Service | Typical RAM Usage | CPU Usage | Notes |
+|---------|------------------|-----------|-------|
+| Homepage | ~100MB | Minimal | Lightweight dashboard |
+| Atuin | ~6MB | Minimal | Shell history service |
+| Wakapi | ~30MB | Minimal | Time tracking |
+| MailHog | ~7MB | Minimal | Email testing |
+| PostgreSQL | ~70MB | Low | Database backend |
+| ArchiveBox | ~107MB | Low | Web archiving |
+| Docker Socket Proxy | ~20MB | Minimal | Service discovery |
+| Elasticsearch | ~780MB | High (startup) | Search engine |
+| Tube Archivist | ~145MB | High (processing) | Media processing |
+
+### Optimization Recommendations
+
+1. **For Development:** All services run comfortably on a modern laptop
+2. **For Production:** Consider dedicated resources for Elasticsearch and Tube Archivist
+3. **Resource Monitoring:** Use the Homepage resource widgets to monitor usage
+
+---
+
+## 🔗 Quick Links
+
+- **Main Dashboard:** http://192.168.3.6:4000
+- **Shell History:** http://192.168.3.6:4001  
+- **Time Tracking:** http://192.168.3.6:4002
+- **Web Archive:** http://192.168.3.6:4003
+- **Media Library:** http://192.168.3.6:4004
+- **Email Testing:** http://192.168.3.6:4005
+
+---
+
+## 🆘 Need Help?
+
+1. **Check the main README.md** for technical details
+2. **Run the test suite:** `./test-stack.sh`
+3. **Check service logs:** `docker compose logs service-name`
+4. **Verify all services:** `docker compose ps`
+
+---
+
+## 🎉 Best Practices
+
+- **Use the Homepage dashboard** as your primary entry point
+- **Set up Atuin on all your development machines** for synced shell history
+- **Configure Wakapi with your code editor** for automatic time tracking
+- **Archive important documentation** with ArchiveBox for future reference
+- **Use MailHog for all development email testing** to avoid spam
+- **Monitor resource usage** via the Homepage widgets
+
+Happy developing! 🚀
--- a/SupportStack/demo/config/homepage/docker.yaml
+++ b/SupportStack/demo/config/homepage/docker.yaml
@@ -0,0 +1,10 @@
+---
+# Docker service discovery for Homepage
+# Using docker socket for service discovery
+
+docker:
+  socket: /var/run/docker.sock
+  # Filter to only show services with homepage labels
+  filter:
+    include:
+      - "homepage.*"
--- a/SupportStack/demo/demo-stack.sh
+++ b/SupportStack/demo/demo-stack.sh
@@ -0,0 +1,163 @@
+#!/bin/bash
+
+# =============================================================================
+# TSYS Developer Support Stack - Demo Deployment Script
+# =============================================================================
+# 
+# This script dynamically detects user environment and deploys the demo stack
+# with proper permissions, naming conventions, and security settings.
+#
+# Usage: ./demo-stack.sh [deploy|stop|restart|status]
+# =============================================================================
+
+set -euo pipefail
+
+# =============================================================================
+# CONFIGURATION
+# =============================================================================
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+# Script directory
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
+# =============================================================================
+# DYNAMIC DETECTION
+# =============================================================================
+
+echo -e "${BLUE}🔍 Detecting environment...${NC}"
+
+# Load environment variables
+# shellcheck source=demo.env
+if [[ -f "demo.env" ]]; then
+    set -a
+    source demo.env
+    set +a
+    echo -e "${GREEN}✅ Loaded demo.env${NC}"
+else
+    echo -e "${RED}❌ demo.env not found!${NC}"
+    exit 1
+fi
+
+# Dynamic user and group detection
+APP_UID=$(id -u)
+export APP_UID
+APP_GID=$(id -g)
+export APP_GID
+DOCKER_GID=$(getent group docker 2>/dev/null | cut -d: -f3 || echo "972")
+export DOCKER_GID
+
+echo -e "${GREEN}👤 User ID: ${APP_UID}${NC}"
+echo -e "${GREEN}👥 Group ID: ${APP_GID}${NC}"
+echo -e "${GREEN}🐳 Docker Group ID: ${DOCKER_GID}${NC}"
+
+# Validate docker group access
+if ! groups | grep -q docker; then
+    echo -e "${YELLOW}⚠️  Warning: User not in docker group${NC}"
+    echo -e "${YELLOW}   Docker socket proxy may not work correctly${NC}"
+fi
+
+# =============================================================================
+# FUNCTIONS
+# =============================================================================
+
+deploy_stack() {
+    echo -e "${BLUE}🚀 Deploying TSYS Developer Support Stack Demo...${NC}"
+    
+    # Generate docker-compose.yml from template
+    if [[ -f "docker-compose.yml.template" ]]; then
+        echo -e "${BLUE}📝 Generating docker-compose.yml...${NC}"
+        envsubst < docker-compose.yml.template > docker-compose.yml
+        echo -e "${GREEN}✅ docker-compose.yml generated${NC}"
+    else
+        echo -e "${RED}❌ docker-compose.yml.template not found!${NC}"
+        exit 1
+    fi
+    
+    # Network will be created by docker compose
+    echo -e "${BLUE}🌐 Docker network will be created by compose...${NC}"
+    
+    # Deploy services
+    echo -e "${BLUE}🐳 Starting services...${NC}"
+    docker compose up -d
+    
+    echo -e "${GREEN}✅ Stack deployed successfully!${NC}"
+    echo -e "${BLUE}🌐 Access Homepage at: http://localhost:${HOMEPAGE_PORT}${NC}"
+}
+
+stop_stack() {
+    echo -e "${YELLOW}🛑 Stopping TSYS Developer Support Stack Demo...${NC}"
+    docker compose down
+    echo -e "${GREEN}✅ Stack stopped${NC}"
+}
+
+restart_stack() {
+    echo -e "${BLUE}🔄 Restarting TSYS Developer Support Stack Demo...${NC}"
+    stop_stack
+    sleep 2
+    deploy_stack
+}
+
+show_status() {
+    echo -e "${BLUE}📊 Stack Status:${NC}"
+    docker compose ps
+    
+    echo -e "${BLUE}🌐 Service URLs:${NC}"
+    echo -e "${GREEN}   Homepage: http://localhost:${HOMEPAGE_PORT}${NC}"
+    echo -e "${GREEN}   Atomic Tracker: http://localhost:${ATOMIC_TRACKER_PORT}${NC}"
+    echo -e "${GREEN}   Wakapi: http://localhost:${WAKAPI_PORT}${NC}"
+    echo -e "${GREEN}   MailHog: http://localhost:${MAILHOG_WEB_PORT}${NC}"
+    echo -e "${GREEN}   Atuin: http://localhost:${ATUIN_PORT}${NC}"
+    echo -e "${GREEN}   Grafana: http://localhost:${GRAFANA_PORT}${NC}"
+    echo -e "${GREEN}   Portainer: http://localhost:${PORTAINER_PORT}${NC}"
+}
+
+show_help() {
+    echo -e "${BLUE}TSYS Developer Support Stack - Demo Deployment${NC}"
+    echo ""
+    echo -e "${YELLOW}Usage:${NC} $0 [command]"
+    echo ""
+    echo -e "${YELLOW}Commands:${NC}"
+    echo -e "  ${GREEN}deploy${NC}     Deploy the demo stack"
+    echo -e "  ${GREEN}stop${NC}       Stop all services"
+    echo -e "  ${GREEN}restart${NC}    Restart all services"
+    echo -e "  ${GREEN}status${NC}     Show service status and URLs"
+    echo -e "  ${GREEN}help${NC}       Show this help message"
+    echo ""
+    echo -e "${YELLOW}Examples:${NC}"
+    echo -e "  $0 deploy"
+    echo -e "  $0 status"
+}
+
+# =============================================================================
+# MAIN EXECUTION
+# =============================================================================
+
+case "${1:-help}" in
+    deploy)
+        deploy_stack
+        ;;
+    stop)
+        stop_stack
+        ;;
+    restart)
+        restart_stack
+        ;;
+    status)
+        show_status
+        ;;
+    help|--help|-h)
+        show_help
+        ;;
+    *)
+        echo -e "${RED}❌ Unknown command: $1${NC}"
+        show_help
+        exit 1
+        ;;
+esac
--- a/SupportStack/demo/demo-test.sh
+++ b/SupportStack/demo/demo-test.sh
@@ -0,0 +1,653 @@
+#!/bin/bash
+
+# =============================================================================
+# TSYS Developer Support Stack - Demo Testing & Validation Script
+# =============================================================================
+# 
+# This script performs comprehensive QA, security compliance, and validation
+# of demo stack deployment using Docker containers only.
+#
+# Usage: ./demo-test.sh [full|security|permissions|network|health]
+# =============================================================================
+
+set -euo pipefail
+
+# =============================================================================
+# CONFIGURATION
+# =============================================================================
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+# Script directory
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
+# Test counters
+TOTAL_TESTS=0
+PASSED_TESTS=0
+FAILED_TESTS=0
+
+# =============================================================================
+# UTILITY FUNCTIONS
+# =============================================================================
+
+print_header() {
+    echo -e "\n${BLUE}============================================================================${NC}"
+    echo -e "${BLUE}$1${NC}"
+    echo -e "${BLUE}============================================================================${NC}"
+}
+
+print_success() {
+    echo -e "${GREEN}✅ $1${NC}"
+    ((PASSED_TESTS++))
+}
+
+print_error() {
+    echo -e "${RED}❌ $1${NC}"
+    ((FAILED_TESTS++))
+}
+
+print_warning() {
+    echo -e "${YELLOW}⚠️  $1${NC}"
+}
+
+print_info() {
+    echo -e "${BLUE}ℹ️  $1${NC}"
+}
+
+test_result() {
+    local condition="$1"
+    local description="$2"
+    
+    ((TOTAL_TESTS++))
+    
+    if eval "$condition"; then
+        print_success "$description"
+    else
+        print_error "$description"
+    fi
+}
+
+# =============================================================================
+# DOCKER-BASED QA FUNCTIONS
+# =============================================================================
+
+run_shellcheck() {
+    print_header "🐚 SHELLCHECK VALIDATION"
+    
+    local shellcheck_failed=0
+    
+    for script in demo-stack.sh demo-test.sh; do
+        if [[ -f "$script" ]]; then
+            print_info "Checking $script with ShellCheck..."
+            
+            if docker run --rm \
+                -v "$(pwd):/workdir" \
+                -w /workdir \
+                koalaman/shellcheck:stable \
+                --severity=warning \
+                "$script"; then
+                print_success "$script passed ShellCheck validation"
+            else
+                print_error "$script failed ShellCheck validation"
+                shellcheck_failed=1
+            fi
+        else
+            print_warning "$script not found"
+        fi
+    done
+    
+    return $shellcheck_failed
+}
+
+run_yamllint() {
+    print_header "📄 YAML VALIDATION"
+    
+    local yamllint_failed=0
+    
+    if [[ -f "docker-compose.yml.template" ]]; then
+        print_info "Checking docker-compose.yml.template with YAMLLint..."
+        
+        # Create a minimal yamllint config
+        cat > .yamllint.yml << 'EOF'
+---
+extends: default
+rules:
+  line-length:
+    max: 120
+  comments:
+    min-spaces-from-content: 1
+EOF
+        
+        if docker run --rm \
+            -v "$(pwd):/workdir" \
+            -w /workdir \
+            cytopia/yamllint:latest \
+            -c .yamllint.yml \
+            docker-compose.yml.template; then
+            print_success "YAML files passed YAMLLint validation"
+        else
+            print_error "YAML files failed YAMLLint validation"
+            yamllint_failed=1
+        fi
+        
+        # Clean up config
+        rm -f .yamllint.yml
+    else
+        print_warning "docker-compose.yml.template not found"
+        yamllint_failed=1
+    fi
+    
+    return $yamllint_failed
+}
+
+run_proselint() {
+    print_header "📝 PROSELINT VALIDATION"
+    
+    local proselint_failed=0
+    
+    for doc_file in PRD.md README.md AGENTS.md; do
+        if [[ -f "$doc_file" ]]; then
+            print_info "Checking $doc_file with Proselint..."
+            
+            # Create temporary proselint config to ignore false positives
+            cat > .proselint-config.json << 'EOF'
+{
+  "flags": [
+    "typography.symbols.curly_quotes",
+    "leonard.exclamation.30ppm"
+  ]
+}
+EOF
+            
+            proselint_output=$(docker run --rm \
+                -v "$(pwd):/workdir" \
+                -w /workdir \
+                ghcr.io/pycqa/proselint:latest \
+                --config .proselint-config.json \
+                "$doc_file" 2>/dev/null || true)
+            
+            # Clean up config
+            rm -f .proselint-config.json
+            
+            if [[ -z "$proselint_output" ]]; then
+                print_success "$doc_file passed Proselint validation"
+            else
+                print_warning "$doc_file has prose issues:"
+                echo "$proselint_output" | head -10
+                proselint_failed=1
+            fi
+        else
+            print_warning "$doc_file not found"
+        fi
+    done
+    
+    return $proselint_failed
+}
+
+run_vale() {
+    print_header "📖 VALE VALIDATION"
+    
+    local vale_failed=0
+    
+    # Create Vale config
+    cat > .vale.ini << EOF
+[*.md]
+BasedOnStyles = Vale
+Vocab = TSYS
+
+[TSYS]
+Terms = TSYS, Docker, Kubernetes, demo
+IgnoreCase = true
+EOF
+    
+    for doc_file in PRD.md README.md AGENTS.md; do
+        if [[ -f "$doc_file" ]]; then
+            print_info "Checking $doc_file with Vale..."
+            
+            vale_output=$(docker run --rm \
+                -v "$(pwd):/workdir" \
+                -w /workdir \
+                jdkato/vale:latest \
+                --minAlertLevel=error \
+                --config=.vale.ini \
+                "$doc_file" 2>/dev/null || true)
+            
+            if [[ -z "$vale_output" ]]; then
+                print_success "$doc_file passed Vale validation"
+            else
+                print_warning "$doc_file has Vale issues:"
+                echo "$vale_output" | head -10
+                vale_failed=1
+            fi
+        else
+            print_warning "$doc_file not found"
+        fi
+    done
+    
+    # Clean up config
+    rm -f .vale.ini
+    
+    return $vale_failed
+}
+
+run_hadolint() {
+    print_header "🐳 DOCKERFILE VALIDATION"
+    
+    local hadolint_failed=0
+    
+    # Check if we have any Dockerfiles (exclude toolchain files)
+    while IFS= read -r -d '' dockerfile; do
+        print_info "Checking $dockerfile with Hadolint..."
+        
+        if docker run --rm \
+            -v "$(pwd):/workdir" \
+            -w /workdir \
+            hadolint/hadolint:latest-alpine \
+            "$dockerfile"; then
+            print_success "$dockerfile passed Hadolint validation"
+        else
+            print_error "$dockerfile failed Hadolint validation"
+            hadolint_failed=1
+        fi
+    done < <(find . -name "Dockerfile*" -type f ! -name "Dockerfile.*" -print0 2>/dev/null)
+    
+    if ! find . -name "Dockerfile*" -type f ! -name "Dockerfile.*" -print0 2>/dev/null | grep -qz .; then
+        print_info "No Dockerfiles found to validate"
+    fi
+    
+    return $hadolint_failed
+}
+
+check_image_versions() {
+    print_header "🏷️  IMAGE VERSION VALIDATION"
+    
+    local version_failed=0
+    
+    print_info "Checking for 'latest' tags in docker-compose.yml.template..."
+    
+    if grep -q ":latest" docker-compose.yml.template; then
+        print_error "Found 'latest' tags in docker-compose.yml.template:"
+        grep -n ":latest" docker-compose.yml.template
+        version_failed=1
+    else
+        print_success "No 'latest' tags found in docker-compose.yml.template"
+    fi
+    
+    return $version_failed
+}
+
+check_file_permissions() {
+    print_header "🔐 FILE PERMISSIONS VALIDATION"
+    
+    local permission_failed=0
+    
+    # Check script permissions
+    if [[ -f "demo-stack.sh" ]]; then
+        if [[ -x "demo-stack.sh" ]]; then
+            print_success "demo-stack.sh is executable"
+        else
+            print_error "demo-stack.sh is not executable"
+            permission_failed=1
+        fi
+    fi
+    
+    if [[ -f "demo-test.sh" ]]; then
+        if [[ -x "demo-test.sh" ]]; then
+            print_success "demo-test.sh is executable"
+        else
+            print_error "demo-test.sh is not executable"
+            permission_failed=1
+        fi
+    fi
+    
+    # Check for world-writable files
+    local world_writable
+    world_writable=$(find . -type f -perm -002 2>/dev/null | wc -l)
+    if [[ "$world_writable" -eq 0 ]]; then
+        print_success "No world-writable files found"
+    else
+        print_error "Found $world_writable world-writable files"
+        permission_failed=1
+    fi
+    
+    return $permission_failed
+}
+
+validate_environment() {
+    print_header "🌍 ENVIRONMENT VALIDATION"
+    
+    local env_failed=0
+    
+    # Load environment variables
+    # shellcheck source=demo.env
+    if [[ -f "demo.env" ]]; then
+        set -a
+        source demo.env
+        set +a
+    fi
+    
+    # Check if demo.env exists
+    if [[ -f "demo.env" ]]; then
+        print_success "demo.env exists"
+    else
+        print_error "demo.env not found"
+        env_failed=1
+    fi
+    
+    # Check if docker-compose.yml.template exists
+    if [[ -f "docker-compose.yml.template" ]]; then
+        print_success "docker-compose.yml.template exists"
+    else
+        print_error "docker-compose.yml.template not found"
+        env_failed=1
+    fi
+    
+    # Check if required scripts exist
+    for script in demo-stack.sh demo-test.sh; do
+        if [[ -f "$script" ]]; then
+            print_success "$script exists"
+        else
+            print_error "$script not found"
+            env_failed=1
+        fi
+    done
+    
+    return $env_failed
+}
+
+# =============================================================================
+# SECURITY VALIDATION FUNCTIONS
+# =============================================================================
+
+validate_user_mapping() {
+    print_header "👤 USER MAPPING VALIDATION"
+    
+    # Get current user info
+    current_uid=$(id -u)
+    local current_uid
+    current_gid=$(id -g)
+    local current_gid
+    current_user=$(id -un)
+    local current_user
+    
+    print_info "Current user: $current_user (UID: $current_uid, GID: $current_gid)"
+    
+    # Check for root-owned files in project directory
+    root_files=$(find . -user root 2>/dev/null | wc -l)
+    local root_files
+    test_result "[[ $root_files -eq 0 ]]" "No root-owned files in project directory"
+    
+    # Verify demo scripts use current user
+    if [[ -f "demo-stack.sh" ]]; then
+        test_result "[[ -r \"demo-stack.sh\" ]]" "demo-stack.sh readable by current user"
+    fi
+    
+    # Check docker group access
+    user_groups=$(id -Gn 2>/dev/null | tr ' ' '\n' | grep -E '^docker$' || echo "")
+    local user_groups
+    
+    test_result "[[ -n \"$user_groups\" ]]" "Current user in docker group"
+}
+
+validate_docker_socket_security() {
+    print_header "🔒 DOCKER SOCKET SECURITY VALIDATION"
+    
+    # Check if docker-socket-proxy is running
+    proxy_running=$(docker compose ps -q docker-socket-proxy 2>/dev/null)
+    local proxy_running
+    test_result "[[ -n \"$proxy_running\" ]]" "Docker socket proxy running"
+    
+    if [[ -n "$proxy_running" ]]; then
+        # Check if proxy container has proper restrictions
+        proxy_container="${COMPOSE_PROJECT_NAME}-docker-socket-proxy"
+        test_result=$(docker exec "$proxy_container" curl -s -o /dev/null -w "%{http_code}" http://localhost:2375/containers/json 2>/dev/null || echo "000")
+        local test_result
+        test_result "[[ \"$test_result\" == \"403\" ]]" "Docker socket proxy security restrictions"
+        
+        # Check if any service has direct docker socket access
+        exposed_socket=$(docker compose ps --format "{{.Ports}}" portainer 2>/dev/null | grep -o "/var/run/docker.sock" || echo "")
+        local exposed_socket
+        test_result "[[ -z \"$exposed_socket\" ]]" "Docker socket not directly exposed"
+    fi
+}
+
+validate_network_isolation() {
+    print_header "🌐 NETWORK ISOLATION VALIDATION"
+    
+    # Check if demo network exists
+    network_exists=$(docker network ls -q -f name="${COMPOSE_NETWORK_NAME}" 2>/dev/null)
+    local network_exists
+    test_result "[[ -n \"$network_exists\" ]]" "Demo network exists"
+    
+    if [[ -n "$network_exists" ]]; then
+        # Check network driver
+        network_driver=$(docker network inspect "${COMPOSE_NETWORK_NAME}" -f '{{.Driver}}' 2>/dev/null)
+        local network_driver
+        test_result "[[ \"$network_driver\" == \"bridge\" ]]" "Network isolation (bridge driver)"
+    fi
+}
+
+# =============================================================================
+# HEALTH CHECK FUNCTIONS
+# =============================================================================
+
+check_service_health() {
+    local service_name="$1"
+    local url="$2"
+    
+    print_info "Checking $service_name health..."
+    
+    http_code=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 "$url" 2>/dev/null || echo "000")
+    local http_code
+    
+    if [[ "$http_code" =~ ^[23] ]]; then
+        print_success "$service_name is healthy (HTTP $http_code)"
+        return 0
+    else
+        print_error "$service_name is unhealthy (HTTP $http_code)"
+        return 1
+    fi
+}
+
+validate_service_health() {
+    print_header "🏥 SERVICE HEALTH VALIDATION"
+    
+    local health_failed=0
+    
+    # Load environment variables
+    # shellcheck source=demo.env
+    if [[ -f "demo.env" ]]; then
+        set -a
+        source demo.env
+        set +a
+    fi
+    
+    # Check core services
+    if check_service_health "Homepage" "http://localhost:${HOMEPAGE_PORT}/"; then
+        : # Homepage is healthy
+    else
+        health_failed=1
+    fi
+    
+    # Check other services if ports are defined
+    if [[ -n "${GRAFANA_PORT:-}" ]]; then
+        check_service_health "Grafana" "http://localhost:${GRAFANA_PORT}/" || health_failed=1
+    fi
+    
+    if [[ -n "${PORTAINER_PORT:-}" ]]; then
+        check_service_health "Portainer" "http://localhost:${PORTAINER_PORT}/" || health_failed=1
+    fi
+    
+    return $health_failed
+}
+
+# =============================================================================
+# DEMO CONFIGURATION VALIDATION
+# =============================================================================
+
+validate_demo_configuration() {
+    print_header "🎯 DEMO CONFIGURATION VALIDATION"
+    
+    # Load environment variables
+    # shellcheck source=demo.env
+    if [[ -f "demo.env" ]]; then
+        set -a
+        source demo.env
+        set +a
+    fi
+    
+    # Check demo credentials
+    test_result "[[ \"$GRAFANA_ADMIN_PASSWORD\" == \"demo_password\" ]]" "Grafana demo credentials"
+    test_result "[[ \"$ATOMIC_TRACKER_USE_DUMMY_DATA\" == \"1\" ]]" "Atomic Tracker demo configuration"
+    
+    # Check project naming
+    test_result "[[ \"$COMPOSE_PROJECT_NAME\" == \"tsysdevstack-supportstack-demo\" ]]" "Project naming convention"
+    
+    # Check port ranges
+    if [[ -n "${HOMEPAGE_PORT:-}" ]]; then
+        test_result "[[ $HOMEPAGE_PORT -ge 4000 && $HOMEPAGE_PORT -le 4099 ]]" "Homepage port in allowed range (4000-4099)"
+    fi
+}
+
+# =============================================================================
+# PERFORMANCE VALIDATION
+# =============================================================================
+
+validate_performance() {
+    print_header "📊 PERFORMANCE VALIDATION"
+    
+    # Check resource usage
+    print_info "Checking resource usage..."
+    
+    # Get memory usage
+    memory_usage=$(docker stats --no-stream --format "table {{.Container}}\t{{.MemUsage}}" 2>/dev/null | grep -E "(homepage|pihole|portainer|influxdb|grafana)" | awk '{sum+=$2} END {print sum}' || echo "0")
+    local memory_usage
+    
+    # Get container count
+    container_count=$(docker compose ps -q 2>/dev/null | wc -l)
+    local container_count
+    
+    print_info "Memory usage: ${memory_usage}B"
+    print_info "Container count: $container_count"
+    
+    # Performance thresholds
+    test_result "[[ $container_count -le 10 ]]" "Container count within limits (≤10)"
+    test_result "[[ ${memory_usage%.*} -le 1048576 ]]" "Memory usage within limits (≤1GB)"
+}
+
+# =============================================================================
+# MAIN EXECUTION
+# =============================================================================
+
+show_usage() {
+    echo "Usage: $0 [full|security|permissions|network|health|qa]"
+    echo ""
+    echo "Options:"
+    echo "  full       - Run all validations"
+    echo "  security   - Security validation only"
+    echo "  permissions- File permissions validation only"
+    echo "  network    - Network isolation validation only"
+    echo "  health     - Service health checks only"
+    echo "  qa         - QA tools validation only"
+    echo ""
+    echo "Examples:"
+    echo "  $0 full      # Run complete validation"
+    echo "  $0 security   # Security checks only"
+    echo "  $0 qa         # QA tools only"
+}
+
+run_qa_validation() {
+    print_header "🔍 COMPREHENSIVE QA VALIDATION"
+    print_info "Running all QA checks using Docker containers only..."
+    
+    local overall_failed=0
+    
+    # Run all QA validations
+    validate_environment || overall_failed=1
+    run_shellcheck || overall_failed=1
+    run_yamllint || overall_failed=1
+    run_proselint || overall_failed=1
+    run_vale || overall_failed=1
+    run_hadolint || overall_failed=1
+    check_image_versions || overall_failed=1
+    check_file_permissions || overall_failed=1
+    
+    # Final result
+    print_header "📋 QA SUMMARY"
+    
+    if [[ $overall_failed -eq 0 ]]; then
+        print_success "All QA checks passed! ✨"
+        echo -e "\n${GREEN}The project is ready for deployment.${NC}"
+    else
+        print_error "Some QA checks failed. Please fix issues above."
+        echo -e "\n${RED}The project is not ready for deployment.${NC}"
+    fi
+    
+    return $overall_failed
+}
+
+main() {
+    case "${1:-full}" in
+        "full")
+            print_header "🚀 COMPREHENSIVE DEMO STACK VALIDATION"
+            validate_environment
+            run_qa_validation
+            validate_user_mapping
+            validate_docker_socket_security
+            validate_network_isolation
+            validate_service_health
+            validate_demo_configuration
+            validate_performance
+            
+            print_header "📋 FINAL SUMMARY"
+            echo -e "${BLUE}Total Tests:${NC} $TOTAL_TESTS"
+            echo -e "${GREEN}Passed:${NC} $PASSED_TESTS"
+            echo -e "${RED}Failed:${NC} $FAILED_TESTS"
+            
+            if [[ $FAILED_TESTS -eq 0 ]]; then
+                echo -e "\n${GREEN}🎉 All validations passed! The demo stack is ready.${NC}"
+                exit 0
+            else
+                echo -e "\n${RED}❌ Some validations failed. Please review the issues above.${NC}"
+                exit 1
+            fi
+            ;;
+        "security")
+            validate_user_mapping
+            validate_docker_socket_security
+            validate_network_isolation
+            ;;
+        "permissions")
+            validate_user_mapping
+            check_file_permissions
+            ;;
+        "network")
+            validate_network_isolation
+            ;;
+        "health")
+            validate_service_health
+            ;;
+        "qa")
+            run_qa_validation
+            ;;
+        "help"|"-h"|"--help")
+            show_usage
+            exit 0
+            ;;
+        *)
+            echo -e "${RED}Error: Unknown option '$1'${NC}"
+            echo ""
+            show_usage
+            exit 1
+            ;;
+    esac
+}
+
+# Run main function with all arguments
+main "$@"
--- a/SupportStack/demo/demo.env
+++ b/SupportStack/demo/demo.env
@@ -0,0 +1,181 @@
+# =============================================================================
+# TSYS Developer Support Stack - Demo Environment Variables
+# =============================================================================
+# This file contains all configuration variables for the demo stack
+# These values are used by demo-stack.sh and docker-compose.yml.template
+# =============================================================================
+
+# =============================================================================
+# PROJECT CONFIGURATION
+# =============================================================================
+
+# Project naming - MUST use tsysdevstack-supportstack-demo prefix everywhere
+COMPOSE_PROJECT_NAME=tsysdevstack-supportstack-demo
+COMPOSE_NETWORK_NAME=tsysdevstack-supportstack-demo-network
+
+# =============================================================================
+# DYNAMIC USER DETECTION (auto-populated by demo-stack.sh)
+# =============================================================================
+
+# These will be automatically detected and set by demo-stack.sh
+# UID=1000
+# GID=1000
+# DOCKER_GID=972
+
+# =============================================================================
+# SERVICE PORT ASSIGNMENTS (4000-4099 range)
+# =============================================================================
+
+# Developer Tools
+HOMEPAGE_PORT=4000
+ATOMIC_TRACKER_PORT=4012
+WAKAPI_PORT=4015
+MAILHOG_SMTP_PORT=4016
+MAILHOG_WEB_PORT=4017
+ATUIN_PORT=4018
+
+# Archival & Content Management
+ARCHIVEBOX_PORT=4013
+TUBE_ARCHIVIST_PORT=4014
+
+# Infrastructure Services
+PIHOLE_PORT=4006
+PORTAINER_PORT=4007
+
+# Monitoring & Observability
+INFLUXDB_PORT=4008
+GRAFANA_PORT=4009
+
+# Documentation & Diagramming
+DRAWIO_PORT=4010
+KROKI_PORT=4011
+
+# =============================================================================
+# DEMO CREDENTIALS (for demonstration purposes only)
+# =============================================================================
+
+# Grafana
+GRAFANA_ADMIN_USER=admin
+GRAFANA_ADMIN_PASSWORD=demo_password
+
+# Portainer
+PORTAINER_ADMIN_USER=admin
+PORTAINER_ADMIN_PASSWORD=demo_password
+
+# Pi-hole
+PIHOLE_WEBPASSWORD=demo_password
+
+# =============================================================================
+# SERVICE CONFIGURATION
+# =============================================================================
+
+# Timezone
+TZ=UTC
+
+# InfluxDB Configuration
+INFLUXDB_USERNAME=demo_user
+INFLUXDB_PASSWORD=demo_password
+INFLUXDB_ORG=demo_org
+INFLUXDB_BUCKET=demo_bucket
+
+# Atomic Tracker Configuration
+ATOMIC_TRACKER_CONFIG_DIR=/config
+ATOMIC_TRACKER_LISTENING_PORT=8080
+ATOMIC_TRACKER_BYPASS_LOGIN=1
+ATOMIC_TRACKER_USE_DUMMY_DATA=1
+
+# Wakapi Configuration
+WAKAPI_DATA_DIR=/data
+WAKAPI_DB_TYPE=sqlite3
+WAKAPI_DB_PATH=/data/wakapi.db
+WAKAPI_PASSWORD_SALT=demo_salt_only
+WAKAPI_INSECURE_COOKIES=true
+WAKAPI_ENVIRONMENT=production
+
+# MailHog Configuration
+MAILHOG_SMTP_BIND_ADDR=0.0.0.0:1025
+MAILHOG_WEB_BIND_ADDR=0.0.0.0:8025
+MAILHOG_STORAGE=memory
+
+# Atuin Configuration
+ATUIN_DB_USERNAME=atuin
+ATUIN_DB_PASSWORD=demo_atuin_password
+ATUIN_DB_NAME=atuin
+
+# ArchiveBox Configuration
+ARCHIVEBOX_DATA_DIR=/data
+
+# Tube Archivist Configuration
+TUBE_ARCHIVIST_MEDIA_DIR=/youtube
+TUBE_ARCHIVIST_CACHE_DIR=/cache
+TUBE_ARCHIVIST_ELASTICSEARCH_URL=http://elasticsearch:9200
+TUBE_ARCHIVIST_REDIS_URL=redis://redis:6379
+
+# Elasticsearch Configuration
+ELASTICSEARCH_DISCOVERY_TYPE=single-node
+ELASTICSEARCH_SECURITY_ENABLED=false
+ELASTICSEARCH_JAVA_OPTS="-Xms512m -Xmx512m"
+
+# Redis Configuration
+REDIS_DATA_DIR=/data
+
+# =============================================================================
+# DOCKER SOCKET PROXY CONFIGURATION
+# =============================================================================
+
+# Security permissions (0=disabled, 1=enabled)
+# Only essential permissions enabled for demo
+PROXY_CONTAINERS=1
+PROXY_POST=0
+PROXY_PUT=0
+PROXY_DELETE=0
+PROXY_BUILD=0
+PROXY_COMMIT=0
+PROXY_CONFIGS=0
+PROXY_EXEC=0
+PROXY_GRPC=0
+PROXY_IMAGES=0
+PROXY_INFO=0
+PROXY_NETWORKS=0
+PROXY_NODES=0
+PROXY_PLUGINS=0
+PROXY_SECRETS=0
+PROXY_SERVICES=0
+PROXY_SESSION=0
+PROXY_SWARM=0
+PROXY_SYSTEM=0
+PROXY_TASKS=0
+PROXY_VOLUMES=1
+
+# =============================================================================
+# SECURITY SETTINGS
+# =============================================================================
+
+# Docker group access (auto-detected by demo-stack.sh)
+# DOCKER_GID=972
+
+# =============================================================================
+# DEVELOPMENT SETTINGS
+# =============================================================================
+
+# Enable debug mode for troubleshooting
+DEBUG_MODE=false
+
+# Log level for services
+LOG_LEVEL=info
+
+# =============================================================================
+# PRODUCTION MIGRATION NOTES
+# =============================================================================
+#
+# ⚠️  DEMO CONFIGURATION ONLY - DO NOT USE IN PRODUCTION ⚠️
+#
+# Before production deployment:
+# 1. Change all default passwords above
+# 2. Replace demo credentials with secure ones
+# 3. Enable persistent data storage
+# 4. Add encryption and security hardening
+# 5. Configure backup and recovery
+# 6. Set up monitoring and alerting
+# 7. Review and update all security settings
+# =============================================================================
--- a/SupportStack/demo/docker-compose.yml
+++ b/SupportStack/demo/docker-compose.yml
@@ -0,0 +1,511 @@
+---
+# =============================================================================
+# This template uses environment variables for dynamic configuration
+# Generate docker-compose.yml with: envsubst < docker-compose.yml.template > docker-compose.yml
+# =============================================================================
+
+services:
+  # =============================================================================
+  # INFRASTRUCTURE SERVICES
+  # =============================================================================
+
+  homepage:
+    image: ghcr.io/gethomepage/homepage:v0.9.13
+    user: "1000:1000"
+    container_name: "tsysdevstack-supportstack-demo-homepage"
+    restart: unless-stopped
+    networks:
+      - tsysdevstack-supportstack-demo-network
+    volumes:
+      - "tsysdevstack-supportstack-demo_homepage_config:/app/config"
+      - "tsysdevstack-supportstack-demo_homepage_images:/app/public/images"
+    ports:
+      - "4000:3000"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=UTC
+      - ADMIN_USERNAME=admin
+      - ADMIN_PASSWORD=admin
+    labels:
+      com.docker.compose.project: "tsysdevstack-supportstack-demo"
+
+  docker-socket-proxy:
+    image: tecnativa/docker-socket-proxy:0.3.0
+    container_name: "tsysdevstack-supportstack-demo-docker-socket-proxy"
+    group_add:
+      - "996"
+    restart: unless-stopped
+    networks:
+      - tsysdevstack-supportstack-demo-network
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      - CONTAINERS=1
+      - POST=0
+      - PUT=0
+      - DELETE=0
+      - BUILD=0
+      - COMMIT=0
+      - CONFIGS=0
+      - EXEC=0
+      - IMAGES=1
+      - INFO=1
+      - NETWORKS=1
+      - PLUGINS=1
+      - SECRETS=0
+      - SERVICES=1
+      - SESSION=1
+      - SWARM=0
+      - SYSTEM=1
+      - TASKS=1
+      - VOLUMES=1
+    labels:
+      com.docker.compose.project: "tsysdevstack-supportstack-demo"
+
+  pihole:
+    image: pihole/pihole:2024.07.0
+    container_name: "tsysdevstack-supportstack-demo-pihole"
+    restart: unless-stopped
+    networks:
+      - tsysdevstack-supportstack-demo-network
+    volumes:
+      - "tsysdevstack-supportstack-demo_pihole_etc:/etc/pihole"
+      - "tsysdevstack-supportstack-demo_pihole_dnsmasq:/etc/dnsmasq.d"
+    ports:
+      - "4006:80"
+      - "53:53/tcp"
+      - "53:53/udp"
+      - "67:67/udp"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=UTC
+      - WEBPASSWORD=demo_password
+      - PIHOLE_DNS_=1.1.1.1;1.0.0.1;8.8.8.8
+      - WEBTHEME=light-darker
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:80/admin"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      homepage.group: "Infrastructure"
+      homepage.name: "Pi-hole"
+      homepage.icon: "pihole.png"
+      homepage.href: "http://192.168.3.6:4006/admin"
+      homepage.description: "DNS-based ad blocking and network monitoring"
+
+  portainer:
+    image: portainer/portainer-ce:2.21.4
+    user: "1000:1000"
+    container_name: "tsysdevstack-supportstack-demo-portainer"
+    restart: unless-stopped
+    networks:
+      - tsysdevstack-supportstack-demo-network
+    volumes:
+      - "tsysdevstack-supportstack-demo_portainer_data:/data"
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    ports:
+      - "4007:9000"
+    environment:
+      - PUID=1000
+      - PGID=1000
+    labels:
+      homepage.group: "Infrastructure"
+      homepage.name: "Portainer"
+      homepage.icon: "portainer.png"
+      homepage.href: "http://192.168.3.6:4007"
+      homepage.description: "Web-based Docker container management"
+
+  # =============================================================================
+  # MONITORING & OBSERVABILITY
+  # =============================================================================
+
+  influxdb:
+    image: influxdb:2.7.10
+    container_name: "tsysdevstack-supportstack-demo-influxdb"
+    restart: unless-stopped
+    networks:
+      - tsysdevstack-supportstack-demo-network
+    volumes:
+      - "tsysdevstack-supportstack-demo_influxdb_data:/var/lib/influxdb"
+    ports:
+      - "4008:8086"
+    environment:
+      - DOCKER_INFLUXDB_INIT_MODE=setup
+      - DOCKER_INFLUXDB_INIT_USERNAME=demo_user
+      - DOCKER_INFLUXDB_INIT_PASSWORD=demo_password
+      - DOCKER_INFLUXDB_INIT_ORG=demo_org
+      - DOCKER_INFLUXDB_INIT_BUCKET=demo_bucket
+      - DOCKER_INFLUXDB_INIT_ADMIN_TOKEN=demo_token
+      - DOCKER_INFLUXDB_INIT_ADMIN_TOKEN=demo_token
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8086/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      homepage.group: "Monitoring"
+      homepage.name: "InfluxDB"
+      homepage.icon: "influxdb.png"
+      homepage.href: "http://192.168.3.6:4008"
+      homepage.description: "Time series database for metrics"
+
+  grafana:
+    image: grafana/grafana:10.4.2
+    user: "1000:1000"
+    container_name: "tsysdevstack-supportstack-demo-grafana"
+    restart: unless-stopped
+    networks:
+      - tsysdevstack-supportstack-demo-network
+    volumes:
+      - "tsysdevstack-supportstack-demo_grafana_data:/var/lib/grafana"
+    ports:
+      - "4009:3000"
+    environment:
+      - GF_SECURITY_ADMIN_USER=admin
+      - GF_SECURITY_ADMIN_PASSWORD=demo_password
+      - GF_INSTALL_PLUGINS=grafana-clock-panel,grafana-simple-json-datasource
+      - GF_INSTALL_PLUGINS=grafana-influxdb-flux-datasource
+    labels:
+      homepage.group: "Monitoring"
+      homepage.name: "Grafana"
+      homepage.icon: "grafana.png"
+      homepage.href: "http://192.168.3.6:4009"
+      homepage.description: "Analytics and visualization platform"
+
+  # =============================================================================
+  # DOCUMENTATION & DIAGRAMMING
+  # =============================================================================
+
+  drawio:
+    image: jgraph/drawio:24.7.17
+    user: "1000:1000"
+    container_name: "tsysdevstack-supportstack-demo-drawio"
+    restart: unless-stopped
+    networks:
+      - tsysdevstack-supportstack-demo-network
+    ports:
+      - "4010:8080"
+    environment:
+      - PUID=1000
+      - PGID=1000
+    labels:
+      homepage.group: "Documentation"
+      homepage.name: "Draw.io"
+      homepage.icon: "drawio.png"
+      homepage.href: "http://192.168.3.6:4010"
+      homepage.description: "Web-based diagramming application"
+
+  kroki:
+    image: yuzutech/kroki:0.25.0
+    user: "1000:1000"
+    container_name: "tsysdevstack-supportstack-demo-kroki"
+    restart: unless-stopped
+    networks:
+      - tsysdevstack-supportstack-demo-network
+    ports:
+      - "4011:8000"
+    environment:
+      - KROKI_SAFE_MODE=secure
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      homepage.group: "Documentation"
+      homepage.name: "Kroki"
+      homepage.icon: "kroki.png"
+      homepage.href: "http://192.168.3.6:4011"
+      homepage.description: "Diagrams as a service"
+
+  # =============================================================================
+  # DEVELOPER TOOLS
+  # =============================================================================
+
+  atomic-tracker:
+    image: ghcr.io/majorpeter/atomic-tracker:v1.2.0
+    user: "1000:1000"
+    container_name: "tsysdevstack-supportstack-demo-atomic-tracker"
+    restart: unless-stopped
+    networks:
+      - tsysdevstack-supportstack-demo-network
+    volumes:
+      - "tsysdevstack-supportstack-demo_atomic_tracker_config:/config"
+    ports:
+      - "4012:8080"
+    environment:
+      - CONFIG_DIR=/config
+      - LISTENING_PORT=8080
+      - BYPASS_LOGIN=1
+      - USE_DUMMY_DATA=1
+    labels:
+      homepage.group: "Developer Tools"
+      homepage.name: "Atomic Tracker"
+      homepage.icon: "atomic-tracker.png"
+      homepage.href: "http://192.168.3.6:4012"
+      homepage.description: "Habit tracking and personal dashboard"
+
+  wakapi:
+    image: ghcr.io/muety/wakapi:v2.7.1
+    user: "1000:1000"
+    container_name: "tsysdevstack-supportstack-demo-wakapi"
+    restart: unless-stopped
+    networks:
+      - tsysdevstack-supportstack-demo-network
+    volumes:
+      - "tsysdevstack-supportstack-demo_wakapi_data:/data"
+    ports:
+      - "4015:3000"
+    environment:
+      - WAKAPI_DB_TYPE=sqlite3
+      - WAKAPI_DB_PATH=/data/wakapi.db
+      - WAKAPI_PASSWORD_SALT=demo_salt_only
+      - WAKAPI_INSECURE_COOKIES=true
+      - WAKAPI_ENVIRONMENT=production
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/api/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      homepage.group: "Developer Tools"
+      homepage.name: "Wakapi"
+      homepage.icon: "wakapi.png"
+      homepage.href: "http://192.168.3.6:4015"
+      homepage.description: "Open-source WakaTime alternative for time tracking"
+
+  mailhog:
+    image: mailhog/mailhog:v1.0.0
+    container_name: "tsysdevstack-supportstack-demo-mailhog"
+    restart: unless-stopped
+    networks:
+      - tsysdevstack-supportstack-demo-network
+    ports:
+      - "4016:1025"
+      - "4017:8025"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - MH_SMTP_BIND_ADDR=0.0.0.0:1025
+      - MH_UI_BIND_ADDR=0.0.0.0:8025
+      - MH_STORAGE=memory
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-s", "http://localhost:8025"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      homepage.group: "Developer Tools"
+      homepage.name: "MailHog"
+      homepage.icon: "mailhog.png"
+      homepage.href: "http://192.168.3.6:4017"
+      homepage.description: "Web and API based SMTP testing tool"
+
+  atuin:
+    image: ghcr.io/atuinsh/atuin:v18.10.0
+    command: server start
+    user: "1000:1000"
+    container_name: "tsysdevstack-supportstack-demo-atuin"
+    restart: unless-stopped
+    networks:
+      - tsysdevstack-supportstack-demo-network
+    volumes:
+      - "tsysdevstack-supportstack-demo_atuin_config:/config"
+    ports:
+      - "4018:8888"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - ATUIN_HOST=0.0.0.0
+      - ATUIN_PORT=8888
+      - ATUIN_OPEN_REGISTRATION=true
+      - ATUIN_DB_URI=postgres://atuin:demo_atuin_password@atuin-db:5432/atuin
+      - RUST_LOG=info,atuin_server=debug
+    depends_on:
+      - atuin-db
+    healthcheck:
+      test: ["CMD-SHELL", "test -f /proc/net/tcp && grep -q ':2288' /proc/net/tcp"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      homepage.group: "Developer Tools"
+      homepage.name: "Atuin"
+      homepage.icon: "atuin.png"
+      homepage.href: "http://192.168.3.6:4018"
+      homepage.description: "Magical shell history synchronization"
+
+  atuin-db:
+    image: postgres:14
+    container_name: "tsysdevstack-supportstack-demo-atuin-db"
+    restart: unless-stopped
+    networks:
+      - tsysdevstack-supportstack-demo-network
+    volumes:
+      - "tsysdevstack-supportstack-demo_atuin_db_data:/var/lib/postgresql/data"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - POSTGRES_USER=atuin
+      - POSTGRES_PASSWORD=demo_atuin_password
+      - POSTGRES_DB=atuin
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U atuin -d atuin"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      com.docker.compose.project: "tsysdevstack-supportstack-demo"
+
+  # =============================================================================
+  # ARCHIVAL & CONTENT MANAGEMENT
+  # =============================================================================
+
+  archivebox:
+    image: archivebox/archivebox:v0.7.3
+    container_name: "tsysdevstack-supportstack-demo-archivebox"
+    restart: unless-stopped
+    networks:
+      - tsysdevstack-supportstack-demo-network
+    volumes:
+      - "tsysdevstack-supportstack-demo_archivebox_data:/data"
+    ports:
+      - "4013:8000"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=UTC
+    labels:
+      homepage.group: "Archival"
+      homepage.name: "ArchiveBox"
+      homepage.icon: "archivebox.png"
+      homepage.href: "http://192.168.3.6:4013"
+      homepage.description: "Self-hosted internet archiving solution"
+
+  tube-archivist:
+    image: bbilly1/tubearchivist:v0.5.8
+    container_name: "tsysdevstack-supportstack-demo-tube-archivist"
+    restart: unless-stopped
+    networks:
+      - tsysdevstack-supportstack-demo-network
+    volumes:
+      - "tsysdevstack-supportstack-demo_tube_archivist_media:/youtube"
+      - "tsysdevstack-supportstack-demo_tube_archivist_data:/cache"
+    ports:
+      - "4014:8000"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - TZ=UTC
+      - ELASTICSEARCH_URL=http://elasticsearch:9200
+      - REDIS_URL=redis://redis:6379
+      - TA_USERNAME=tubearchivist
+      - TA_PASSWORD=tubearchivist
+      - TA_HOST=http://192.168.3.6:4014
+      - ELASTIC_PASSWORD=changeme
+      - TA_ENABLE_AUTH_PROXY=false
+      - HOST_UID=1000
+      - HOST_GID=1000
+    depends_on:
+      - elasticsearch
+      - redis
+    labels:
+      homepage.group: "Archival"
+      homepage.name: "Tube Archivist"
+      homepage.icon: "tube-archivist.png"
+      homepage.href: "http://192.168.3.6:4014"
+      homepage.description: "YouTube media archiving and management"
+
+  elasticsearch:
+    image: docker.elastic.co/elasticsearch/elasticsearch:8.11.0
+    user: "1000:1000"
+    container_name: "tsysdevstack-supportstack-demo-elasticsearch"
+    restart: unless-stopped
+    networks:
+      - tsysdevstack-supportstack-demo-network
+    volumes:
+      - "tsysdevstack-supportstack-demo_elasticsearch_data:/usr/share/elasticsearch/data"
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - discovery.type=single-node
+      - xpack.security.enabled=false
+      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
+      - ELASTIC_PASSWORD=changeme
+    labels:
+      com.docker.compose.project: "tsysdevstack-supportstack-demo"
+
+  redis:
+    image: redis:7.2-alpine
+    user: "1000:1000"
+    container_name: "tsysdevstack-supportstack-demo-redis"
+    restart: unless-stopped
+    networks:
+      - tsysdevstack-supportstack-demo-network
+    volumes:
+      - "tsysdevstack-supportstack-demo_redis_data:/data"
+    environment:
+      - PUID=1000
+      - PGID=1000
+    labels:
+      com.docker.compose.project: "tsysdevstack-supportstack-demo"
+
+# =============================================================================
+# NETWORKS
+# =============================================================================
+
+networks:
+  tsysdevstack-supportstack-demo-network:
+    driver: bridge
+    name: tsysdevstack-supportstack-demo-network
+
+
+# =============================================================================
+# VOLUMES
+# =============================================================================
+
+volumes:
+  tsysdevstack-supportstack-demo_homepage_config:
+    driver: local
+  tsysdevstack-supportstack-demo_homepage_images:
+    driver: local
+  tsysdevstack-supportstack-demo_pihole_etc:
+    driver: local
+  tsysdevstack-supportstack-demo_pihole_dnsmasq:
+    driver: local
+  tsysdevstack-supportstack-demo_portainer_data:
+    driver: local
+  tsysdevstack-supportstack-demo_influxdb_data:
+    driver: local
+  tsysdevstack-supportstack-demo_grafana_data:
+    driver: local
+  tsysdevstack-supportstack-demo_atomic_tracker_config:
+    driver: local
+  tsysdevstack-supportstack-demo_wakapi_data:
+    driver: local
+  tsysdevstack-supportstack-demo_mailhog_data:
+    driver: local
+  tsysdevstack-supportstack-demo_archivebox_data:
+    driver: local
+  tsysdevstack-supportstack-demo_tube_archivist_media:
+    driver: local
+  tsysdevstack-supportstack-demo_tube_archivist_data:
+    driver: local
+  tsysdevstack-supportstack-demo_elasticsearch_data:
+    driver: local
+  tsysdevstack-supportstack-demo_redis_data:
+    driver: local
+  tsysdevstack-supportstack-demo_atuin_config:
+    driver: local
+  tsysdevstack-supportstack-demo_atuin_db_data:
+    driver: local
--- a/SupportStack/demo/docker-compose.yml.template
+++ b/SupportStack/demo/docker-compose.yml.template
@@ -0,0 +1,511 @@
+---
+# =============================================================================
+# This template uses environment variables for dynamic configuration
+# Generate docker-compose.yml with: envsubst < docker-compose.yml.template > docker-compose.yml
+# =============================================================================
+
+services:
+  # =============================================================================
+  # INFRASTRUCTURE SERVICES
+  # =============================================================================
+
+  homepage:
+    image: ghcr.io/gethomepage/homepage:v0.9.13
+    user: "${APP_UID}:${APP_GID}"
+    container_name: "${COMPOSE_PROJECT_NAME}-homepage"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    volumes:
+      - "${COMPOSE_PROJECT_NAME}_homepage_config:/app/config"
+      - "${COMPOSE_PROJECT_NAME}_homepage_images:/app/public/images"
+    ports:
+      - "${HOMEPAGE_PORT}:3000"
+    environment:
+      - PUID=${APP_UID}
+      - PGID=${APP_GID}
+      - TZ=UTC
+      - ADMIN_USERNAME=admin
+      - ADMIN_PASSWORD=admin
+    labels:
+      com.docker.compose.project: "tsysdevstack-supportstack-demo"
+
+  docker-socket-proxy:
+    image: tecnativa/docker-socket-proxy:0.3.0
+    container_name: "${COMPOSE_PROJECT_NAME}-docker-socket-proxy"
+    group_add:
+      - "${DOCKER_GID}"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      - CONTAINERS=1
+      - POST=0
+      - PUT=0
+      - DELETE=0
+      - BUILD=0
+      - COMMIT=0
+      - CONFIGS=0
+      - EXEC=0
+      - IMAGES=1
+      - INFO=1
+      - NETWORKS=1
+      - PLUGINS=1
+      - SECRETS=0
+      - SERVICES=1
+      - SESSION=1
+      - SWARM=0
+      - SYSTEM=1
+      - TASKS=1
+      - VOLUMES=1
+    labels:
+      com.docker.compose.project: "tsysdevstack-supportstack-demo"
+
+  pihole:
+    image: pihole/pihole:2024.07.0
+    container_name: "${COMPOSE_PROJECT_NAME}-pihole"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    volumes:
+      - "${COMPOSE_PROJECT_NAME}_pihole_etc:/etc/pihole"
+      - "${COMPOSE_PROJECT_NAME}_pihole_dnsmasq:/etc/dnsmasq.d"
+    ports:
+      - "${PIHOLE_PORT}:80"
+      - "53:53/tcp"
+      - "53:53/udp"
+      - "67:67/udp"
+    environment:
+      - PUID=${APP_UID}
+      - PGID=${APP_GID}
+      - TZ=UTC
+      - WEBPASSWORD=demo_password
+      - PIHOLE_DNS_=1.1.1.1;1.0.0.1;8.8.8.8
+      - WEBTHEME=light-darker
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:80/admin"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      homepage.group: "Infrastructure"
+      homepage.name: "Pi-hole"
+      homepage.icon: "pihole.png"
+      homepage.href: "http://192.168.3.6:${PIHOLE_PORT}/admin"
+      homepage.description: "DNS-based ad blocking and network monitoring"
+
+  portainer:
+    image: portainer/portainer-ce:2.21.4
+    user: "${APP_UID}:${APP_GID}"
+    container_name: "${COMPOSE_PROJECT_NAME}-portainer"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    volumes:
+      - "${COMPOSE_PROJECT_NAME}_portainer_data:/data"
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    ports:
+      - "${PORTAINER_PORT}:9000"
+    environment:
+      - PUID=${APP_UID}
+      - PGID=${APP_GID}
+    labels:
+      homepage.group: "Infrastructure"
+      homepage.name: "Portainer"
+      homepage.icon: "portainer.png"
+      homepage.href: "http://192.168.3.6:${PORTAINER_PORT}"
+      homepage.description: "Web-based Docker container management"
+
+  # =============================================================================
+  # MONITORING & OBSERVABILITY
+  # =============================================================================
+
+  influxdb:
+    image: influxdb:2.7.10
+    container_name: "${COMPOSE_PROJECT_NAME}-influxdb"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    volumes:
+      - "${COMPOSE_PROJECT_NAME}_influxdb_data:/var/lib/influxdb"
+    ports:
+      - "${INFLUXDB_PORT}:8086"
+    environment:
+      - DOCKER_INFLUXDB_INIT_MODE=setup
+      - DOCKER_INFLUXDB_INIT_USERNAME=demo_user
+      - DOCKER_INFLUXDB_INIT_PASSWORD=demo_password
+      - DOCKER_INFLUXDB_INIT_ORG=demo_org
+      - DOCKER_INFLUXDB_INIT_BUCKET=demo_bucket
+      - DOCKER_INFLUXDB_INIT_ADMIN_TOKEN=demo_token
+      - DOCKER_INFLUXDB_INIT_ADMIN_TOKEN=demo_token
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8086/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      homepage.group: "Monitoring"
+      homepage.name: "InfluxDB"
+      homepage.icon: "influxdb.png"
+      homepage.href: "http://192.168.3.6:${INFLUXDB_PORT}"
+      homepage.description: "Time series database for metrics"
+
+  grafana:
+    image: grafana/grafana:10.4.2
+    user: "${APP_UID}:${APP_GID}"
+    container_name: "${COMPOSE_PROJECT_NAME}-grafana"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    volumes:
+      - "${COMPOSE_PROJECT_NAME}_grafana_data:/var/lib/grafana"
+    ports:
+      - "${GRAFANA_PORT}:3000"
+    environment:
+      - GF_SECURITY_ADMIN_USER=admin
+      - GF_SECURITY_ADMIN_PASSWORD=demo_password
+      - GF_INSTALL_PLUGINS=grafana-clock-panel,grafana-simple-json-datasource
+      - GF_INSTALL_PLUGINS=grafana-influxdb-flux-datasource
+    labels:
+      homepage.group: "Monitoring"
+      homepage.name: "Grafana"
+      homepage.icon: "grafana.png"
+      homepage.href: "http://192.168.3.6:${GRAFANA_PORT}"
+      homepage.description: "Analytics and visualization platform"
+
+  # =============================================================================
+  # DOCUMENTATION & DIAGRAMMING
+  # =============================================================================
+
+  drawio:
+    image: jgraph/drawio:24.7.17
+    user: "${APP_UID}:${APP_GID}"
+    container_name: "${COMPOSE_PROJECT_NAME}-drawio"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    ports:
+      - "${DRAWIO_PORT}:8080"
+    environment:
+      - PUID=${APP_UID}
+      - PGID=${APP_GID}
+    labels:
+      homepage.group: "Documentation"
+      homepage.name: "Draw.io"
+      homepage.icon: "drawio.png"
+      homepage.href: "http://192.168.3.6:${DRAWIO_PORT}"
+      homepage.description: "Web-based diagramming application"
+
+  kroki:
+    image: yuzutech/kroki:0.25.0
+    user: "${APP_UID}:${APP_GID}"
+    container_name: "${COMPOSE_PROJECT_NAME}-kroki"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    ports:
+      - "${KROKI_PORT}:8000"
+    environment:
+      - KROKI_SAFE_MODE=secure
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      homepage.group: "Documentation"
+      homepage.name: "Kroki"
+      homepage.icon: "kroki.png"
+      homepage.href: "http://192.168.3.6:${KROKI_PORT}"
+      homepage.description: "Diagrams as a service"
+
+  # =============================================================================
+  # DEVELOPER TOOLS
+  # =============================================================================
+
+  atomic-tracker:
+    image: ghcr.io/majorpeter/atomic-tracker:v1.2.0
+    user: "${APP_UID}:${APP_GID}"
+    container_name: "${COMPOSE_PROJECT_NAME}-atomic-tracker"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    volumes:
+      - "${COMPOSE_PROJECT_NAME}_atomic_tracker_config:/config"
+    ports:
+      - "${ATOMIC_TRACKER_PORT}:8080"
+    environment:
+      - CONFIG_DIR=/config
+      - LISTENING_PORT=8080
+      - BYPASS_LOGIN=1
+      - USE_DUMMY_DATA=1
+    labels:
+      homepage.group: "Developer Tools"
+      homepage.name: "Atomic Tracker"
+      homepage.icon: "atomic-tracker.png"
+      homepage.href: "http://192.168.3.6:${ATOMIC_TRACKER_PORT}"
+      homepage.description: "Habit tracking and personal dashboard"
+
+  wakapi:
+    image: ghcr.io/muety/wakapi:v2.7.1
+    user: "${APP_UID}:${APP_GID}"
+    container_name: "${COMPOSE_PROJECT_NAME}-wakapi"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    volumes:
+      - "${COMPOSE_PROJECT_NAME}_wakapi_data:/data"
+    ports:
+      - "${WAKAPI_PORT}:3000"
+    environment:
+      - WAKAPI_DB_TYPE=sqlite3
+      - WAKAPI_DB_PATH=/data/wakapi.db
+      - WAKAPI_PASSWORD_SALT=demo_salt_only
+      - WAKAPI_INSECURE_COOKIES=true
+      - WAKAPI_ENVIRONMENT=production
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/api/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      homepage.group: "Developer Tools"
+      homepage.name: "Wakapi"
+      homepage.icon: "wakapi.png"
+      homepage.href: "http://192.168.3.6:${WAKAPI_PORT}"
+      homepage.description: "Open-source WakaTime alternative for time tracking"
+
+  mailhog:
+    image: mailhog/mailhog:v1.0.0
+    container_name: "${COMPOSE_PROJECT_NAME}-mailhog"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    ports:
+      - "${MAILHOG_SMTP_PORT}:1025"
+      - "${MAILHOG_WEB_PORT}:8025"
+    environment:
+      - PUID=${APP_UID}
+      - PGID=${APP_GID}
+      - MH_SMTP_BIND_ADDR=0.0.0.0:1025
+      - MH_UI_BIND_ADDR=0.0.0.0:8025
+      - MH_STORAGE=memory
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-s", "http://localhost:8025"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      homepage.group: "Developer Tools"
+      homepage.name: "MailHog"
+      homepage.icon: "mailhog.png"
+      homepage.href: "http://192.168.3.6:${MAILHOG_WEB_PORT}"
+      homepage.description: "Web and API based SMTP testing tool"
+
+  atuin:
+    image: ghcr.io/atuinsh/atuin:v18.10.0
+    user: "${APP_UID}:${APP_GID}"
+    container_name: "${COMPOSE_PROJECT_NAME}-atuin"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    volumes:
+      - "${COMPOSE_PROJECT_NAME}_atuin_config:/config"
+    ports:
+      - "${ATUIN_PORT}:8888"
+    environment:
+      - PUID=${APP_UID}
+      - PGID=${APP_GID}
+      - ATUIN_HOST=0.0.0.0
+      - ATUIN_PORT=8888
+      - ATUIN_OPEN_REGISTRATION=true
+      - ATUIN_DB_URI=postgres://${ATUIN_DB_USERNAME}:${ATUIN_DB_PASSWORD}@atuin-db:5432/${ATUIN_DB_NAME}
+      - RUST_LOG=info,atuin_server=debug
+    depends_on:
+      - atuin-db
+    command: server start
+    healthcheck:
+      test: ["CMD-SHELL", "test -f /proc/net/tcp && grep -q ':2288' /proc/net/tcp"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      homepage.group: "Developer Tools"
+      homepage.name: "Atuin"
+      homepage.icon: "atuin.png"
+      homepage.href: "http://192.168.3.6:${ATUIN_PORT}"
+      homepage.description: "Magical shell history synchronization"
+
+  atuin-db:
+    image: postgres:14
+    container_name: "${COMPOSE_PROJECT_NAME}-atuin-db"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    volumes:
+      - "${COMPOSE_PROJECT_NAME}_atuin_db_data:/var/lib/postgresql/data"
+    environment:
+      - PUID=${APP_UID}
+      - PGID=${APP_GID}
+      - POSTGRES_USER=${ATUIN_DB_USERNAME}
+      - POSTGRES_PASSWORD=${ATUIN_DB_PASSWORD}
+      - POSTGRES_DB=${ATUIN_DB_NAME}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${ATUIN_DB_USERNAME} -d ${ATUIN_DB_NAME}"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    labels:
+      com.docker.compose.project: "tsysdevstack-supportstack-demo"
+
+  # =============================================================================
+  # ARCHIVAL & CONTENT MANAGEMENT
+  # =============================================================================
+
+  archivebox:
+    image: archivebox/archivebox:v0.7.3
+    container_name: "${COMPOSE_PROJECT_NAME}-archivebox"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    volumes:
+      - "${COMPOSE_PROJECT_NAME}_archivebox_data:/data"
+    ports:
+      - "${ARCHIVEBOX_PORT}:8000"
+    environment:
+      - PUID=${APP_UID}
+      - PGID=${APP_GID}
+      - TZ=UTC
+    labels:
+      homepage.group: "Archival"
+      homepage.name: "ArchiveBox"
+      homepage.icon: "archivebox.png"
+      homepage.href: "http://192.168.3.6:${ARCHIVEBOX_PORT}"
+      homepage.description: "Self-hosted internet archiving solution"
+
+  tube-archivist:
+    image: bbilly1/tubearchivist:v0.5.8
+    container_name: "${COMPOSE_PROJECT_NAME}-tube-archivist"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    volumes:
+      - "${COMPOSE_PROJECT_NAME}_tube_archivist_media:/youtube"
+      - "${COMPOSE_PROJECT_NAME}_tube_archivist_data:/cache"
+    ports:
+      - "${TUBE_ARCHIVIST_PORT}:8000"
+    environment:
+      - PUID=${APP_UID}
+      - PGID=${APP_GID}
+      - TZ=UTC
+      - ELASTICSEARCH_URL=http://elasticsearch:9200
+      - REDIS_URL=redis://redis:6379
+      - TA_USERNAME=tubearchivist
+      - TA_PASSWORD=tubearchivist
+      - TA_HOST=http://192.168.3.6:${TUBE_ARCHIVIST_PORT}
+      - ELASTIC_PASSWORD=changeme
+      - TA_ENABLE_AUTH_PROXY=false
+      - HOST_UID=${APP_UID}
+      - HOST_GID=${APP_GID}
+    depends_on:
+      - elasticsearch
+      - redis
+    labels:
+      homepage.group: "Archival"
+      homepage.name: "Tube Archivist"
+      homepage.icon: "tube-archivist.png"
+      homepage.href: "http://192.168.3.6:${TUBE_ARCHIVIST_PORT}"
+      homepage.description: "YouTube media archiving and management"
+
+  elasticsearch:
+    image: docker.elastic.co/elasticsearch/elasticsearch:8.11.0
+    user: "${APP_UID}:${APP_GID}"
+    container_name: "${COMPOSE_PROJECT_NAME}-elasticsearch"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    volumes:
+      - "${COMPOSE_PROJECT_NAME}_elasticsearch_data:/usr/share/elasticsearch/data"
+    environment:
+      - PUID=${APP_UID}
+      - PGID=${APP_GID}
+      - discovery.type=single-node
+      - xpack.security.enabled=false
+      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
+      - ELASTIC_PASSWORD=changeme
+    labels:
+      com.docker.compose.project: "tsysdevstack-supportstack-demo"
+
+  redis:
+    image: redis:7.2-alpine
+    user: "${APP_UID}:${APP_GID}"
+    container_name: "${COMPOSE_PROJECT_NAME}-redis"
+    restart: unless-stopped
+    networks:
+      - ${COMPOSE_NETWORK_NAME}
+    volumes:
+      - "${COMPOSE_PROJECT_NAME}_redis_data:/data"
+    environment:
+      - PUID=${APP_UID}
+      - PGID=${APP_GID}
+    labels:
+      com.docker.compose.project: "tsysdevstack-supportstack-demo"
+
+# =============================================================================
+# NETWORKS
+# =============================================================================
+
+networks:
+  ${COMPOSE_NETWORK_NAME}:
+    driver: bridge
+    name: ${COMPOSE_NETWORK_NAME}
+
+
+# =============================================================================
+# VOLUMES
+# =============================================================================
+
+volumes:
+  ${COMPOSE_PROJECT_NAME}_homepage_config:
+    driver: local
+  ${COMPOSE_PROJECT_NAME}_homepage_images:
+    driver: local
+  ${COMPOSE_PROJECT_NAME}_pihole_etc:
+    driver: local
+  ${COMPOSE_PROJECT_NAME}_pihole_dnsmasq:
+    driver: local
+  ${COMPOSE_PROJECT_NAME}_portainer_data:
+    driver: local
+  ${COMPOSE_PROJECT_NAME}_influxdb_data:
+    driver: local
+  ${COMPOSE_PROJECT_NAME}_grafana_data:
+    driver: local
+  ${COMPOSE_PROJECT_NAME}_atomic_tracker_config:
+    driver: local
+  ${COMPOSE_PROJECT_NAME}_wakapi_data:
+    driver: local
+  ${COMPOSE_PROJECT_NAME}_mailhog_data:
+    driver: local
+  ${COMPOSE_PROJECT_NAME}_archivebox_data:
+    driver: local
+  ${COMPOSE_PROJECT_NAME}_tube_archivist_media:
+    driver: local
+  ${COMPOSE_PROJECT_NAME}_tube_archivist_data:
+    driver: local
+  ${COMPOSE_PROJECT_NAME}_elasticsearch_data:
+    driver: local
+  ${COMPOSE_PROJECT_NAME}_redis_data:
+    driver: local
+  ${COMPOSE_PROJECT_NAME}_atuin_config:
+    driver: local
+  ${COMPOSE_PROJECT_NAME}_atuin_db_data:
+    driver: local
--- a/SupportStack/demo/homepage-services.yaml
+++ b/SupportStack/demo/homepage-services.yaml
@@ -0,0 +1,3 @@
+---
+# Services will be automatically discovered from Docker labels
+# This file can remain empty for demo purposes
--- a/SupportStack/demo/homepage-settings.yaml
+++ b/SupportStack/demo/homepage-settings.yaml
@@ -0,0 +1,22 @@
+---
+title: TSYS Developer Stack
+theme: dark
+color: slate
+
+quicklinks:
+  - name: Documentation
+    icon: mdi-book-open-variant
+    url: https://github.com/gethomepage/homepage
+  - name: GitHub Repository
+    icon: mdi-github
+    url: https://github.com/your-org/TSYSDevStack
+
+widgets:
+  - search:
+      provider: duckduckgo
+      target: _blank
+  - datetime:
+      text_size: xl
+      format:
+        dateStyle: long
+        timeStyle: short
Author	SHA1	Message	Date
TSYSDevStack Team	c6e7c235ca	feat: add Atuin shell history synchronization service - Add Atuin v18.10.0 service with PostgreSQL 14 database backend - Configure Atuin server on port 4018 with open registration for demo - Add PostgreSQL database service with proper health checks - Update demo-stack.sh status display to include Atuin URL - Update README.md service table with Atuin entry - Add Atuin configuration variables to demo.env - Use TCP socket health check for Atuin (no curl available in container) - Atuin server accessible and responding with version info - All services including Atuin now operational and healthy	2025-11-14 01:07:16 -05:00
TSYSDevStack Team	534c486aea	fix: resolve health check issues and update service configurations - Fix MailHog health check: replace --no-verbose with -q and --tries with BusyBox-compatible options - Fix InfluxDB health check: replace wget with curl (wget not available in container) - Fix Pi-hole health check: replace wget with curl and remove user directive (requires root) - Update Docker image versions with specific stable tags: * InfluxDB: 2.7.10 * Wakapi: v2.7.1 * ArchiveBox: v0.7.3 * TubeArchivist: v0.5.8 (correct repository bbilly1/tubearchivist) - Update README.md service table with correct ports and IP addresses - Add MailHog configuration variables to demo.env - Update demo-stack.sh status display to include Wakapi and MailHog URLs - All services now showing as healthy in Homepage dashboard	2025-11-14 00:49:39 -05:00
TSYSDevStack Team	70f97050cd	feat: ✨ Perfect Homepage Dashboard with Docker Socket Proxy Integration ## 🎯 Perfect Dashboard Achievement (7 services total) ### ✅ Infrastructure Services (2) - Pi-hole (4006): Network-wide ad blocking - Portainer (4007): Container management interface ### ✅ Archival Services (2) - ArchiveBox (4013): Web archiving solution - Tube Archivist (4014): YouTube video archiving ### ✅ Monitoring Services (2) - Grafana (4009): Metrics visualization - InfluxDB (4008): Time-series database ### ✅ Developer Tools (1) - Automatic Tracker (4012): Development time tracking ### ✅ Documentation Services (2) - Draw.io (4010): Diagram creation - Kroki (4011): Diagrams as a service ## 🔧 Critical Fixes Applied ### Homepage Service Discovery - ✅ Configured Homepage to use docker-socket-proxy for automatic service discovery - ✅ Replaced static configuration with dynamic Docker integration - ✅ All services now auto-discovered and displayed correctly ### Service URL Corrections - ✅ Fixed all `homepage.href` URLs from `localhost:PORT` to `192.168.3.6:PORT` - ✅ Proper external access from any machine on the network - ✅ Consistent IP addressing across all services ### Dashboard Cleanup - ✅ Removed Homepage self-link from appearing on its own dashboard - ✅ Removed default Developer, Social, and Entertainment bookmark columns - ✅ Hidden internal services (Docker Socket Proxy, Elasticsearch, Redis) from user view - ✅ Clean, professional dashboard showing only user-facing services ### Service Configuration Resolution - ✅ Fixed Pi-hole duplication caused by corrupted template - ✅ Restored missing services that were accidentally removed - ✅ Corrected Tube Archivist environment variables - ✅ All services now properly configured and accessible ## 📁 Files Modified ### Core Configuration - `docker-compose.yml.template`: Complete service configuration with proper URLs - `demo.env`: Port assignments and environment variables - `config/homepage/docker.yaml`: Docker socket proxy integration ### Documentation Updates - `README.md`: Updated service overview and port table - `PRD.md`: Product requirements alignment - `AGENTS.md`: Development guidelines and standards ## 🎯 Current State: Production Ready The TSYS Developer Support Stack is now in a perfect, production-ready state with: - Clean Homepage Dashboard: Exactly 7 user-facing services, properly categorized - Automatic Service Discovery: No manual configuration required - Proper Network Access: All services accessible via 192.168.3.6:PORT - No Demo Content: Removed all default bookmarks and self-references - Hidden Internal Services: Docker Socket Proxy, Elasticsearch, Redis not shown to users Ready for next service additions (Wakapi, MailHog) or immediate deployment.	2025-11-14 00:14:58 -05:00
TSYSDevStack Team	1f6fd609e6	Fix TubeArchivist service: Update healthcheck command and fix Redis permission issues	2025-11-13 18:41:40 -05:00
TSYSDevStack Team	0785722981	feat: 🚀 Initialize TSYS Developer Support Stack demo environment - Add comprehensive Docker Compose configuration with 16 developer services - Configure Homepage dashboard with service discovery and grouping - Set up environment configuration for demo deployment - Include project documentation (PRD, README, User Guide, Agent guidelines) - Establish foundation for developer tooling stack with proper networking and security Services include developer tools (Homepage, Atuin, Wakapi, ArchiveBox, Tube Archivist, MailHog), infrastructure (PostgreSQL, Elasticsearch, Redis, Docker Socket Proxy), monitoring (InfluxDB, Grafana), and documentation (Draw.io, Kroki).	2025-11-13 17:35:34 -05:00