first commit

.gitignore

@@ -0,0 +1,18 @@
+# Hugo build output
+/public/
+/resources/_gen/
+.hugo_build.lock
+hugo_stats.json
+
+# Editors and OS
+.vscode/
+.idea/
+*.swp
+*~
+.DS_Store
+Thumbs.db
+
+# Environment and logs
+.env
+*.log
+node_modules/

README.md

@@ -0,0 +1,57 @@
+# Federated Core documentation
+
+A Hugo site documenting the applications Federated Computer hosts for customers on Federated Core. It uses a custom built-in theme (no external theme or CDN dependencies; fonts are self-hosted).
+
+## Requirements
+
+Hugo **extended**, v0.146 or newer (built and tested with v0.168.0).
+
+## Run locally
+
+    hugo server
+
+Then open http://localhost:1313. Build for production with `hugo --minify`; the output is in `public/`.
+
+Set `baseURL` in `hugo.toml` to the address the site will be published at.
+
+## Structure
+
+    content/
+      getting-started/      How Federated Core works, sign-in, Superpanel, command-line access, help
+      apps/                 One page per application
+    layouts/                Templates (baseof, home, list, single, partials, shortcodes)
+    assets/css/main.css     All styles (light and dark mode)
+    assets/js/site.js       Search, mobile menu, "On this page" highlighting
+    static/fonts/           Public Sans and IBM Plex Mono (SIL Open Font License)
+
+## Writing app pages
+
+Create a new page with:
+
+    hugo new content apps/myapp.md
+
+Front matter drives the page header and the home page directory:
+
+| Field | Purpose |
+| --- | --- |
+| `category` | Group in the sidebar and directory. Must match a `params.appGroups` name in `hugo.toml`. |
+| `tagline` | One-sentence summary. |
+| `replaces` | Proprietary services the app can replace (shown struck through). |
+| `address` | Typical web address for the app. |
+| `website`, `upstreamDocs` | Project site and official documentation. |
+| `links` | "Further reading" list of `name` / `url` pairs. |
+
+## Shortcodes
+
+- `{{< note >}}…{{< /note >}}`: helpful tip. Optional `title="…"`.
+- `{{< warning >}}…{{< /warning >}}`: something that could cause data loss or downtime.
+- `{{< enterprise >}}…{{< /enterprise >}}`: a task that needs command-line access (Enterprise installs only). Adds a standard footer explaining this.
+- `{{< superpanel >}}…{{< /superpanel >}}`: a callout for a Superpanel step.
+- `{{< screenshot src="app/name.png" alt="…" caption="…" >}}`: a screenshot from `assets/screenshots/`, converted to WebP and linked to the full-size PNG. Indent it three spaces to place it inside a numbered step. Screenshots are taken on a Federated Core test server with `example.com` substituted for the real domain. Add `demo="true"` for the few taken on an upstream public demo; the caption then says so.
+- `{{< review "what to check" >}}`: an editorial marker that renders nothing. List all of them with:
+
+      grep -rn '< review' content/
+
+## Before publishing
+
+Superpanel option names, the address pattern for each app, and a few Federated Core specifics (for example SSH access to Gitea, the Headscale login address, and how customers edit DNS records) were written in general terms and are flagged with `review` markers. Confirm them against the current Federated Core release and remove the markers.

archetypes/apps.md

@@ -0,0 +1,26 @@
+---
+title: "{{ replace .File.ContentBaseName "-" " " | title }}"
+category: ""        # must match a name in params.appGroups in hugo.toml
+tagline: ""         # one sentence, shown in the directory and under the title
+replaces: []        # proprietary services this app can stand in for
+address: "{{ .File.ContentBaseName }}.example.com"
+website: ""
+upstreamDocs: ""
+links: []
+---
+
+## Overview
+
+What it is and its main capabilities.
+
+### What it replaces
+
+## Signing in
+
+## Common tasks
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for this app." >}}
+
+- **Access**: choose which groups can use this app.

assets/css/main.css

@@ -0,0 +1,285 @@
+/* Federated Core Docs
+   Palette: paper, ink, federation blue, ochre signal, hairline sage. */
+@font-face { font-family: "Public Sans"; src: url("../fonts/public-sans-latin-wght-normal.woff2") format("woff2"); font-weight: 100 900; font-style: normal; font-display: swap; }
+@font-face { font-family: "Public Sans"; src: url("../fonts/public-sans-latin-wght-italic.woff2") format("woff2"); font-weight: 100 900; font-style: italic; font-display: swap; }
+@font-face { font-family: "IBM Plex Mono"; src: url("../fonts/ibm-plex-mono-latin-400-normal.woff2") format("woff2"); font-weight: 400; font-display: swap; }
+@font-face { font-family: "IBM Plex Mono"; src: url("../fonts/ibm-plex-mono-latin-600-normal.woff2") format("woff2"); font-weight: 600; font-display: swap; }
+
+:root {
+  --paper: #F7F8F5;
+  --paper-2: #EEF1EC;
+  --ink: #17232B;
+  --ink-2: #4E5D65;
+  --blue: #24527A;
+  --blue-ink: #1B3F5F;
+  --blue-wash: #E3ECF3;
+  --ochre: #B07A12;
+  --ochre-wash: #F6ECD4;
+  --line: #CFD6D2;
+  --strike: #B5452F;
+  --code-bg: #EBEFEA;
+  --focus: #2F7BC0;
+  --sans: "Public Sans", system-ui, -apple-system, "Segoe UI", sans-serif;
+  --mono: "IBM Plex Mono", ui-monospace, "SFMono-Regular", Menlo, monospace;
+  --measure: 68ch;
+  --header-h: 60px;
+  color-scheme: light;
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    --paper: #12191E;
+    --paper-2: #18222A;
+    --ink: #E3E9EB;
+    --ink-2: #A3B1B8;
+    --blue: #8DBDE3;
+    --blue-ink: #B6D5EE;
+    --blue-wash: #1C2D3B;
+    --ochre: #E2B04F;
+    --ochre-wash: #2C2516;
+    --line: #2C3A42;
+    --strike: #E08770;
+    --code-bg: #1A252C;
+    --focus: #8DBDE3;
+    color-scheme: dark;
+  }
+}
+
+*, *::before, *::after { box-sizing: border-box; }
+html { -webkit-text-size-adjust: 100%; scroll-padding-top: calc(var(--header-h) + 16px); }
+body {
+  margin: 0; background: var(--paper); color: var(--ink);
+  font: 400 1.0625rem/1.65 var(--sans);
+  font-feature-settings: "kern", "liga";
+  text-rendering: optimizeLegibility;
+}
+a { color: var(--blue); text-decoration-thickness: 1px; text-underline-offset: 0.18em; }
+a:hover { color: var(--blue-ink); text-decoration-thickness: 2px; }
+:focus-visible { outline: 2px solid var(--focus); outline-offset: 2px; border-radius: 2px; }
+main:focus { outline: none; }
+.visually-hidden { position: absolute !important; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; }
+.skip { position: absolute; left: 12px; top: -48px; z-index: 50; background: var(--ink); color: var(--paper); padding: 8px 12px; }
+.skip:focus { top: 8px; }
+s { text-decoration-color: var(--strike); text-decoration-thickness: 1.5px; }
+
+/* Masthead */
+.masthead { position: sticky; top: 0; z-index: 20; background: var(--paper); border-bottom: 1px solid var(--line); }
+.masthead-inner { height: var(--header-h); display: flex; align-items: center; gap: 24px; padding: 0 24px; max-width: 1440px; margin: 0 auto; }
+.brand { display: flex; align-items: center; gap: 10px; color: var(--ink); text-decoration: none; font-weight: 700; letter-spacing: -0.01em; white-space: nowrap; }
+.brand:hover { color: var(--ink); }
+.mark { width: 32px; height: 28px; image-rendering: pixelated; }
+.brand-sub { font-weight: 400; color: var(--ink-2); }
+.topnav { display: flex; gap: 20px; }
+.topnav a { color: var(--ink-2); text-decoration: none; font-size: 0.95rem; padding: 4px 0; border-bottom: 2px solid transparent; }
+.topnav a:hover { color: var(--ink); }
+.topnav a[aria-current] { color: var(--ink); border-bottom-color: var(--blue); }
+.search { position: relative; margin-left: auto; width: min(340px, 40vw); }
+.search input {
+  width: 100%; font: inherit; font-size: 0.95rem; color: var(--ink); background: var(--paper-2);
+  border: 1px solid var(--line); border-radius: 6px; padding: 7px 34px 7px 12px;
+}
+.search input::placeholder { color: var(--ink-2); }
+.search input:focus { outline: 2px solid var(--focus); outline-offset: 0; background: var(--paper); }
+.search-key { position: absolute; right: 9px; top: 50%; transform: translateY(-50%); font: 600 0.75rem var(--mono); color: var(--ink-2); border: 1px solid var(--line); border-radius: 4px; padding: 0 6px; }
+.search-results {
+  position: absolute; top: calc(100% + 6px); right: 0; width: min(460px, 92vw); max-height: 70vh; overflow: auto;
+  margin: 0; padding: 6px; list-style: none; background: var(--paper); border: 1px solid var(--line); border-radius: 8px;
+  box-shadow: 0 12px 32px -12px rgb(10 25 35 / 0.35);
+}
+.search-results li a { display: block; padding: 8px 10px; border-radius: 5px; color: var(--ink); text-decoration: none; }
+.search-results li a:hover, .search-results li a[aria-selected="true"] { background: var(--blue-wash); }
+.search-results .r-title { font-weight: 650; }
+.search-results .r-meta { display: block; font-size: 0.82rem; color: var(--ink-2); }
+.search-results .r-empty { padding: 10px; color: var(--ink-2); font-size: 0.92rem; }
+.nav-toggle { display: none; }
+
+/* Frame */
+.frame { max-width: 1440px; margin: 0 auto; display: grid; grid-template-columns: 1fr; }
+.is-doc .frame { grid-template-columns: 264px minmax(0, 1fr); }
+main { min-width: 0; padding: 40px 24px 80px; }
+.is-doc main { padding: 40px 48px 96px; }
+
+/* Sidebar */
+.sidebar {
+  position: sticky; top: var(--header-h); align-self: start; height: calc(100vh - var(--header-h)); overflow-y: auto;
+  padding: 28px 16px 48px 24px; border-right: 1px solid var(--line); font-size: 0.93rem;
+}
+.side-group + .side-group { margin-top: 28px; }
+.side-heading { display: block; font-weight: 700; color: var(--ink); text-decoration: none; margin-bottom: 6px; }
+.side-sub { margin: 18px 0 4px; font-size: 0.8rem; font-weight: 600; color: var(--ink-2); }
+.sidebar ul { list-style: none; margin: 0; padding: 0; }
+.sidebar li a { display: block; padding: 3px 10px; margin-left: -10px; border-radius: 4px; color: var(--ink-2); text-decoration: none; line-height: 1.45; }
+.sidebar li a:hover { color: var(--ink); background: var(--paper-2); }
+.sidebar a[aria-current="page"] { color: var(--blue-ink); background: var(--blue-wash); font-weight: 600; }
+.side-heading[aria-current="page"] { background: none; }
+
+/* Docs */
+.doc-wrap { display: grid; grid-template-columns: minmax(0, var(--measure)) 220px; gap: 56px; }
+.doc { min-width: 0; max-width: var(--measure); }
+.doc-head { margin-bottom: 32px; }
+.doc-kicker { margin: 0 0 8px; font-size: 0.9rem; }
+.doc-kicker a { color: var(--ink-2); text-decoration: none; }
+.doc-kicker a:hover { color: var(--blue); }
+h1, h2, h3, h4 { line-height: 1.2; letter-spacing: -0.015em; font-weight: 750; text-wrap: balance; }
+h1 { font-size: clamp(2rem, 1.4rem + 2vw, 2.75rem); margin: 0 0 12px; letter-spacing: -0.025em; }
+.doc-lede { font-size: 1.2rem; line-height: 1.5; color: var(--ink-2); margin: 0; max-width: 60ch; }
+.factsheet { margin: 24px 0 0; padding: 0; border-top: 1px solid var(--line); }
+.factsheet > div { display: grid; grid-template-columns: 9.5em 1fr; gap: 16px; padding: 9px 0; border-bottom: 1px solid var(--line); }
+.factsheet dt { color: var(--ink-2); font-size: 0.92rem; padding-top: 1px; }
+.factsheet dd { margin: 0; overflow-wrap: anywhere; }
+.replaces s { white-space: nowrap; }
+.replaces .sep, .dir-replaces .sep { color: var(--ink-2); }
+
+.prose > :first-child { margin-top: 0; }
+.prose h2 { font-size: 1.6rem; margin: 2.4em 0 0.6em; padding-top: 0.2em; }
+.prose h3 { font-size: 1.22rem; margin: 1.9em 0 0.5em; }
+.prose h4 { font-size: 1.02rem; margin: 1.6em 0 0.4em; }
+.prose p, .prose ul, .prose ol, .prose table, .prose pre { margin: 0 0 1.1em; }
+.prose ul, .prose ol { padding-left: 1.4em; }
+.prose li { margin: 0.25em 0; }
+.prose li > ul, .prose li > ol { margin: 0.25em 0 0.4em; }
+.prose ol > li::marker { font-weight: 650; color: var(--ink-2); }
+.prose strong { font-weight: 650; }
+.prose code { font: 0.86em var(--mono); background: var(--code-bg); padding: 0.12em 0.36em; border-radius: 4px; overflow-wrap: anywhere; }
+.prose pre { font: 0.86rem/1.55 var(--mono); background: var(--code-bg) !important; padding: 14px 16px; border-radius: 6px; overflow-x: auto; border: 1px solid var(--line); }
+.prose pre code { background: none; padding: 0; font-size: inherit; }
+.prose table { width: 100%; border-collapse: collapse; font-size: 0.95rem; display: block; overflow-x: auto; }
+.prose th, .prose td { text-align: left; vertical-align: top; padding: 8px 14px 8px 0; border-bottom: 1px solid var(--line); }
+.prose th { font-weight: 650; border-bottom-color: var(--ink-2); }
+.prose kbd { font: 600 0.8em var(--mono); border: 1px solid var(--line); border-bottom-width: 2px; border-radius: 4px; padding: 0 5px; background: var(--paper-2); }
+.prose blockquote { margin: 0 0 1.1em; padding-left: 16px; border-left: 3px solid var(--line); color: var(--ink-2); }
+.prose hr { border: 0; border-top: 1px solid var(--line); margin: 2.4em 0; }
+
+/* Callouts */
+.callout { margin: 1.5em 0; padding: 14px 18px; border-left: 4px solid var(--line); background: var(--paper-2); border-radius: 0 6px 6px 0; }
+.callout > :last-child { margin-bottom: 0; }
+.callout p { margin: 0 0 0.6em; }
+.callout-title { font-weight: 700; margin-bottom: 4px !important; }
+.callout-note { border-left-color: var(--blue); background: var(--blue-wash); }
+.callout-superpanel { border-left-color: var(--blue); }
+.callout-warning { border-left-color: var(--strike); }
+.callout-enterprise { border-left-color: var(--ochre); background: var(--ochre-wash); }
+.screenshot { margin: 1.5em 0; }
+.screenshot a { display: block; }
+.screenshot img { display: block; max-width: 100%; height: auto; border: 1px solid var(--line); border-radius: 6px; }
+.screenshot figcaption { margin-top: 8px; font-size: 0.88rem; color: var(--ink-2); }
+.screenshot-src { font-style: italic; }
+.callout-foot { font-size: 0.88rem; color: var(--ink-2); margin-top: 0.8em !important; }
+
+.further { margin-top: 3em; padding-top: 1.4em; border-top: 1px solid var(--line); }
+.further h2 { font-size: 1.15rem; margin: 0 0 0.6em; }
+.further ul { margin: 0; padding-left: 1.2em; }
+
+.pager { display: grid; grid-template-columns: 1fr 1fr; gap: 16px; margin-top: 3.5em; }
+.pager a { display: block; padding: 12px 16px; border: 1px solid var(--line); border-radius: 6px; text-decoration: none; font-weight: 650; color: var(--ink); }
+.pager a:hover { border-color: var(--blue); color: var(--blue-ink); }
+.pager span { display: block; font-weight: 400; font-size: 0.85rem; color: var(--ink-2); }
+.pager-next { grid-column: 2; text-align: right; }
+
+.toc { position: sticky; top: calc(var(--header-h) + 40px); align-self: start; max-height: calc(100vh - var(--header-h) - 60px); overflow-y: auto; font-size: 0.88rem; }
+.toc-title { font-weight: 700; margin: 0 0 8px; }
+.toc ul { list-style: none; margin: 0; padding: 0; }
+.toc ul ul { padding-left: 12px; }
+.toc li a { display: block; padding: 3px 0 3px 10px; border-left: 2px solid var(--line); color: var(--ink-2); text-decoration: none; line-height: 1.4; }
+.toc li a:hover { color: var(--ink); }
+.toc li a.is-active { color: var(--blue-ink); border-left-color: var(--blue); }
+
+.guide-list { list-style: none; padding: 0; margin: 2em 0 0; counter-reset: g; border-top: 1px solid var(--line); }
+.guide-list li { counter-increment: g; display: grid; grid-template-columns: 2.2em 1fr; padding: 16px 0; border-bottom: 1px solid var(--line); }
+.guide-list li::before { content: counter(g); font-weight: 750; color: var(--ink-2); grid-row: span 2; }
+.guide-list a { font-weight: 650; font-size: 1.08rem; }
+.guide-list p { margin: 2px 0 0; color: var(--ink-2); }
+
+/* Directory: the signature element. Open-source app on the left, the service it retires struck through on the right. */
+.directory { margin-top: 8px; }
+.dir-group { margin-top: 40px; }
+.dir-group-head h2, .dir-group-head h3 { font-size: 1.15rem; margin: 0 0 4px; padding-bottom: 8px; border-bottom: 2px solid var(--ink); }
+.dir-list { list-style: none; margin: 0; padding: 0; }
+.dir-row { display: grid; grid-template-columns: 10rem minmax(0, 1fr) minmax(0, 15rem); gap: 6px 24px; align-items: baseline; padding: 12px 0; border-bottom: 1px solid var(--line); }
+.dir-name { font-weight: 700; font-size: 1.05rem; text-decoration: none; }
+.dir-name:hover { text-decoration: underline; }
+.dir-desc { color: var(--ink-2); }
+.dir-replaces { font-size: 0.93rem; text-align: right; color: var(--ink); }
+
+/* Home */
+.is-home main { max-width: 1200px; margin: 0 auto; width: 100%; padding: 64px 32px 96px; }
+.hero { display: grid; grid-template-columns: minmax(0, 1.25fr) minmax(0, 1fr); gap: 64px; align-items: center; padding-bottom: 56px; border-bottom: 1px solid var(--line); }
+.hero h1 { font-size: clamp(2.3rem, 1.4rem + 3.4vw, 3.9rem); line-height: 1.04; letter-spacing: -0.035em; font-weight: 800; margin: 0 0 20px; max-width: 14ch; }
+.hero-lede { font-size: 1.2rem; line-height: 1.55; color: var(--ink-2); max-width: 54ch; margin: 0 0 28px; }
+.hero-links { display: flex; flex-wrap: wrap; gap: 12px; margin: 0; }
+.btn { display: inline-block; padding: 10px 18px; border-radius: 6px; background: var(--blue); color: var(--paper); text-decoration: none; font-weight: 650; border: 1px solid var(--blue); }
+.btn:hover { background: var(--blue-ink); border-color: var(--blue-ink); color: var(--paper); }
+.btn-quiet { background: transparent; color: var(--blue); border-color: var(--line); }
+.btn-quiet:hover { background: var(--blue-wash); color: var(--blue-ink); border-color: var(--blue); }
+.swap { margin: 0; }
+.swap-list { list-style: none; margin: 0; padding: 0; font-size: clamp(1.2rem, 0.9rem + 1vw, 1.55rem); font-weight: 650; letter-spacing: -0.01em; }
+.swap-list li { display: grid; grid-template-columns: 1fr 40px 1fr; align-items: center; gap: 12px; padding: 10px 0; border-bottom: 1px solid var(--line); }
+.swap-list li:first-child { border-top: 1px solid var(--line); }
+.swap-list s { color: var(--ink-2); font-weight: 500; text-align: right; text-decoration-thickness: 2px; }
+.swap-list a { text-decoration: none; }
+.swap-list a:hover { text-decoration: underline; }
+.swap-arrow { height: 2px; background: var(--line); position: relative; }
+.swap-arrow::after { content: ""; position: absolute; right: -1px; top: -4px; border: 5px solid transparent; border-left: 7px solid var(--line); border-right: 0; }
+@media (prefers-reduced-motion: no-preference) {
+  .swap-list s { animation: strike-in 700ms cubic-bezier(.2,.7,.2,1) both; }
+  .swap-list li:nth-child(2) s { animation-delay: 90ms; } .swap-list li:nth-child(3) s { animation-delay: 180ms; }
+  .swap-list li:nth-child(4) s { animation-delay: 270ms; } .swap-list li:nth-child(5) s { animation-delay: 360ms; }
+  .swap-list li:nth-child(6) s { animation-delay: 450ms; }
+  @keyframes strike-in { from { text-decoration-color: transparent; } to { text-decoration-color: var(--strike); } }
+}
+.home-section { margin-top: 56px; }
+.home-section-head { display: grid; grid-template-columns: minmax(0, 1fr) minmax(0, 1.2fr); gap: 32px; align-items: end; }
+.home-section-head h2 { font-size: 2rem; margin: 0; letter-spacing: -0.025em; }
+.home-section-head p { margin: 0; color: var(--ink-2); }
+
+.site-footer { border-top: 1px solid var(--line); font-size: 0.88rem; color: var(--ink-2); }
+.site-footer-inner { max-width: 1440px; margin: 0 auto; padding: 28px 24px 40px; }
+.site-footer p { margin: 0 0 6px; max-width: 80ch; }
+
+/* Syntax highlighting (minimal) */
+.chroma .c, .chroma .c1, .chroma .cm { color: var(--ink-2); font-style: italic; }
+.chroma .s, .chroma .s1, .chroma .s2 { color: var(--ochre); }
+.chroma .k, .chroma .nb, .chroma .nt { color: var(--blue); }
+
+/* Responsive */
+@media (max-width: 1240px) {
+  .doc-wrap { grid-template-columns: minmax(0, 1fr); }
+  .toc { display: none; }
+}
+@media (max-width: 960px) {
+  .hero { grid-template-columns: 1fr; gap: 40px; }
+  .home-section-head { grid-template-columns: 1fr; gap: 8px; }
+  .dir-row { grid-template-columns: 9rem minmax(0, 1fr); }
+  .dir-replaces { grid-column: 2; text-align: left; }
+}
+@media (max-width: 860px) {
+  .is-doc .frame { grid-template-columns: 1fr; }
+  .is-doc main { padding: 28px 20px 72px; }
+  .nav-toggle { display: inline-flex; align-items: center; justify-content: center; width: 38px; height: 38px; margin-left: -8px; background: none; border: 0; color: var(--ink); cursor: pointer; border-radius: 6px; }
+  .is-home .nav-toggle { display: none; }
+  .nav-toggle-bars, .nav-toggle-bars::before, .nav-toggle-bars::after { display: block; width: 20px; height: 2px; background: currentColor; position: relative; }
+  .nav-toggle-bars::before, .nav-toggle-bars::after { content: ""; position: absolute; left: 0; }
+  .nav-toggle-bars::before { top: -6px; } .nav-toggle-bars::after { top: 6px; }
+  .sidebar { position: fixed; left: 0; top: var(--header-h); bottom: 0; width: min(320px, 86vw); height: auto; background: var(--paper); z-index: 15; transform: translateX(-100%); visibility: hidden; transition: transform 200ms ease, visibility 0s 200ms; }
+  .sidebar.is-open { transform: none; visibility: visible; transition: transform 200ms ease; box-shadow: 0 0 0 100vmax rgb(10 20 28 / 0.35); }
+  .topnav { display: none; }
+  .masthead-inner { gap: 12px; padding: 0 16px; }
+  .search { width: auto; flex: 1; max-width: 300px; }
+  .search-key { display: none; }
+}
+@media (max-width: 560px) {
+  .brand-text { display: none; }
+  .is-home main { padding: 40px 20px 72px; }
+  .dir-row { grid-template-columns: 1fr; gap: 2px; }
+  .dir-replaces { grid-column: 1; }
+  .factsheet > div { grid-template-columns: 1fr; gap: 0; }
+  .swap-list li { grid-template-columns: 1fr 28px 1fr; gap: 8px; }
+  .pager { grid-template-columns: 1fr; }
+  .pager-next { grid-column: 1; }
+}
+@media (prefers-reduced-motion: reduce) { .sidebar, .sidebar.is-open { transition: none; } }
+
+/* Refinements */
+.search input:focus ~ .search-key, .search input:not(:placeholder-shown) ~ .search-key { display: none; }
+.factsheet code { font: 0.92rem var(--mono); }
+.dir-replaces { color: var(--ink-2); line-height: 1.5; }
+.dir-replaces s { white-space: nowrap; }

assets/js/site.js

@@ -0,0 +1,129 @@
+// Sidebar toggle, "on this page" highlighting, and client-side search.
+
+const toggle = document.querySelector(".nav-toggle");
+const sidebar = document.getElementById("sidebar");
+if (toggle && sidebar) {
+  const setOpen = (open) => {
+    sidebar.classList.toggle("is-open", open);
+    toggle.setAttribute("aria-expanded", String(open));
+  };
+  toggle.addEventListener("click", () => setOpen(!sidebar.classList.contains("is-open")));
+  document.addEventListener("keydown", (e) => { if (e.key === "Escape") setOpen(false); });
+  document.addEventListener("click", (e) => {
+    if (sidebar.classList.contains("is-open") && !sidebar.contains(e.target) && !toggle.contains(e.target)) setOpen(false);
+  });
+  const current = sidebar.querySelector('[aria-current="page"]');
+  if (current) current.scrollIntoView({ block: "center" });
+}
+
+// Highlight the current heading in the table of contents.
+const tocLinks = [...document.querySelectorAll(".toc a")];
+if (tocLinks.length && "IntersectionObserver" in window) {
+  const map = new Map(tocLinks.map((a) => [decodeURIComponent(a.hash.slice(1)), a]));
+  const headings = [...map.keys()].map((id) => document.getElementById(id)).filter(Boolean);
+  const observer = new IntersectionObserver((entries) => {
+    entries.forEach((entry) => {
+      if (entry.isIntersecting) {
+        tocLinks.forEach((a) => a.classList.remove("is-active"));
+        map.get(entry.target.id)?.classList.add("is-active");
+      }
+    });
+  }, { rootMargin: "0px 0px -70% 0px" });
+  headings.forEach((h) => observer.observe(h));
+}
+
+// Search
+const input = document.getElementById("search-input");
+const results = document.getElementById("search-results");
+const script = document.currentScript || document.querySelector("script[data-index]");
+const indexURL = script ? script.dataset.index : "/index.json";
+let index = null;
+let selected = -1;
+
+async function loadIndex() {
+  if (index) return index;
+  try {
+    const res = await fetch(indexURL);
+    index = await res.json();
+  } catch (err) {
+    index = [];
+  }
+  return index;
+}
+
+const norm = (s) => (s || "").toLowerCase();
+
+function score(item, terms) {
+  let total = 0;
+  for (const t of terms) {
+    const title = norm(item.title);
+    let s = 0;
+    if (title === t) s += 100;
+    else if (title.startsWith(t)) s += 60;
+    else if (title.includes(t)) s += 40;
+    if (norm(item.replaces).includes(t)) s += 30;
+    if (norm(item.tagline).includes(t)) s += 15;
+    if (norm(item.headings).includes(t)) s += 12;
+    if (norm(item.body).includes(t)) s += 4;
+    if (!s) return 0; // every term must match somewhere
+    total += s;
+  }
+  return total;
+}
+
+function escapeHTML(s) {
+  return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
+}
+
+function render(items, query) {
+  selected = -1;
+  if (!query) { results.hidden = true; input.setAttribute("aria-expanded", "false"); return; }
+  results.hidden = false;
+  input.setAttribute("aria-expanded", "true");
+  if (!items.length) {
+    results.innerHTML = `<li class="r-empty">No pages match “${escapeHTML(query)}”. Try an app name or a service you want to replace, like “Dropbox”.</li>`;
+    return;
+  }
+  results.innerHTML = items.slice(0, 8).map((it) => {
+    const meta = it.replaces ? `${it.section}. Replaces ${it.replaces}` : it.section;
+    return `<li><a href="${it.url}"><span class="r-title">${escapeHTML(it.title)}</span><span class="r-meta">${escapeHTML(meta)}</span></a></li>`;
+  }).join("");
+}
+
+async function search() {
+  const q = input.value.trim();
+  const data = await loadIndex();
+  const terms = norm(q).split(/\s+/).filter(Boolean);
+  const hits = data
+    .map((item) => ({ item, s: score(item, terms) }))
+    .filter((x) => x.s > 0)
+    .sort((a, b) => b.s - a.s)
+    .map((x) => x.item);
+  render(hits, q);
+}
+
+function move(delta) {
+  const links = [...results.querySelectorAll("a")];
+  if (!links.length) return;
+  selected = (selected + delta + links.length) % links.length;
+  links.forEach((a, i) => a.setAttribute("aria-selected", String(i === selected)));
+  links[selected].scrollIntoView({ block: "nearest" });
+}
+
+if (input && results) {
+  input.addEventListener("focus", loadIndex, { once: true });
+  input.addEventListener("input", search);
+  input.addEventListener("keydown", (e) => {
+    if (e.key === "ArrowDown") { e.preventDefault(); move(1); }
+    else if (e.key === "ArrowUp") { e.preventDefault(); move(-1); }
+    else if (e.key === "Enter") {
+      const links = results.querySelectorAll("a");
+      const target = links[selected >= 0 ? selected : 0];
+      if (target) { e.preventDefault(); window.location.href = target.href; }
+    } else if (e.key === "Escape") { input.value = ""; render([], ""); input.blur(); }
+  });
+  document.addEventListener("keydown", (e) => {
+    if (e.key === "/" && !/input|textarea|select/i.test(document.activeElement.tagName)) { e.preventDefault(); input.focus(); }
+  });
+  document.addEventListener("click", (e) => { if (!e.target.closest(".search")) { results.hidden = true; input.setAttribute("aria-expanded", "false"); } });
+}

content/_index.md

@@ -0,0 +1,3 @@
+---
+title: "Federated Computer Documentation"
+---

content/apps/_index.md

@@ -0,0 +1,9 @@
+---
+title: "Applications"
+tagline: "Every application Federated Computer can host for you on Federated Core, grouped by what you would use it for."
+weight: 20
+---
+
+Each application listed here is installed individually for your organization on its own virtual machine. Nothing is shared with other customers: your data, your users, and your settings live only on your server.
+
+Your plan may not include every application. If you want one that isn't running yet, it can be added from Superpanel or by contacting Federated Computer. See [Superpanel](/getting-started/superpanel/) for details.

content/apps/authelia.md

@@ -0,0 +1,99 @@
+---
+title: "Authelia"
+category: "Identity and security"
+tagline: "Single sign-on and two-factor authentication for your Federated Core apps."
+replaces: ["Okta", "Microsoft Entra ID", "Auth0", "Duo"]
+address: "auth.example.com"
+website: "https://www.authelia.com/"
+upstreamDocs: "https://www.authelia.com/overview/prologue/introduction/"
+links:
+  - name: "Authelia: Two-factor authentication methods"
+    url: "https://www.authelia.com/overview/authentication/introduction/"
+  - name: "Authelia: One-time password apps"
+    url: "https://www.authelia.com/overview/authentication/one-time-password/"
+  - name: "Authelia: Security keys and passkeys (WebAuthn)"
+    url: "https://www.authelia.com/overview/authentication/security-key/"
+---
+
+## Overview
+
+Authelia is the sign-in portal that sits in front of many of the applications on your server. Instead of signing in to each app separately, you sign in once with Authelia and it lets you through to every app you're allowed to use. It also adds a second layer of protection, two-factor authentication (2FA), so a stolen password on its own isn't enough to get into your account.
+
+What Authelia does for you:
+
+- **Single sign-on (SSO).** One sign-in covers all connected apps until your session expires or you sign out.
+- **Two-factor authentication** using an authenticator app (one-time codes), a hardware security key such as a YubiKey, or a passkey stored on your phone or computer.
+- **Access rules.** Administrators can decide which groups can reach which applications, and which apps require 2FA.
+- **Self-service password reset** by email.
+- **OpenID Connect provider**, so applications can use "Sign in with" your organization's account.
+
+### What it replaces
+
+Authelia covers the parts of identity services like Okta, Microsoft Entra ID (Azure AD), and Auth0 that most small and medium organizations use: SSO, 2FA, and access policies. Paired with the user directory managed in Superpanel, you don't need a separate per-user identity subscription.
+
+## Signing in
+
+1. Open any connected application, or go directly to the Authelia portal address shown in Superpanel.
+2. Enter your username and password.
+
+   {{< screenshot src="authelia/sign-in.png" alt="The Authelia sign-in page with username and password fields" caption="The Authelia sign-in page." >}}
+
+3. If 2FA is required, approve the second step: type the six-digit code from your authenticator app, touch your security key, or confirm your passkey.
+4. Authelia sends you back to the app you were trying to open.
+
+Tick **Remember me** only on your own devices. It keeps your session open longer.
+
+## Set up two-factor authentication
+
+You can register more than one method. Registering two (for example, an authenticator app and a security key) means you won't be locked out if you lose one.
+
+### Authenticator app (one-time password)
+
+1. Install an authenticator app on your phone. Good options include Aegis (Android), 2FAS, Ente Auth, or the iOS Passwords app. You can also store the code in [Vaultwarden](/apps/vaultwarden/#store-two-factor-codes).
+2. Sign in to Authelia and open **Settings**, then **Two-Factor Authentication**. (On first sign-in you may be prompted to register a method straight away.)
+3. Choose to add a **one-time password**. Authelia verifies your identity by emailing you a one-time code. Enter it.
+4. Scan the QR code with your authenticator app, then enter the six-digit code it shows to confirm.
+
+### Security key or passkey (WebAuthn)
+
+1. In **Settings**, then **Two-Factor Authentication**, choose to add a **WebAuthn credential**.
+2. Confirm your identity with the emailed code.
+3. Give the key a name you'll recognize, such as "Blue YubiKey" or "Work laptop".
+4. Follow your browser's prompt to touch the key, or use your fingerprint, face, or device PIN.
+
+{{< note title="Which method is best?" >}}
+Security keys and passkeys are the strongest option because they can't be phished: they only work on your real Authelia address. Authenticator apps are a good, widely supported second choice.
+{{< /note >}}
+
+## Reset a forgotten password
+
+1. On the Authelia sign-in page, select **Reset password**.
+2. Enter your username. A reset link is emailed to the address on your account.
+
+   {{< screenshot src="authelia/reset-password.png" alt="The Authelia Reset password page with a username field" caption="Enter your username and choose **Reset**." >}}
+
+3. Follow the link and choose a new password. Your new password works in all connected apps right away.
+
+If you can't receive the email, ask an administrator to reset your password in Superpanel.
+
+## Lost your second factor
+
+If you lose your phone or security key and have no other method registered, an administrator needs to reset your 2FA registration. Contact your administrator or Federated Computer support. Afterwards, register a new method and remove the lost device from your Authelia settings.
+
+## Signing out
+
+Signing out of Authelia ends your SSO session, so you will need to sign in again before opening another connected app. Some apps also keep their own session; sign out of those too on shared computers.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Authelia." >}}
+
+Authelia doesn't have its own admin screen. Its behavior is controlled by Federated Computer and by the options in Superpanel:
+
+- **People and groups.** Users and group membership in Superpanel decide who can sign in and which applications each group can reach.
+- **Two-factor requirement.** Where available, choose whether 2FA is required for all users or only for selected applications.
+- **Password resets.** Administrators can reset passwords and help users who have lost their second factor.
+
+{{< enterprise >}}
+Authelia's full configuration (session lengths, access-control rules, password policy, and OpenID Connect clients) lives in a configuration file on the server. Enterprise customers can view it, but ask Federated Computer before changing it, because other applications depend on these settings.
+{{< /enterprise >}}

content/apps/baserow.md

@@ -0,0 +1,92 @@
+---
+title: "Baserow"
+category: "Files, photos, and documents"
+tagline: "Spreadsheet-style databases for tracking anything, plus forms, kanban boards, and simple apps."
+replaces: ["Airtable", "Smartsheet", "Google Sheets", "Notion databases"]
+address: "baserow.example.com"
+website: "https://baserow.io/"
+upstreamDocs: "https://baserow.io/user-docs"
+links:
+  - name: "Baserow user documentation"
+    url: "https://baserow.io/user-docs"
+  - name: "Field types"
+    url: "https://baserow.io/user-docs/baserow-field-overview"
+  - name: "Import from Airtable"
+    url: "https://baserow.io/user-docs/import-airtable-to-baserow"
+  - name: "Baserow REST API"
+    url: "https://baserow.io/user-docs/database-api"
+---
+
+## Overview
+
+Baserow is a no-code database. It looks like a spreadsheet, but each column has a type (text, number, date, single select, link to another table, file, and more), so your data stays consistent and tables can be connected to each other. It's a good fit for inventories, content calendars, applicant tracking, event planning, and any list that has outgrown a spreadsheet.
+
+Main capabilities:
+
+- **Workspaces** that hold **databases**, which hold **tables**.
+- Over 20 **field types**, including links between tables, lookups, rollups, formulas, files, and collaborators.
+- **Views** of the same table: grid, gallery, form, kanban, and calendar, each with its own filters, sorts, and hidden fields.
+- **Forms** that anyone can fill in to add rows, without seeing the rest of the data.
+- **Real-time collaboration**, row comments, and change history.
+- **Application Builder** for simple internal tools and portals on top of your data.
+- A REST **API** and webhooks for connecting to [n8n](/apps/n8n/) and other tools.
+
+### What it replaces
+
+Baserow replaces Airtable and Smartsheet, and the database features of Notion. Some features are labelled Premium or Advanced in Baserow; whether they're available depends on whether your installation includes a Baserow licence.
+
+## Signing in
+
+Open your Baserow address and sign in. You may be invited by email to a workspace by a colleague; follow the invitation to join.
+
+## Create your first database
+
+1. On the dashboard, choose **+ Create new**, then **Database**. Start from scratch, or choose a **template** to start with example tables and views.
+
+   {{< screenshot src="baserow/create-new.png" alt="The Baserow Add new menu listing Database, Application, Dashboard, Automation, From template, and Import data" caption="The **Add new** menu in a Baserow workspace." >}}
+
+2. Rename the default table and add fields with the **+** at the end of the column headers. Pick the right field type now: it's what makes filtering and linking work.
+
+   {{< screenshot src="baserow/add-field.png" alt="Adding a field in Baserow, with the list of field types open" caption="Adding a field. Choose the field type from the list." >}}
+
+3. Add rows directly in the grid, paste from a spreadsheet, or import a file (see below).
+
+### Link tables together
+
+Use a **Link to table** field to connect records, for example linking each **Task** to a **Project**. Then add a **Lookup** or **Rollup** field to pull values across, such as a project's deadline onto each task, or a count of open tasks onto each project.
+
+## Use views
+
+Every table can have many views. Create one from the view menu at the top left:
+
+- **Grid**: the spreadsheet view. Add filters, sorts, and groupings, and hide fields people don't need.
+- **Kanban**: cards grouped by a single select field, such as status. Drag cards to change the status.
+- **Calendar**: rows shown by a date field.
+- **Gallery**: cards with a cover image, good for products or people.
+- **Form**: a shareable form that creates new rows. Choose which fields appear, add descriptions, and set a thank-you message or redirect.
+
+Views can be **collaborative** (everyone sees the same filters) or **personal** (only you).
+
+## Import data
+
+- **CSV, Excel, JSON, or XML**: choose **+ Create table** in a database and import the file. Check the field types after import and convert them where needed.
+- **Airtable**: create a shared link to your Airtable base, then use **Import from Airtable** when creating a new database. Fields, views, and attachments come across.
+
+## Share and collaborate
+
+- Invite colleagues from the workspace's **Members** page and choose their role (admin, builder, editor, commenter, or viewer, depending on your edition).
+- Share a view publicly with a read-only link from the view's **Share view** option. You can password-protect it.
+- Mention colleagues in row comments to notify them.
+
+## Administer Baserow
+
+Instance administrators see **Admin** in the left sidebar, with pages for users, workspaces, health, and settings. Under **Settings** you can control whether new people can sign up, and whether to allow workspace creation by everyone.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Baserow." >}}
+
+- **Access**: choose which groups can use Baserow.
+- **Administrators**: choose who is an instance administrator.
+
+Baserow sends email (invitations, notifications) through your server's mail settings, which Federated Computer configures.

content/apps/bookstack.md

@@ -0,0 +1,106 @@
+---
+title: "BookStack"
+category: "Files, photos, and documents"
+tagline: "A wiki for your team's documentation, organized like a library of books."
+replaces: ["Confluence", "Notion (wiki)", "GitBook", "Guru"]
+address: "bookstack.example.com"
+website: "https://www.bookstackapp.com/"
+upstreamDocs: "https://www.bookstackapp.com/docs/"
+links:
+  - name: "BookStack user guide"
+    url: "https://www.bookstackapp.com/docs/user/"
+  - name: "BookStack admin guide"
+    url: "https://www.bookstackapp.com/docs/admin/"
+  - name: "Roles and permissions"
+    url: "https://www.bookstackapp.com/docs/user/roles-and-permissions/"
+  - name: "Content import and export"
+    url: "https://www.bookstackapp.com/docs/user/import-export/"
+---
+
+## Overview
+
+BookStack is a simple, well-organized wiki. Content is arranged in a structure everyone understands: **shelves** hold **books**, books hold **chapters**, and chapters hold **pages**. It's ideal for internal procedures, onboarding guides, policies, and knowledge bases.
+
+Main capabilities:
+
+- A clean **WYSIWYG editor**, or a **Markdown editor** with live preview.
+- Images, attachments, tables, code blocks, callouts, and diagrams drawn with the built-in **diagrams.net** integration.
+- **Revisions** for every page, with comparison and restore.
+- **Full-text search** with filters (by tag, type, date, author).
+- **Tags** and **templates** for consistent page layouts.
+- **Roles and permissions** down to individual books, chapters, and pages.
+- **Export** of pages, chapters, and books to PDF, HTML, Markdown, or plain text.
+- Page comments, a recycle bin, and an audit log for administrators.
+
+### What it replaces
+
+BookStack replaces Confluence and similar wiki and knowledge base tools such as Notion (as a wiki), GitBook, and Guru.
+
+## Signing in
+
+Open your BookStack address and sign in with your organization account.
+
+## Structure your content
+
+| Level | Use it for | Example |
+| --- | --- | --- |
+| Shelf | A department or broad area | Operations |
+| Book | One topic or handbook | Office procedures |
+| Chapter | A section of the book | Opening and closing |
+| Page | One piece of content | Alarm codes and lock-up checklist |
+
+Chapters are optional; a book can contain pages directly. Shelves are optional too, but they make browsing easier once you have more than a handful of books.
+
+## Write and edit pages
+
+1. Open a book or chapter and choose **New page**.
+2. Write in the editor. Use the toolbar for headings, lists, links, tables, and callouts. Paste or drag images straight in.
+3. Choose **Save page**. Drafts save automatically while you type, so you won't lose work if your browser closes.
+
+To switch to Markdown for yourself, open your profile, **My account**, **Preferences**, and change the editor. Administrators can choose the default editor for everyone.
+
+### Revisions
+
+Open a page's **Revisions** from the page menu to see who changed what. Use **Preview** or **Changes** to compare, and **Restore** to roll back.
+
+### Templates
+
+Mark any page as a **template** (in the editor's sidebar). When creating pages, insert a template from the same sidebar. Books can also have a default template for new pages.
+
+## Find things
+
+- The search box searches titles, content, and tags. Use the filters on the results page to narrow down, or search for an exact phrase in quotes.
+- Tags (for example `status: draft` or `team: finance`) are searchable with `[status=draft]`.
+
+## Control who sees what
+
+Permissions are role-based. By default, roles such as **Admin**, **Editor**, and **Viewer** apply everywhere. To restrict a specific book, chapter, or page:
+
+1. Open it and choose **Permissions**.
+2. Override the role permissions for that item, for example letting only the **HR** role view the HR book.
+
+Roles are managed under **Settings**, **Roles**. If your organization maps directory groups to BookStack roles, role membership follows group membership in Superpanel.
+
+## Export and share
+
+From a page, chapter, or book, choose **Export** and pick the format. PDF works well for printing policies; Markdown or HTML is useful for moving content elsewhere.
+
+## Administer BookStack
+
+Administrators see **Settings** in the header:
+
+- **Customization**: app name, logo, colors, and a custom home page (for example a specific shelf or page).
+- **Features & Security**: whether public (signed-out) viewing is allowed, comments, and registration.
+- **Maintenance**: empty the recycle bin and clean up unused images.
+- **Audit log**: see who did what and when.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for BookStack." >}}
+
+- **Access**: choose which groups can sign in to BookStack.
+- **Administrators**: choose who gets the BookStack Admin role.
+
+{{< enterprise >}}
+Enterprise customers can run BookStack's `php artisan bookstack:` commands in the container, for example regenerating the search index (`bookstack:regenerate-search`) after a bulk import, or bulk-updating URLs if your domain changes (`bookstack:update-url`).
+{{< /enterprise >}}

content/apps/calcom.md

@@ -0,0 +1,89 @@
+---
+title: "Cal.com"
+linkTitle: "Cal.com"
+category: "Business operations"
+tagline: "Booking pages that let people schedule time with you, without the back-and-forth."
+replaces: ["Calendly", "Microsoft Bookings", "Acuity Scheduling", "Doodle"]
+address: "calcom.example.com"
+website: "https://cal.com/"
+upstreamDocs: "https://cal.com/docs"
+links:
+  - name: "Cal.com help center"
+    url: "https://cal.com/help"
+  - name: "Cal.com developer and self-hosting docs"
+    url: "https://cal.com/docs"
+  - name: "Cal.com on GitHub"
+    url: "https://github.com/calcom/cal.com"
+---
+
+## Overview
+
+Cal.com publishes your availability as a booking page. Visitors pick a time that suits them, and the meeting lands in your calendar automatically, with a video link if needed.
+
+Main capabilities:
+
+- **Event types** such as "30-minute intro call" or "1-hour consultation", each with its own length, location, questions, and rules.
+- **Calendar connections** so existing events block out busy times and new bookings are added to your calendar.
+- **Availability schedules** with working hours, date overrides, and time zones handled automatically.
+- **Buffers**, minimum notice, daily limits, and booking windows.
+- **Team scheduling**: round-robin (spread bookings across a team) and collective (everyone must be free).
+- **Workflows** for email reminders and follow-ups.
+- **Routing forms** that send visitors to the right person or event based on their answers.
+- **Embeds** for your website and a booking link for your email signature.
+
+### What it replaces
+
+Cal.com replaces Calendly, Microsoft Bookings, Acuity Scheduling, and the scheduling part of Doodle.
+
+{{< note title="Self-hosted edition" >}}
+Cal.com's self-hosted edition includes most features. A few organization-level features in Cal.com's documentation are only available in their paid cloud or enterprise plans.
+{{< /note >}}
+
+## Signing in
+
+Open your Cal.com address and sign in with the account created for you. Complete the onboarding steps: your name, username (which becomes your booking link), time zone, and calendar connection.
+
+## Connect your calendar
+
+1. Go to **Apps**, then **Calendar**, or **Settings**, **Calendars**.
+2. Connect your calendar:
+   - **Nextcloud** (or any CalDAV calendar): choose **CalDAV** and enter `https://nextcloud.example.com/remote.php/dav` with your username and a Nextcloud **app password**.
+   - **Google** or **Outlook**: available if your administrator has set them up. These need extra configuration on the server.
+3. Choose which calendars to **check for conflicts**, and which calendar new bookings are **added to**.
+
+## Set your availability
+
+Go to **Availability**. Edit the default schedule to set your working hours for each day, and add **date overrides** for holidays or special days. You can create several schedules (for example "Mornings only") and pick one per event type.
+
+## Create an event type
+
+1. Go to **Event Types** and choose **New**.
+2. Give it a title, URL slug, and duration.
+3. Under **Location**, choose how you'll meet: in person, phone, or a video link. To use [Jitsi](/apps/jitsi/), install the Jitsi app from **Apps** and set your Jitsi server address.
+4. Under **Limits**, add buffer time, minimum notice, and booking limits.
+5. Under **Advanced**, add booking questions, require confirmation, or hide the event from your profile.
+6. Save, then copy the link. Your booking page is `https://calcom.example.com/yourusername`.
+
+## Manage bookings
+
+**Bookings** shows upcoming, unconfirmed, past, and cancelled bookings. From here you can reschedule, cancel, or request a reschedule. Attendees get emails with links to reschedule or cancel too.
+
+## Add reminders with workflows
+
+Go to **Workflows**, create a workflow, choose a trigger (for example "Before event starts, 24 hours"), and add an email action to attendees or hosts. Attach it to one or more event types.
+
+## Teams
+
+Create a team under **Teams** and invite members. Team event types can be:
+
+- **Round robin**: the next available team member is assigned.
+- **Collective**: the booking needs everyone to be free.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Cal.com and whether Google/Microsoft calendar integrations are preconfigured." >}}
+
+- **Access**: choose which groups are given a Cal.com account.
+- **Calendar integrations**: Google and Microsoft calendar connections need API credentials on the server. Ask Federated Computer support if you want them enabled.
+
+Cal.com administrators can open **Settings**, **Admin** to manage users and instance-wide settings.

content/apps/castopod.md

@@ -0,0 +1,87 @@
+---
+title: "Castopod"
+category: "Websites and media"
+tagline: "Host and publish your podcast, with built-in social features from the fediverse."
+replaces: ["Buzzsprout", "Libsyn", "Podbean", "Transistor", "Spotify for Creators"]
+address: "castopod.example.com"
+website: "https://castopod.org/"
+upstreamDocs: "https://docs.castopod.org/"
+links:
+  - name: "Castopod documentation"
+    url: "https://docs.castopod.org/"
+  - name: "Castopod on Code.Castopod"
+    url: "https://code.castopod.org/adaures/castopod"
+  - name: "Submit your podcast to Apple Podcasts"
+    url: "https://podcasters.apple.com/"
+  - name: "Submit your podcast to Spotify"
+    url: "https://creators.spotify.com/"
+---
+
+## Overview
+
+Castopod is a podcast hosting platform. You upload episodes, and Castopod creates your podcast website, the RSS feed that podcast apps subscribe to, and an embeddable player. It's also connected to the **fediverse** (Mastodon and other ActivityPub networks), so listeners can follow, comment on, and share episodes from their social accounts.
+
+Main capabilities:
+
+- **Podcast and episode management**: artwork, descriptions, seasons, episode types, and scheduling.
+- **RSS feed** compatible with Apple Podcasts, Spotify, and other directories, including Podcasting 2.0 tags.
+- A **podcast website** and an **embeddable player**.
+- **Chapters**, **transcripts**, **soundbites**, and **persons** (hosts and guests).
+- **Analytics**: downloads, listening apps, and locations, measured in a privacy-respecting way.
+- **Fediverse integration**: each podcast is an account that people can follow, with posts and replies.
+- **Premium podcasts** for subscriber-only episodes.
+- **Import** from an existing podcast feed.
+
+### What it replaces
+
+Castopod replaces podcast hosts such as Buzzsprout, Libsyn, Podbean, Transistor, and Spotify for Creators (formerly Anchor).
+
+## Signing in
+
+Castopod's admin area is at your Castopod address followed by `/cp-admin`, for example `https://castopod.example.com/cp-admin`. Sign in with the account your administrator created.
+
+## Create a podcast
+
+1. In the admin, choose **Podcasts**, **+ New podcast**.
+2. Add the cover art (square, at least 1400 × 1400 pixels, ideally 3000 × 3000), title, **handle** (used for the fediverse account, for example `@ourshow@castopod.example.com`), description, language, and category.
+
+   {{< screenshot src="castopod/new-podcast.png" alt="The Castopod Create podcast form with cover, title, and description fields" caption="The **Create podcast** form." >}}
+
+3. Fill in the **owner** name and email. Directories use this to verify you own the show.
+4. Save. Your podcast page and RSS feed now exist.
+
+### Move an existing podcast
+
+Choose **Podcasts**, **Import a podcast**, enter your current RSS feed address, and Castopod copies your episodes. Then set up a **301 redirect** of the old feed to your Castopod feed at your old host, so listeners move automatically.
+
+## Publish an episode
+
+1. Open your podcast and choose **Episodes**, **+ New episode**.
+2. Upload the audio file (MP3 is the safest choice) and add a title, description, and optional episode artwork.
+3. Set the season and episode numbers and the episode type (full, trailer, or bonus).
+4. Optionally add a transcript (SRT or VTT) and chapters (JSON) for apps that support them.
+5. Choose **Publish** now or schedule a date. Castopod also posts the episode to your podcast's fediverse account.
+
+## Get listed in podcast apps
+
+Copy your RSS feed address from the podcast's page and submit it once to each directory: Apple Podcasts Connect, Spotify for Creators, and others such as Pocket Casts and Podcast Index. New episodes then appear automatically.
+
+## Analytics
+
+Open your podcast's **Analytics** to see downloads over time, per episode, by listening app, and by country.
+
+## Fediverse features
+
+Your podcast's handle can be followed from Mastodon and similar networks. Replies and favourites appear in the admin under the podcast's social section, and you can write posts that aren't tied to an episode.
+
+## Administer Castopod
+
+- **Users**: invite collaborators and give them roles per podcast (for example admin, editor, or author).
+- **Settings**: instance name, theme, and image processing.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Castopod." >}}
+
+- **Access**: choose which groups are given the Castopod admin address.
+- **Storage**: audio files take space. Check your VM's storage before importing a long back catalogue.

content/apps/discourse.md

@@ -0,0 +1,96 @@
+---
+title: "Discourse"
+category: "Communication"
+tagline: "A modern discussion forum for your community, customers, or internal knowledge sharing."
+replaces: ["Facebook Groups", "Circle", "Google Groups", "Vanilla Forums", "Khoros"]
+address: "discourse.example.com"
+website: "https://www.discourse.org/"
+upstreamDocs: "https://meta.discourse.org/docs"
+links:
+  - name: "Discourse documentation on Meta"
+    url: "https://meta.discourse.org/docs"
+  - name: "Discourse new user guide"
+    url: "https://meta.discourse.org/t/discourse-new-user-guide/96331"
+  - name: "Discourse moderation guide"
+    url: "https://meta.discourse.org/t/discourse-moderation-guide/63116"
+  - name: "Understanding trust levels"
+    url: "https://blog.discourse.org/2018/06/understanding-discourse-trust-levels/"
+---
+
+## Overview
+
+Discourse is a discussion platform. People start **topics** in **categories**, and others reply. It works as a public community forum, a customer support community, a members' area, or an internal space for announcements and long-form discussion that would get lost in chat.
+
+Main capabilities:
+
+- **Categories** and **tags** to organize topics, with per-category permissions.
+- A rich editor with Markdown, image uploads, quotes, polls, and @mentions.
+- **Email integration**: get notifications and digests by email, and reply by email.
+- **Trust levels** that automatically give experienced members more abilities, reducing moderation work.
+- **Moderation tools**: flags, review queue, slow mode, topic timers, and user suspensions.
+- **Chat** channels alongside topics.
+- **Search**, bookmarks, badges, and a mobile-friendly design.
+- **Plugins** and **themes** to extend features and change the look.
+
+### What it replaces
+
+Discourse replaces Facebook Groups and Circle for communities, Google Groups and mailing lists for discussion, and paid forum platforms such as Vanilla Forums and Khoros.
+
+## Signing in
+
+Members sign up or sign in from the **Log In** button. Depending on how your forum is configured, your colleagues may use the organization account through single sign-on, while public community members create their own Discourse accounts.
+
+## For members
+
+### Start and reply to topics
+
+- Choose **+ New Topic**, pick a category, write a clear title, and post.
+- Reply to the whole topic with the **Reply** button at the bottom, or to a specific post with that post's reply button.
+- Select text in a post and choose **Quote** to quote it in your reply.
+
+### Stay up to date
+
+- On any topic or category, use the bell to choose **Watching**, **Tracking**, **Normal**, or **Muted**.
+- Open your avatar, **Preferences**, **Emails** to choose how often you get email digests and whether you get emails for mentions and replies.
+- Use **Bookmark** to save a post and set a reminder.
+
+## For moderators and administrators
+
+### Run the setup wizard
+
+The first time an administrator signs in, Discourse offers a **setup wizard** for the forum name, logo, colors, and basic access settings. You can run it again from **Admin**, **Setup wizard**.
+
+### Plan your categories
+
+Start with a few broad categories, then add more as needed. In each category's settings (the wrench), set:
+
+- **Security**: which groups can see, reply to, or create topics. Use this for private areas such as "Staff" or "Members only".
+- **Settings**: default sort order, topic templates, and whether new topics need approval.
+
+### Moderate
+
+- Review flagged posts and queued content in the **Review** queue.
+- From a user's profile, **Admin** lets you silence, suspend, or delete accounts, and change their trust level.
+- Use **Topic timers** to close or archive topics automatically, and **slow mode** to cool down heated threads.
+
+### Key admin settings
+
+Open **Admin** (the wrench in the hamburger menu):
+
+- **Settings**: search for any setting by name, for example `login required` to make the forum private, or `must approve users` to vet new members.
+- **Customize**: install themes and theme components, edit text strings, and set up email templates.
+- **Users** and **Groups**: manage members and create groups for permissions and mentions.
+- **Emails**: check outgoing mail and logs if members say they aren't receiving notifications.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Discourse." >}}
+
+- **Access**: whether staff sign in with the organization account (single sign-on).
+- **Administrators**: who gets admin rights in Discourse.
+
+Plugins on Discourse require a rebuild of the application. On Federated Core, ask Federated Computer support to add a plugin; themes and theme components can be installed from the admin screens without help.
+
+{{< enterprise >}}
+Enterprise customers can enter the Discourse container to use the Rails console or `rake` tasks, for example to grant admin rights when nobody can sign in (`rake admin:create`) or to run bulk operations on users and posts.
+{{< /enterprise >}}

content/apps/docuseal.md

@@ -0,0 +1,89 @@
+---
+title: "DocuSeal"
+category: "Files, photos, and documents"
+tagline: "Send documents for electronic signature and keep a verifiable audit trail."
+replaces: ["DocuSign", "Adobe Acrobat Sign", "Dropbox Sign", "PandaDoc"]
+address: "docuseal.example.com"
+website: "https://www.docuseal.com/"
+upstreamDocs: "https://www.docuseal.com/docs"
+links:
+  - name: "DocuSeal guides"
+    url: "https://www.docuseal.com/guides"
+  - name: "DocuSeal API and embedding"
+    url: "https://www.docuseal.com/docs/api"
+  - name: "DocuSeal on GitHub"
+    url: "https://github.com/docusealco/docuseal"
+---
+
+## Overview
+
+DocuSeal lets you turn a PDF or Word document into a fillable, signable form, send it to one or more people, and collect a completed, signed copy with a full audit trail. It's used for contracts, NDAs, onboarding forms, consent forms, and approvals.
+
+Main capabilities:
+
+- A drag-and-drop **template builder** with signature, initials, date, text, number, checkbox, radio, select, image, file, stamp, and phone fields.
+- **Multiple signers** in a set order or all at once, each with their own fields.
+- **Email and link delivery**, with automatic reminders.
+- **Audit log** recording each view, field entry, and signature, plus a signed PDF with a verification certificate.
+- **Templates** you can reuse, organized into folders.
+- **Bulk send** from a CSV or spreadsheet.
+- **API, webhooks, and embedding** to add signing to your website or connect to [n8n](/apps/n8n/).
+
+### What it replaces
+
+DocuSeal replaces e-signature services such as DocuSign, Adobe Acrobat Sign, Dropbox Sign (HelloSign), and PandaDoc's signing features, without per-envelope or per-sender fees.
+
+## Signing in
+
+Open your DocuSeal address and sign in with the account created for you. People you send documents to don't need an account.
+
+## Create a template
+
+1. Choose **Create** (or **Upload**) and upload a PDF, Word document, or image. You can add several documents to one template.
+2. In the builder, pick a field type from the right-hand panel and draw it on the page.
+3. Assign each field to a party, for example **First party** (your customer) and **Second party** (you). Rename parties to make them clearer, such as "Client" and "Company".
+
+   {{< screenshot src="docuseal/template-builder.png" alt="The DocuSeal template builder with signature and date fields placed for two parties, Client and Company" caption="Signature and date fields for two parties, renamed **Client** and **Company**. The field types are on the right." >}}
+
+4. Open a field's settings to make it required, set a default value, or add a description.
+5. Save. The template is ready to send.
+
+{{< note title="Faster setup for existing forms" >}}
+If your PDF already contains form fields, DocuSeal detects them on upload. You can also type field tags into a Word document before uploading (see the [DocuSeal guides](https://www.docuseal.com/guides)) so fields are placed automatically.
+{{< /note >}}
+
+## Send for signature
+
+1. Open the template and choose **Send** (or **Add recipients**).
+2. Enter each party's name and email address. Turn on **Preserve order** if signers must go one after another.
+
+   {{< screenshot src="docuseal/send.png" alt="The DocuSeal Add New Recipients dialog with an email address for each party" caption="The **Add New Recipients** dialog." >}}
+
+3. Edit the email message if needed, then send. Alternatively, copy the signing link and send it yourself.
+4. Track progress on the template's page: each submission shows who has opened, completed, or is still pending.
+
+To sign yourself as one of the parties, choose **Sign it yourself** or open your own signing link.
+
+## Download completed documents
+
+When everyone has signed, all parties receive an email with the completed PDF. In DocuSeal, open the submission to download the signed document and the **audit log**. Keep both: the audit log is your evidence of who signed and when.
+
+## Administer DocuSeal
+
+Open **Settings** to manage:
+
+- **Account**: company name, time zone, and language.
+- **Personalization**: your logo, email templates, and the message shown after signing.
+- **Users**: invite colleagues who can create and send templates.
+- **Email**: the outgoing mail settings. On Federated Core these are normally set up for you.
+- **API** and **Webhooks**: tokens and callback URLs for integrations.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for DocuSeal." >}}
+
+- **Access**: choose which groups are given the DocuSeal address and account.
+
+{{< warning title="Legal requirements vary" >}}
+Electronic signatures are legally recognized in most countries, but some document types (certain property, family, or notarized documents) still need wet-ink signatures or a qualified signature. Check with your legal adviser for important agreements.
+{{< /warning >}}

content/apps/element.md

@@ -0,0 +1,101 @@
+---
+title: "Element"
+category: "Communication"
+tagline: "Secure team chat, rooms, and calls, built on the open Matrix network."
+replaces: ["Slack", "Microsoft Teams chat", "Discord", "WhatsApp groups"]
+address: "element.example.com"
+website: "https://element.io/"
+upstreamDocs: "https://element.io/help"
+links:
+  - name: "Element help center"
+    url: "https://element.io/help"
+  - name: "Download Element for desktop and mobile"
+    url: "https://element.io/download"
+  - name: "Matrix: how federation works"
+    url: "https://matrix.org/docs/matrix-concepts/elements-of-matrix/"
+  - name: "Bridges to Slack, Teams, and other networks"
+    url: "https://matrix.org/ecosystem/bridges/"
+---
+
+## Overview
+
+Element is a chat app for teams. It connects to a **Matrix homeserver** running on your Federated Core server, so your messages are stored on your infrastructure. Matrix is an open standard: like email, people on your server can talk to people on other Matrix servers.
+
+Main capabilities:
+
+- **Rooms** for teams and topics, and **direct messages** for one-to-one or small group chats.
+- **Spaces** to group rooms, like Slack workspaces or Teams teams.
+- **Threads**, replies, reactions, mentions, message editing, and file sharing.
+- **End-to-end encryption** by default for direct messages and private rooms.
+- **Voice and video calls** in direct messages and rooms.
+- **Desktop and mobile apps** for Windows, macOS, Linux, iOS, and Android.
+- **Federation** with other organizations on Matrix, and **bridges** to other chat networks where configured.
+
+### What it replaces
+
+Element replaces Slack, Microsoft Teams chat, and Discord for internal communication, and WhatsApp or Signal groups for working with partners, while keeping message history on your own server.
+
+## Signing in
+
+- **Web**: open your Element address and choose **Sign in**. Use your organization account; you may be sent to the Authelia portal.
+
+  {{< screenshot src="element/sign-in.png" alt="The Element sign-in page with a Continue with Authelia button" caption="Element's sign-in page. Choose **Continue with Authelia** to use your organization account." >}}
+
+- **Apps**: install Element (or **Element X** on mobile) from [element.io/download](https://element.io/download). On the sign-in screen, choose **Edit** next to the server name and enter your homeserver, for example `example.com` or `matrix.example.com`, as shown in Superpanel.
+
+Your Matrix ID looks like `@yourname:example.com`. Share it with people on other servers so they can message you.
+
+## Set up encryption on your first sign-in
+
+Because messages are end-to-end encrypted, each device needs the keys to read them. Element walks you through this the first time:
+
+1. **Set up recovery** (also called Secure Backup). Element creates a **recovery key**. Save it in [Vaultwarden](/apps/vaultwarden/) or another safe place.
+2. When you sign in on another device, **verify** it from a device you're already signed in on, by comparing emoji or scanning a QR code, or enter your recovery key.
+
+   {{< screenshot src="element/verify-device.png" alt="Element asking to confirm your digital identity, with Use another device and Can't confirm? buttons" caption="What a new device shows until you verify it." >}}
+
+{{< warning title="Keep your recovery key" >}}
+If you sign out of every device and lose your recovery key, you won't be able to read your old encrypted messages. Your administrator can't recover them for you.
+{{< /warning >}}
+
+## Everyday use
+
+### Join and create rooms
+
+- Select **+** next to **Rooms** (or in a space) to **create a room** or **explore public rooms** on your server.
+- Choose **private** (invite only, encrypted) or **public** (anyone on the server can find and join).
+- Invite colleagues by name or Matrix ID from the room's **Invite** button.
+
+### Organize with spaces
+
+Create a space for each department or project and add rooms to it. People who join a space can see and join its rooms. Spaces can contain other spaces.
+
+### Threads, mentions, and notifications
+
+- Hover over a message and choose **Reply in thread** to keep side conversations tidy.
+- Type `@` to mention someone. Use `@room` to notify everyone in a room (use sparingly).
+- Adjust notifications per room from the bell icon: all messages, mentions and keywords, or off.
+
+### Calls
+
+Start a voice or video call from the phone or camera icon in a direct message or room. Group calls in rooms may use [Jitsi](/apps/jitsi/) or Element Call, depending on how your server is set up.
+
+## Talk to other organizations
+
+Because Matrix is federated, you can start a direct message with someone on another Matrix server by entering their full Matrix ID, such as `@alex:partner.org`. Rooms can include people from several servers. Your administrator can restrict federation if your organization requires it.
+
+## Administer rooms
+
+Room admins can open **Room settings** to change the name, topic, and avatar; set who can join and who can see history; and change members' power levels (moderator, admin). To remove someone, use **Remove** or **Ban** from their profile in the member list.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Element and Matrix." >}}
+
+- **Access**: choose which groups can sign in to the Matrix homeserver.
+- **Federation**: where offered, choose whether your server can talk to other Matrix servers.
+- **Registration**: accounts come from your directory, so self-registration is normally off.
+
+{{< enterprise >}}
+Enterprise customers can use the Synapse admin API from the server, for example to deactivate accounts, purge old room history, or inspect media usage. See the [Synapse admin API documentation](https://element-hq.github.io/synapse/latest/usage/administration/admin_api/).
+{{< /enterprise >}}

content/apps/erpnext.md

@@ -0,0 +1,100 @@
+---
+title: "ERPNext"
+category: "Business operations"
+tagline: "Accounting, inventory, sales, purchasing, and more in one business system."
+replaces: ["QuickBooks", "Xero", "NetSuite", "SAP Business One", "Sage"]
+address: "erpnext.example.com"
+website: "https://frappe.io/erpnext"
+upstreamDocs: "https://docs.frappe.io/erpnext/user/manual/en/introduction"
+links:
+  - name: "ERPNext user manual"
+    url: "https://docs.frappe.io/erpnext/user/manual/en/introduction"
+  - name: "Frappe School: ERPNext courses"
+    url: "https://school.frappe.io/"
+  - name: "Data Import tool"
+    url: "https://docs.frappe.io/erpnext/user/manual/en/data-import"
+  - name: "ERPNext community forum"
+    url: "https://discuss.frappe.io/"
+---
+
+## Overview
+
+ERPNext is a full enterprise resource planning (ERP) system. It brings your accounts, sales, purchasing, stock, and operations together so information entered once flows everywhere it's needed: a sales order becomes a delivery note, then an invoice, then a payment entry in your ledger.
+
+Main modules:
+
+- **Accounting**: chart of accounts, invoices, payments, bank reconciliation, taxes, budgets, and financial statements.
+- **Selling** and **CRM**: leads, opportunities, quotations, sales orders, and customers.
+- **Buying**: suppliers, requests for quotation, purchase orders, and receipts.
+- **Stock**: items, warehouses, batches and serial numbers, stock entries, and valuation.
+- **Manufacturing**: bills of materials, work orders, and production planning.
+- **Projects**, **Assets**, **Quality**, and **Support**.
+- **HR and payroll** through the companion Frappe HR app, where installed.
+
+Everything is customizable without code: add fields, change forms, create print formats, and set up approval workflows.
+
+### What it replaces
+
+ERPNext replaces small business accounting tools such as QuickBooks, Xero, and Sage, and larger ERP systems like NetSuite and SAP Business One.
+
+## Signing in
+
+Open your ERPNext address and sign in. ERPNext manages its own users and roles; an administrator creates your account and assigns roles such as **Accounts User** or **Stock Manager**.
+
+## First-time setup
+
+The first administrator to sign in runs the **setup wizard**:
+
+1. Choose your language, country, time zone, and currency.
+2. Enter your company name and abbreviation. The abbreviation appears in account and warehouse names, so keep it short.
+3. Choose a **chart of accounts** template for your country, or the standard one.
+4. Set the start and end of your **fiscal year**.
+
+{{< note title="Get your accountant involved early" >}}
+Choices made in the setup wizard (country, currency, chart of accounts, fiscal year) are hard to change later. If you have an accountant, review these settings with them before you start entering transactions.
+{{< /note >}}
+
+## Find your way around
+
+- The **search bar** (the "awesome bar") at the top is the fastest way to do anything. Type "new sales invoice", a customer's name, or a report name.
+- **Workspaces** in the sidebar (Accounting, Selling, Buying, Stock…) group related documents and reports.
+- Every list can be filtered, sorted, and saved, and switched to **Report** view for spreadsheet-style columns.
+
+## A typical sales flow
+
+1. Create a **Customer** and an **Item** (or import them, see below).
+2. Create a **Quotation**, then **Create**, **Sales Order** from it when the customer accepts.
+3. From the sales order, create a **Delivery Note** when goods ship (this reduces stock).
+4. Create a **Sales Invoice** and **Submit** it. Submitting posts the entries to your ledger.
+5. When the customer pays, create a **Payment Entry** against the invoice.
+
+Documents move from **Draft** to **Submitted**. Submitted documents can't be edited; to correct one, **Cancel** and **Amend** it, which keeps the audit trail intact.
+
+## Import your data
+
+Use **Data Import** (search for it in the awesome bar) to bring in customers, suppliers, items, and opening balances:
+
+1. Choose the document type and **Insert new records**.
+2. Download the template, fill it in a spreadsheet, and upload it.
+3. Review the preview and errors, then start the import.
+
+Import opening balances with an **Opening Invoice Creation Tool** or a **Journal Entry** marked as opening.
+
+## Administer ERPNext
+
+- **Users and permissions**: add users under **User**, and assign roles. Fine-tune with **Role Permissions Manager**.
+- **Customize Form**: add fields or change labels on any form without code.
+- **Print Format Builder**: design invoices and quotations with your logo and layout.
+- **Workflow**: add approval steps, for example purchase orders above a limit need a manager's approval.
+- **Email Account**: connect a mailbox so documents can be emailed from ERPNext. On Federated Core, outgoing mail is normally set up for you.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for ERPNext." >}}
+
+- **Access**: choose which groups are given the ERPNext address.
+- **Administrator account**: Superpanel or Federated Computer support provides the initial Administrator credentials.
+
+{{< enterprise >}}
+Enterprise customers can use the `bench` command in the ERPNext container, for example to run `bench --site <site> backup` before a large import, clear caches, or install additional Frappe apps. Coordinate app installs with Federated Computer so updates keep working.
+{{< /enterprise >}}

content/apps/espocrm.md

@@ -0,0 +1,95 @@
+---
+title: "EspoCRM"
+category: "Business operations"
+tagline: "Customer relationship management: contacts, deals, activities, and email in one place."
+replaces: ["Salesforce", "HubSpot CRM", "Zoho CRM", "Pipedrive"]
+address: "espocrm.example.com"
+website: "https://www.espocrm.com/"
+upstreamDocs: "https://docs.espocrm.com/"
+links:
+  - name: "EspoCRM user guide"
+    url: "https://docs.espocrm.com/user-guide/browsing-and-navigation/"
+  - name: "EspoCRM administration guide"
+    url: "https://docs.espocrm.com/administration/server-configuration/"
+  - name: "Roles and access control"
+    url: "https://docs.espocrm.com/administration/roles-management/"
+  - name: "Importing data"
+    url: "https://docs.espocrm.com/administration/import/"
+---
+
+## Overview
+
+EspoCRM helps you keep track of the people and companies you work with, the deals you're pursuing, and every call, meeting, and email along the way.
+
+Main capabilities:
+
+- **Accounts** (companies), **Contacts** (people), and **Leads** (prospects not yet qualified).
+- **Opportunities** (deals) with stages, amounts, and probability, shown as a kanban board.
+- **Activities**: calls, meetings, and tasks, with a shared **Calendar**.
+- **Email**: connect your mailbox to send and receive email inside the CRM and link messages to records automatically.
+- **Cases** for customer support requests.
+- **Stream**: a timeline of updates on each record and for the records you follow.
+- **Reports**, dashboards, and **workflows** (some through EspoCRM's paid extensions).
+- **Entity Manager** and **Layout Manager** to add fields, record types, and change layouts without code.
+
+### What it replaces
+
+EspoCRM replaces Salesforce Sales Cloud, HubSpot CRM, Zoho CRM, and Pipedrive for small and medium teams, without per-seat pricing.
+
+## Signing in
+
+Open your EspoCRM address and sign in with the account your administrator created for you.
+
+## Core concepts
+
+| Record | Use it for |
+| --- | --- |
+| Lead | Someone who has shown interest but isn't qualified yet. **Convert** a lead to create an account, contact, and opportunity in one step. |
+| Account | A company or organization. |
+| Contact | A person, usually linked to an account. |
+| Opportunity | A potential sale, with an amount, stage, and close date. |
+| Case | A support issue raised by a customer. |
+
+## Everyday use
+
+### Add and find records
+
+- Use **Create** on any list, or the **+** in the top bar for quick creation.
+- The global search in the top bar searches across record types.
+- On lists, use filters and save them as presets, such as "My open opportunities".
+
+### Log activities
+
+On a record's detail page, use the **Activities** panel to schedule a call, meeting, or task. Completed activities move to **History**, building a full picture of the relationship.
+
+### Manage your pipeline
+
+Open **Opportunities** and switch to the **Kanban** view. Drag deals between stages as they progress. Keep amounts and close dates current so forecasts and dashboards are accurate.
+
+### Connect your email
+
+1. Open your avatar menu, **Email Accounts**, and **Create Email Account**.
+2. Enter your IMAP details (from Superpanel or your administrator) and enable SMTP to send from the CRM.
+
+   {{< screenshot src="espocrm/connect-email.png" alt="The IMAP tab of a new personal email account in EspoCRM" caption="The **IMAP** tab of a new personal email account. Outgoing mail goes on the **SMTP** tab." >}}
+
+3. Emails to and from known contacts are linked to their records automatically. Use **Archive** on others to link them manually.
+
+## Administer EspoCRM
+
+Open **Administration** from the menu:
+
+- **Users**, **Teams**, and **Roles**: control who can see and edit each type of record. Roles can limit access to "own" records, "team" records, or "all".
+- **Entity Manager**: add fields (dropdowns, dates, currency) and new record types.
+- **Layout Manager**: arrange fields on detail, list, and search layouts.
+- **Import**: bring in CSV exports from your old CRM. Map columns to fields, run a test, then import. Imports can be reverted.
+- **Outbound Emails** and **Inbound Emails**: group mailboxes and case creation from a support address.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for EspoCRM." >}}
+
+- **Access**: choose which groups are given the EspoCRM address.
+- **Administrator account**: initial admin credentials are provided through Superpanel or Federated Computer support.
+
+Scheduled jobs that EspoCRM needs (fetching email, sending reminders) are set up by Federated Computer. If email stops syncing, check **Administration**, **Scheduled Jobs**, then contact support.

content/apps/freescout.md

@@ -0,0 +1,91 @@
+---
+title: "FreeScout"
+category: "Business operations"
+tagline: "A shared help desk inbox so your team can answer customer email together."
+replaces: ["Zendesk", "Help Scout", "Freshdesk", "Front"]
+address: "freescout.example.com"
+website: "https://freescout.net/"
+upstreamDocs: "https://github.com/freescout-help-desk/freescout/wiki"
+links:
+  - name: "FreeScout wiki"
+    url: "https://github.com/freescout-help-desk/freescout/wiki"
+  - name: "FreeScout modules"
+    url: "https://freescout.net/modules/"
+  - name: "FreeScout FAQ"
+    url: "https://github.com/freescout-help-desk/freescout/wiki/FAQ"
+---
+
+## Overview
+
+FreeScout turns a support address like `support@example.com` into a shared inbox. Every incoming email becomes a **conversation** that can be assigned, discussed internally, and tracked until it's resolved, so nothing falls through the cracks and customers get one consistent reply.
+
+Main capabilities:
+
+- **Mailboxes** connected to your support addresses.
+- **Assignment**, **statuses** (Active, Pending, Closed, Spam), and **follow** to stay informed.
+- **Internal notes** visible only to your team, with @mentions.
+- **Saved replies** for common answers.
+- **Collision detection** so two people don't answer the same email.
+- **Customer profiles** with conversation history.
+- **Auto-replies**, signatures per mailbox, and notification settings per person.
+- **Modules** (some free, some paid) for knowledge bases, satisfaction ratings, live chat, reports, and more.
+
+### What it replaces
+
+FreeScout replaces email-based help desks such as Help Scout, Zendesk, Freshdesk, and Front for teams that support customers mainly over email.
+
+## Signing in
+
+Open your FreeScout address and sign in with the account your administrator created. FreeScout keeps its own user list; ask an administrator to add you to the right mailboxes.
+
+## Handle conversations
+
+1. Open a mailbox from the top menu. Folders on the left show **Unassigned**, **Mine**, **Assigned**, **Closed**, and **Spam**.
+
+   {{< screenshot src="freescout/conversations.png" alt="FreeScout mailbox showing the Assigned folder with a list of conversations" caption="A mailbox, with folders on the left and conversations on the right." demo="true" >}}
+
+2. Open a conversation and **assign** it to yourself (or a colleague) from the toolbar.
+3. Choose **Reply** to answer the customer, or **Note** to leave an internal comment.
+4. Set the status when you send:
+   - **Active** while you're working on it.
+   - **Pending** when you're waiting for the customer. It returns to Active when they reply.
+   - **Closed** when it's resolved.
+
+   {{< screenshot src="freescout/reply.png" alt="Replying to a conversation in FreeScout, with the Status and Assign to menus under the editor" caption="Replying to a customer. The **Status** and **Assign to** menus sit under the editor." demo="true" >}}
+
+Use **Saved replies** (the speech-bubble icon in the editor) for answers you send often, and **Merge** if a customer starts several conversations about the same thing.
+
+## Notifications
+
+Under your avatar, **Your profile**, **Notifications**, choose which events email you or show in the browser: new conversations, replies to your conversations, mentions, and more.
+
+## Set up a mailbox (administrators)
+
+1. Go to **Manage**, **Mailboxes**, **New mailbox**. Enter the name and support email address.
+2. Open **Connection settings**:
+   - **Sending emails**: choose SMTP and enter your outgoing mail server details.
+   - **Fetching emails**: enter the IMAP details for the mailbox so FreeScout can collect new messages.
+
+   {{< screenshot src="freescout/connection-incoming.png" alt="The Fetching Emails tab of a FreeScout mailbox's connection settings" caption="**Connection settings**, **Fetching emails**: the IMAP server, port, username, and password for the mailbox." demo="true" >}}
+
+3. Under **Permissions**, choose which users can access the mailbox.
+4. Set the mailbox **signature** and an **auto reply** acknowledging new requests.
+
+If your support address is hosted on Federated Core's mail server, get the IMAP and SMTP details from Superpanel. Create a dedicated mailbox for FreeScout rather than using a person's own mailbox.
+
+## Administer FreeScout
+
+Open **Manage**:
+
+- **Users**: invite agents and set their role (User or Administrator).
+- **Settings**: company name, logo, time format, and mail settings for system notifications.
+- **Modules**: install and activate modules. Paid modules require a licence key from FreeScout.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for FreeScout." >}}
+
+- **Access**: choose which groups are given the FreeScout address.
+- **Mailboxes**: create the shared support mailbox in Superpanel, then connect it in FreeScout.
+
+Fetching email depends on a scheduled task that Federated Computer runs. If new emails stop appearing, check **Manage**, **System**, **Status**, then contact support.

content/apps/gitea.md

@@ -0,0 +1,115 @@
+---
+title: "Gitea"
+category: "Development and automation"
+tagline: "Git hosting with issues, pull requests, wikis, packages, and CI."
+replaces: ["GitHub", "GitLab.com", "Bitbucket"]
+address: "gitea.example.com"
+website: "https://about.gitea.com/"
+upstreamDocs: "https://docs.gitea.com/"
+links:
+  - name: "Gitea documentation"
+    url: "https://docs.gitea.com/"
+  - name: "Gitea Actions"
+    url: "https://docs.gitea.com/usage/actions/overview"
+  - name: "Repository migration"
+    url: "https://docs.gitea.com/usage/repo-mirror"
+  - name: "Package registry"
+    url: "https://docs.gitea.com/usage/packages/overview"
+---
+
+## Overview
+
+Gitea is a lightweight, self-hosted Git service. If you've used GitHub, you'll feel at home: repositories, issues, pull requests, and organizations all work the same way.
+
+Main capabilities:
+
+- **Repositories** with a web code browser, branches, tags, and releases.
+- **Issues** with labels, milestones, assignees, and project boards.
+- **Pull requests** with code review, required approvals, and branch protection.
+- **Organizations** and **teams** with fine-grained permissions.
+- **Wikis** per repository.
+- **Gitea Actions**: CI/CD compatible with most GitHub Actions workflows (needs a runner).
+- **Package registry** for container images, npm, PyPI, Maven, and more.
+- **Mirrors** and **migrations** from GitHub, GitLab, Bitbucket, and others.
+- **Webhooks** and an API compatible with many GitHub tools.
+
+### What it replaces
+
+Gitea replaces GitHub, GitLab.com, and Bitbucket for private and internal code hosting.
+
+## Signing in
+
+Open your Gitea address and sign in with your organization account (you may see a **Sign in with** button for single sign-on).
+
+## Connect Git on your computer
+
+### Over HTTPS (recommended)
+
+1. In Gitea, go to your avatar, **Settings**, **Applications**, and **Generate new token**. Give it the scopes you need (for example `repository: read and write`).
+
+   {{< screenshot src="gitea/access-token.png" alt="Generating a Gitea access token with Read and Write access to repositories" caption="A new token with **Read and Write** access to repositories." >}}
+
+2. Clone with the HTTPS URL from the repository page:
+
+   ```bash
+   git clone https://gitea.example.com/your-org/your-repo.git
+   ```
+
+3. When prompted, enter your Gitea username and use the **token as your password**. Use a credential manager to remember it.
+
+### Over SSH
+
+Add your public key under **Settings**, **SSH / GPG Keys**, then use the SSH clone URL. SSH access depends on your server's network setup; if the SSH URL doesn't connect, use HTTPS.
+
+{{< review "confirm whether Git-over-SSH is exposed on Federated Core and on which port." >}}
+
+## Create a repository
+
+1. Choose **+**, **New Repository**.
+2. Pick the owner (you or an organization), name, and visibility. **Private** repositories are only visible to people you grant access.
+
+   {{< screenshot src="gitea/new-repository.png" alt="The Gitea New Repository form" caption="The **New Repository** form." >}}
+
+3. Optionally initialize with a README, `.gitignore`, and licence.
+
+## Move a repository from GitHub or GitLab
+
+1. Choose **+**, **New Migration** and select the source service.
+2. Paste the repository URL and an access token from the source service.
+
+   {{< screenshot src="gitea/migrate.png" alt="The Gitea Migrate From GitHub form" caption="Migrating from GitHub. Issues, pull requests, and the other items need an access token." >}}
+
+3. Choose what to bring across: issues, pull requests, labels, milestones, releases, and wiki.
+4. Optionally tick **This repository will be a mirror** to keep pulling changes on a schedule.
+
+## Work with pull requests
+
+1. Push a branch, then choose **New Pull Request** and pick the base and compare branches.
+
+   {{< screenshot src="gitea/new-pull-request.png" alt="Comparing a branch with main in Gitea, with the New Pull Request button" caption="Pick the branch to merge into and the branch to pull from, then choose **New Pull Request**." >}}
+
+2. Reviewers comment on lines, approve, or request changes.
+3. Merge with a merge commit, rebase, or squash, as allowed by the repository settings.
+
+   {{< screenshot src="gitea/merge-pull-request.png" alt="A Gitea pull request with the merge style menu open" caption="The merge styles allowed by the repository." >}}
+
+Protect important branches under **Repository settings**, **Branches**: require pull requests, approvals, and passing status checks.
+
+## Organizations and teams
+
+Create an organization for your company or group, then create **teams** (for example Developers, Reviewers) and give each team access to specific repositories with read, write, or admin rights.
+
+## CI with Gitea Actions
+
+Add workflow files under `.gitea/workflows/` (or `.github/workflows/`) using GitHub Actions syntax. Actions need at least one **runner** registered with your server. Ask Federated Computer whether a runner is available on your installation, or register your own runner on a machine you control using a token from **Site Administration**, **Actions**, **Runners**.
+
+## Administer Gitea
+
+Site administrators open **Site Administration** from the avatar menu to manage users, organizations, repositories, authentication sources, and Actions runners.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Gitea." >}}
+
+- **Access**: choose which groups can sign in to Gitea.
+- **Administrators**: choose who gets site administrator rights.

content/apps/headplane.md

@@ -0,0 +1,102 @@
+---
+title: "Headplane"
+category: "Networking and infrastructure"
+tagline: "A web dashboard for your private mesh network, built on Headscale and the Tailscale apps."
+replaces: ["Tailscale (hosted)", "ZeroTier Central", "Cisco AnyConnect", "NordLayer"]
+address: "headplane.example.com"
+website: "https://github.com/tale/headplane"
+upstreamDocs: "https://headscale.net/stable/"
+links:
+  - name: "Headplane on GitHub"
+    url: "https://github.com/tale/headplane"
+  - name: "Headscale documentation"
+    url: "https://headscale.net/stable/"
+  - name: "Download the Tailscale client"
+    url: "https://tailscale.com/download"
+  - name: "Tailscale: Access control policies (ACL syntax)"
+    url: "https://tailscale.com/kb/1018/acls"
+---
+
+## Overview
+
+Headplane is the dashboard for **Headscale**, an open-source server that coordinates a private **mesh VPN** using the official Tailscale apps. Devices you add (laptops, phones, servers, office machines) can reach each other securely over encrypted WireGuard connections, wherever they are, without opening ports on your router.
+
+Your Federated Core server runs the coordination service; your traffic goes directly between your devices whenever possible.
+
+Main capabilities:
+
+- **Machines**: see every connected device, its addresses, operating system, and last seen time.
+- **Users**: group devices by person.
+- **Access controls (ACLs)**: decide which devices and users can reach which others.
+- **MagicDNS**: reach devices by name, such as `office-printer`, instead of by IP address.
+- **Subnet routes**: let devices reach a whole office network through one machine.
+- **Exit nodes**: route all internet traffic through a chosen device, for example while on public Wi-Fi.
+- **Pre-auth keys** for adding servers and devices without an interactive sign-in.
+
+### What it replaces
+
+Headscale with Headplane replaces the hosted Tailscale control plane, ZeroTier Central, and traditional company VPNs such as Cisco AnyConnect or NordLayer for remote access.
+
+## Signing in
+
+Open your Headplane address and sign in. Depending on your setup, you sign in with your organization account or with an API key provided by your administrator.
+
+## Add a device
+
+You use the official Tailscale app on each device, pointed at your own Headscale server instead of Tailscale's.
+
+### Windows, macOS, and Linux
+
+1. Install Tailscale from [tailscale.com/download](https://tailscale.com/download).
+2. Connect it to your server. On Linux, or from a terminal on macOS and Windows:
+
+   ```bash
+   tailscale up --login-server https://headscale.example.com
+   ```
+
+   On macOS you can instead hold <kbd>Option</kbd> while clicking the Tailscale menu bar icon, then choose **Debug**, **Custom Login Server**. On Windows, run the command above in PowerShell.
+3. A browser window opens with a registration step. Complete it, or copy the registration key it shows and give it to your administrator.
+4. In Headplane, the administrator approves the device under **Machines** and assigns it to a user.
+
+### iPhone, iPad, and Android
+
+1. Install Tailscale from the App Store or Google Play.
+2. Open the app's settings and choose to use an **alternate server** (or **custom coordination server**), then enter your Headscale address.
+3. Sign in and complete registration as above.
+
+The address to use is shown in Superpanel. It is the Headscale server, which may differ from the Headplane dashboard address.
+
+{{< review "confirm the Headscale login-server address pattern on Federated Core and the sign-in method for Headplane." >}}
+
+## Manage machines
+
+In Headplane, open **Machines**:
+
+- **Rename** devices so they're easy to recognize.
+- **Move** a machine to a different user.
+- **Expire** a machine's key to force it to sign in again, or **remove** a lost or retired device.
+- **Approve routes**: if a device advertises a subnet or offers to be an exit node, approve it here before others can use it.
+
+## Control who can reach what
+
+Open **Access Control** to edit the policy. By default, devices may be able to reach everything; tighten this as your network grows. The policy uses the same format as Tailscale ACLs, for example allowing the `finance` group to reach only the accounting server on port 443. Save, and changes apply within seconds.
+
+## DNS
+
+Under **DNS**, turn on **MagicDNS** so devices can reach each other by name, and add nameservers or split DNS for internal domains.
+
+## Pre-auth keys for servers
+
+For servers and unattended devices, create a **pre-auth key** under the user's settings. Use it when connecting:
+
+```bash
+tailscale up --login-server https://headscale.example.com --authkey <key>
+```
+
+Make keys single-use and short-lived unless you need otherwise.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Headplane/Headscale." >}}
+
+- **Access**: choose which administrators can open Headplane. Regular users don't need Headplane; they only need the Tailscale app.

content/apps/immich.md

@@ -0,0 +1,97 @@
+---
+title: "Immich"
+category: "Files, photos, and documents"
+tagline: "Automatic photo and video backup with albums, sharing, and smart search."
+replaces: ["Google Photos", "iCloud Photos", "Amazon Photos"]
+address: "immich.example.com"
+website: "https://immich.app/"
+upstreamDocs: "https://immich.app/docs/overview/introduction"
+links:
+  - name: "Immich mobile app"
+    url: "https://immich.app/docs/features/mobile-app"
+  - name: "Immich features overview"
+    url: "https://immich.app/docs/features/searching"
+  - name: "Immich command-line upload tool"
+    url: "https://immich.app/docs/features/command-line-interface"
+  - name: "Import from Google Takeout with immich-go"
+    url: "https://github.com/simulot/immich-go"
+---
+
+## Overview
+
+Immich is a photo and video library that feels like Google Photos, running on your own server. The mobile app backs up your camera roll automatically, and the web app lets you browse, search, and share your library.
+
+Main capabilities:
+
+- **Automatic backup** from iOS and Android, including in the background.
+- **Timeline** of all your photos and videos, with **Memories** ("on this day").
+- **Smart search**: describe what you're looking for ("dog on the beach", "receipt") and Immich finds it using on-server machine learning. No photos are sent to outside services.
+- **Face recognition** that groups people so you can name them and search by person.
+- **Map** of where photos were taken, and filtering by date, camera, or place.
+- **Albums**, shared albums with comments and likes, and public share links.
+- **Partner sharing** to see a partner's or colleague's library alongside yours.
+- **Archive**, **favorites**, **locked folder**, and **trash**.
+
+### What it replaces
+
+Immich replaces Google Photos, iCloud Photos, and Amazon Photos for personal libraries and for teams who manage event, marketing, or field photography.
+
+## Signing in
+
+Open your Immich address and sign in. Depending on your setup, you use your organization account (via the **Login with** single sign-on button) or an Immich account created by your administrator.
+
+## Back up your phone
+
+1. Install **Immich** from the App Store or Google Play.
+2. Enter your server address, for example `https://immich.example.com`, and sign in.
+3. Tap the cloud icon at the top, choose **Backup**, and select the albums to back up (usually **Recent** or **Camera Roll**).
+4. Turn on **Background backup** (Android) or allow **Background App Refresh** (iOS).
+5. To save mobile data, keep **Backup on Wi-Fi only** enabled.
+
+Immich doesn't delete photos from your phone after backup. Once backed up, you can free up space from the app's settings.
+
+## Find photos
+
+- **Search** with plain words: objects, scenes, text in the photo, or a place name.
+- Select **Explore** to browse by **People**, **Places**, and **Things**.
+- Name a face once under **People**, and every photo of that person becomes searchable by name.
+- Use the **Map** to find photos taken in a specific area.
+
+## Albums and sharing
+
+1. Select photos (hover and tick, or <kbd>Shift</kbd>+click for a range), then **Add to album**.
+
+   {{< screenshot src="immich/add-to-album.png" alt="Three photos selected in Immich with the Add to album dialog open" caption="Three photos selected and the **Add to album** dialog open." >}}
+
+2. Open an album and choose **Share** to add other Immich users, who can view, add their own photos, and comment.
+
+   {{< screenshot src="immich/share-album.png" alt="The Immich album options dialog with Invite People and Create link" caption="**Invite People** for Immich users, **Create link** for people outside Immich." >}}
+
+3. To share with someone outside Immich, create a **link**. You can set an expiry, a password, and whether they can download or upload.
+
+**Partner sharing** (in **Account settings**, **Partner sharing**) shows another person's whole library in your timeline. They see yours only if you add them too.
+
+## Upload existing photos from a computer
+
+- **Small batches**: drag files onto the web app or use **Upload**.
+- **Large libraries**: use the [Immich CLI](https://immich.app/docs/features/command-line-interface) on your own computer. It uploads folders through the web API using an API key from **Account settings**, **API keys**, so it doesn't need server access.
+- **Google Photos**: request a Google Takeout export, then import it with [immich-go](https://github.com/simulot/immich-go), which keeps dates, albums, and descriptions.
+
+## Administer Immich
+
+Administrators open **Administration** from the avatar menu:
+
+- **Users**: create accounts, set storage quotas, and reset passwords for local accounts.
+- **Jobs**: run or re-run tasks such as thumbnail generation, face detection, and smart search indexing. After a large import these run in the background and can take a while.
+- **Settings**: control machine learning, video transcoding, storage templates, and the public share settings.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Immich." >}}
+
+- **Access**: choose which groups can use Immich.
+- **Storage**: photo libraries grow quickly. Check your VM's storage in Superpanel and contact Federated Computer before importing a large library.
+
+{{< enterprise >}}
+Enterprise customers can add **external libraries**: folders of photos already on the server that Immich indexes in place without copying. This requires mounting the folder into the Immich container; coordinate with Federated Computer support.
+{{< /enterprise >}}

content/apps/jitsi.md

@@ -0,0 +1,89 @@
+---
+title: "Jitsi"
+category: "Communication"
+tagline: "Video meetings in the browser, with no downloads or accounts needed for guests."
+replaces: ["Zoom", "Google Meet", "Microsoft Teams meetings", "Webex"]
+address: "jitsi.example.com"
+website: "https://jitsi.org/"
+upstreamDocs: "https://jitsi.github.io/handbook/docs/category/user-guide/"
+links:
+  - name: "Jitsi Meet user guide"
+    url: "https://jitsi.github.io/handbook/docs/category/user-guide/"
+  - name: "Keyboard shortcuts"
+    url: "https://jitsi.github.io/handbook/docs/user-guide/user-guide-keyboard-shortcuts"
+  - name: "Jitsi Meet mobile apps"
+    url: "https://jitsi.org/downloads/"
+---
+
+## Overview
+
+Jitsi Meet is a video conferencing app that runs in the browser. You start a meeting by giving it a name, and anyone with the link can join from a browser or the Jitsi Meet mobile app. Guests don't need an account.
+
+Main capabilities:
+
+- HD video and audio, **screen sharing**, and tile or speaker views.
+- **Chat**, **raise hand**, reactions, and **polls**.
+- **Lobby** (waiting room) and **meeting passwords**.
+- **Moderator controls** to mute participants, ask them to turn on video, or remove them.
+- **Breakout rooms**.
+- **Background blur** and virtual backgrounds.
+- Calendar integration through a meeting link you can paste anywhere.
+
+### What it replaces
+
+Jitsi replaces Zoom, Google Meet, Microsoft Teams meetings, and Webex for most day-to-day calls, with no per-host licences or time limits.
+
+## Start a meeting
+
+1. Open your Jitsi address.
+2. Type a meeting name, such as `weekly-ops-review`, and choose **Start meeting**. Use names that are hard to guess for private meetings.
+
+   {{< screenshot src="jitsi/start-meeting.png" alt="The Jitsi Meet start page with a meeting name typed in" caption="The Jitsi start page." >}}
+
+3. If your server requires it, sign in with your organization account to create the meeting. Guests can still join without signing in once you're there.
+4. Allow your browser to use your camera and microphone.
+
+   {{< screenshot src="jitsi/join-meeting.png" alt="The Jitsi pre-join screen with a name field, Join meeting button, and microphone and camera controls" caption="Before you join: enter your name and check your microphone and camera." >}}
+
+5. Share the link from the **Invite people** button, or copy the address from your browser.
+
+Add the meeting link to a calendar invite in [Nextcloud](/apps/nextcloud/) or a booking type in [Cal.com](/apps/calcom/) so people can join with one click.
+
+## During a meeting
+
+| Want to | Do this |
+| --- | --- |
+| Mute or unmute | Microphone button, or press <kbd>M</kbd> |
+| Turn the camera on or off | Camera button, or press <kbd>V</kbd> |
+| Share your screen | Screen share button, or press <kbd>D</kbd> |
+| Raise your hand | Hand button, or press <kbd>R</kbd> |
+| Open chat | Chat button, or press <kbd>C</kbd> |
+| Switch tile view | Tile button, or press <kbd>W</kbd> |
+| Blur your background | **…** menu, then **Select background** |
+
+Use headphones to avoid echo, and a Chromium-based browser (Chrome, Edge, Brave) for the best performance.
+
+## Secure a meeting
+
+As the moderator (usually the person who started the meeting):
+
+- Open **Security options** (the shield) to **enable the lobby**. You'll be asked to admit each person.
+- Set a **meeting password** in the same panel and share it separately from the link.
+- From a participant's tile menu, mute, **kick**, or **grant moderator** rights.
+- Choose **Mute everyone** from the participants panel for large meetings.
+
+## Breakout rooms
+
+From the participants panel, choose **Add breakout room**, then drag or assign people. Participants can also move between rooms themselves. Close the rooms to bring everyone back to the main meeting.
+
+## Join from a phone
+
+Install **Jitsi Meet** from the App Store or Google Play. In the app's **Settings**, set **Server URL** to your Jitsi address so meetings open on your server rather than the public meet.jit.si service.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Jitsi, and whether recording/streaming are available." >}}
+
+- **Access**: choose whether creating meetings requires signing in. Requiring sign-in stops strangers from using your server for their own meetings; guests can still join meetings you start.
+
+Recording and live streaming need an extra component (Jibri) that isn't part of every installation. Ask Federated Computer if you need them.

content/apps/kimai.md

@@ -0,0 +1,103 @@
+---
+title: "Kimai"
+category: "Business operations"
+tagline: "Time tracking for projects and clients, with timesheets, reports, and invoices."
+replaces: ["Toggl Track", "Harvest", "Clockify", "Timely"]
+address: "kimai.example.com"
+website: "https://www.kimai.org/"
+upstreamDocs: "https://www.kimai.org/documentation/"
+links:
+  - name: "Kimai documentation"
+    url: "https://www.kimai.org/documentation/"
+  - name: "Invoices"
+    url: "https://www.kimai.org/documentation/invoices.html"
+  - name: "Kimai plugin store"
+    url: "https://www.kimai.org/store/"
+---
+
+## Overview
+
+Kimai records how much time your team spends on each client, project, and type of work. Use it for billing clients, understanding project costs, or simply knowing where the week went.
+
+Main capabilities:
+
+- One-click **start and stop** timers, and manual entries.
+- A hierarchy of **customers**, **projects**, and **activities**.
+- **Hourly and fixed rates** per user, customer, project, or activity.
+- **Budgets** on customers and projects, in money or hours, with warnings.
+- **Teams** to control who can see and book time to which projects.
+- **Reports** by user, project, month, and more, and **exports** to Excel, CSV, and PDF.
+- **Invoices** generated from tracked time using customizable templates.
+- An API and browser-friendly mobile layout (it can be installed as a web app on your phone).
+
+### What it replaces
+
+Kimai replaces Toggl Track, Harvest, Clockify, and similar time trackers, without per-user subscriptions.
+
+## Signing in
+
+Open your Kimai address and sign in with your organization account or the Kimai account created for you.
+
+## Track time
+
+### Start a timer
+
+1. Choose **Start** (the play button) in the top bar.
+2. Pick the **customer**, **project**, and **activity**, and optionally add a description and tags.
+
+   {{< screenshot src="kimai/start-timer.png" alt="The Kimai dialog for starting a timer, with project, activity, description, and tags fields" caption="The dialog that opens from the play button." >}}
+
+3. Choose **Start**. The running timer shows in the top bar. Stop it with the stop button.
+
+Your recent activities appear in the top bar's dropdown for one-click restarts.
+
+### Add time after the fact
+
+Go to **My times** and choose **Create**. Enter the date, start and end time (or duration), and the project and activity.
+
+### Fix a mistake
+
+In **My times**, open the entry's menu to edit or delete it. Entries may be locked after a period closes, depending on your organization's settings.
+
+## Set up clients and projects
+
+Administrators and team leads:
+
+1. Create a **customer** under **Customers**, with currency and an optional budget.
+
+   {{< screenshot src="kimai/new-customer.png" alt="The Kimai form for creating a customer" caption="Creating a customer under **Administration**, **Customers**." demo="true" >}}
+
+2. Create **projects** for that customer, with optional budget, order number, and start and end dates.
+3. Create **activities**: global ones (such as "Meetings" or "Development") that apply to every project, or ones specific to a project.
+4. Set **rates** on the customer, project, activity, or user. The most specific rate wins.
+
+## Reports and exports
+
+- **Reporting** has ready-made reports, such as weekly hours per user and monthly totals per project.
+- **Export** turns filtered timesheets into Excel, CSV, PDF, or HTML. Mark exported entries so they aren't billed twice.
+
+## Create invoices
+
+1. Under **Invoices**, filter by customer and date range.
+
+   {{< screenshot src="kimai/create-invoice.png" alt="The Kimai Create invoice screen with filters for time range, customer, and project" caption="**Invoices**, **Create invoice**: filter the time entries to bill." demo="true" >}}
+
+2. Choose a **template** (configure your company details and payment terms under **Invoices**, **Templates**).
+3. Preview, then create the invoice. Kimai keeps a numbered invoice archive and can mark the time entries as exported.
+
+## Administer Kimai
+
+- **Users**: set roles (User, Teamlead, Admin, Super-Admin), hourly rates, and preferences.
+- **Teams**: connect users to customers and projects to restrict visibility.
+- **Settings**: time rounding, lockdown periods for completed months, and default work hours.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Kimai." >}}
+
+- **Access**: choose which groups can sign in to Kimai.
+- **Administrators**: choose who gets the Super-Admin role.
+
+{{< enterprise >}}
+Kimai plugins from the store are installed by copying them to the server and running `bin/console kimai:reload`. Enterprise customers can do this themselves; others can ask Federated Computer support.
+{{< /enterprise >}}

content/apps/listmonk.md

@@ -0,0 +1,97 @@
+---
+title: "Listmonk"
+category: "Marketing and analytics"
+tagline: "Newsletters and mailing lists: manage subscribers, design campaigns, and track results."
+replaces: ["Mailchimp", "Constant Contact", "Brevo", "Kit (ConvertKit)", "Substack (email)"]
+address: "listmonk.example.com"
+website: "https://listmonk.app/"
+upstreamDocs: "https://listmonk.app/docs/"
+links:
+  - name: "Listmonk documentation"
+    url: "https://listmonk.app/docs/"
+  - name: "Templating and expressions"
+    url: "https://listmonk.app/docs/templating/"
+  - name: "Importing subscribers"
+    url: "https://listmonk.app/docs/importing-subscribers/"
+  - name: "Listmonk on GitHub"
+    url: "https://github.com/knadh/listmonk"
+---
+
+## Overview
+
+Listmonk is a newsletter and mailing list manager. It handles subscribers, sign-up forms, campaign sending, and basic analytics, and it's fast enough for lists of hundreds of thousands of people.
+
+Main capabilities:
+
+- **Lists**, public or private, with **single or double opt-in**.
+- **Subscribers** with custom attributes (stored as JSON) for segmentation and personalization.
+- **Campaigns** written in a rich text editor, Markdown, raw HTML, or visual builder, with **templates**.
+- **Segmentation** using SQL-style queries on subscriber data.
+- **Analytics**: views, clicks, bounces, and link tracking.
+- **Subscription forms** you can embed on your website, and a public archive of past campaigns.
+- **Transactional email API** for one-off messages from your other systems.
+- Automatic **unsubscribe** handling and **bounce processing**.
+
+### What it replaces
+
+Listmonk replaces Mailchimp, Constant Contact, Brevo (Sendinblue), and Kit (ConvertKit) for newsletters, without paying by list size.
+
+## Signing in
+
+Open your Listmonk admin address (usually ending in `/admin`) and sign in with the account provided by your administrator.
+
+## Create a list
+
+1. Go to **Lists**, then **New**.
+2. Choose:
+   - **Public** (shown on your subscription page) or **Private** (only you can add people).
+   - **Single opt-in** or **Double opt-in** (subscribers confirm by email). Double opt-in is strongly recommended for public lists.
+
+   {{< screenshot src="listmonk/new-list.png" alt="The Listmonk New list dialog with name, type, and opt-in fields" caption="The **New list** dialog." >}}
+
+3. Save.
+
+## Add subscribers
+
+- **One at a time**: **Subscribers**, **New**.
+- **In bulk**: **Subscribers**, **Import**. Upload a CSV with at least `email` and `name` columns. Extra columns can go into the `attributes` column as JSON. Choose the list and whether to overwrite existing subscribers.
+- **From your website**: **Lists**, **Forms** generates HTML you can paste into a page (or into [WordPress](/apps/wordpress/)).
+
+Only import people who agreed to receive your email. Sending to purchased or scraped lists harms your domain's reputation and is illegal in many countries.
+
+## Send a campaign
+
+1. Go to **Campaigns**, **New**.
+2. Enter a name, subject, and **from address**, and choose the lists to send to.
+
+   {{< screenshot src="listmonk/new-campaign.png" alt="The Listmonk New campaign form with a list selected and the Send test message panel" caption="A new campaign. **Send test message** is on the right." >}}
+
+3. Pick a **template** and write the content. Personalize with tags such as `{{ .Subscriber.FirstName }}`.
+4. Select **Send test message** to send to yourself, and check it on desktop and phone.
+5. **Schedule** it or select **Start campaign** to send now.
+
+Watch the campaign's progress and stats under **Campaigns**. Use **Analytics** for views and clicks over time.
+
+## Templates
+
+Under **Campaigns**, **Templates**, edit the layout that wraps every campaign: your logo, colors, footer, and unsubscribe link. Keep `{{ template "content" . }}` where the campaign body should appear, and always keep the unsubscribe link.
+
+## Settings (administrators)
+
+Open **Settings**:
+
+- **General**: root URL, default from address, and whether a public archive is enabled.
+- **SMTP**: the mail servers used to send campaigns. Large lists should use a dedicated sending service; see below.
+- **Bounces**: process bounce emails so invalid addresses are blocklisted automatically.
+- **Privacy**: options for individual subscriber data exports and self-service deletion.
+- **Users and roles**: add colleagues and limit them to specific lists.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Listmonk and default SMTP arrangement." >}}
+
+- **Access**: choose which groups are given the Listmonk admin address.
+
+{{< warning title="Sending volume and deliverability" >}}
+For lists beyond a few hundred subscribers, send through a dedicated email delivery service (such as Amazon SES, Postmark, or Mailgun) configured under **Settings**, **SMTP**, and make sure your domain has SPF, DKIM, and DMARC records. Ask Federated Computer support for help before your first large send.
+{{< /warning >}}

content/apps/matomo.md

@@ -0,0 +1,86 @@
+---
+title: "Matomo"
+category: "Marketing and analytics"
+tagline: "Full-featured website analytics that keeps visitor data on your own server."
+replaces: ["Google Analytics", "Adobe Analytics", "Hotjar (with plugins)"]
+address: "matomo.example.com"
+website: "https://matomo.org/"
+upstreamDocs: "https://matomo.org/guide/"
+links:
+  - name: "Matomo user guides"
+    url: "https://matomo.org/guide/"
+  - name: "Matomo FAQ"
+    url: "https://matomo.org/faq/"
+  - name: "Matomo Tag Manager"
+    url: "https://matomo.org/guide/tag-manager/getting-started-with-tag-manager/"
+  - name: "Privacy and GDPR guide"
+    url: "https://matomo.org/gdpr-analytics/"
+---
+
+## Overview
+
+Matomo is a web analytics platform comparable to Google Analytics, but the data is stored on your server and never shared with an advertising company. It can be configured to run without cookies, which in many jurisdictions removes the need for a consent banner.
+
+Main capabilities:
+
+- **Visitors**: real-time visitors, locations, devices, and visit logs.
+- **Behaviour**: pages, entry and exit pages, site search, downloads, outlinks, and events.
+- **Acquisition**: referrers, search engines, social networks, and **campaign** tracking (UTM parameters).
+- **Goals** and **ecommerce** tracking, with conversion and revenue reports.
+- **Custom dashboards**, segments, scheduled email reports, and annotations.
+- **Tag Manager** for adding tracking and third-party scripts without editing your site.
+- **Privacy controls**: IP anonymization, cookieless tracking, Do Not Track, data retention, and GDPR tools.
+- Optional premium plugins for heatmaps, session recordings, funnels, and more.
+
+### What it replaces
+
+Matomo replaces Google Analytics and Adobe Analytics, and with premium plugins, Hotjar-style heatmaps and session recordings.
+
+## Signing in
+
+Open your Matomo address and sign in with the account created for you. Users can have **view**, **write**, or **admin** access to each website separately.
+
+## Add a website
+
+Administrators:
+
+1. Open **Administration** (the gear), **Websites**, **Manage**, and select **Add a new website**.
+2. Enter the name, URLs (including variants like `www.`), time zone, and currency.
+3. Save, then open **Tracking code** to get the snippet.
+
+## Install the tracking code
+
+- **Any website**: paste the JavaScript snippet before the closing `</head>` tag on every page.
+- **WordPress**: install the **Connect Matomo** plugin in [WordPress](/apps/wordpress/) and enter your Matomo address and an auth token.
+- **Tag Manager**: create a container, add a **Matomo Analytics** tag, publish, and install the container snippet instead.
+
+Visit your site, then check **Visitors**, **Real-time** to confirm visits are recorded.
+
+## Read your reports
+
+- **Dashboard**: widgets you can add, remove, and rearrange.
+- **Visitors**, **Behaviour**, **Acquisition**: the main report areas. Change the date range at the top, and compare periods.
+- **Segments**: filter any report, for example "visits from newsletter" or "mobile visitors".
+- **Goals**: under **Goals**, **Manage goals**, define conversions such as visiting a thank-you page or clicking a sign-up button.
+
+Schedule regular email reports from **Administration**, **Personal**, **Email reports**.
+
+## Privacy settings
+
+Under **Administration**, **Privacy**:
+
+- **Anonymize data**: mask part of the IP address and stop tracking user IDs.
+- **Users opt-out**: embed an opt-out form on your privacy policy page.
+- **GDPR tools**: find, export, or delete a visitor's data on request.
+- **Delete old raw data** to limit how long logs are kept.
+
+For cookieless tracking, disable cookies in the tracking code (`_paq.push(['disableCookies']);`) and check whether consent is still required in your jurisdiction.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Matomo." >}}
+
+- **Access**: choose which groups can sign in to Matomo.
+- **Super user**: Federated Computer sets up the first super user account; contact support to change it.
+
+Matomo processes reports in the background on a schedule that Federated Computer manages. New data usually appears within an hour.

content/apps/mautic.md

@@ -0,0 +1,108 @@
+---
+title: "Mautic"
+category: "Marketing and analytics"
+tagline: "Marketing automation: track contacts, build campaigns, and nurture leads."
+replaces: ["HubSpot Marketing Hub", "Marketo", "Salesforce Pardot", "ActiveCampaign"]
+address: "mautic.example.com"
+website: "https://www.mautic.org/"
+upstreamDocs: "https://docs.mautic.org/en/"
+links:
+  - name: "Mautic user documentation"
+    url: "https://docs.mautic.org/en/"
+  - name: "Mautic community forum"
+    url: "https://forum.mautic.org/"
+  - name: "Mautic on GitHub"
+    url: "https://github.com/mautic/mautic"
+---
+
+## Overview
+
+Mautic is a marketing automation platform. It tracks how contacts interact with your website and emails, lets you group them into segments, and runs automated campaigns that send the right message at the right time.
+
+Main capabilities:
+
+- **Contacts** and **companies** with activity history (page visits, email opens, form submissions).
+- **Segments** that update automatically based on filters.
+- **Campaigns** built in a visual editor with actions, decisions, and conditions.
+- **Emails** designed in a drag-and-drop builder, sent as one-off broadcasts or by campaigns.
+- **Forms** and **landing pages** to capture leads.
+- **Website tracking** with a small script.
+- **Points** and **stages** for lead scoring and lifecycle tracking.
+- **Reports** and dashboards, plus integrations with CRMs and other tools.
+
+### What it replaces
+
+Mautic replaces marketing automation suites such as HubSpot Marketing Hub, Marketo, Salesforce Pardot (Account Engagement), and ActiveCampaign.
+
+## Signing in
+
+Open your Mautic address and sign in with the account your administrator created.
+
+## Get started
+
+### Add the tracking script to your website
+
+1. Open the gear icon, **Configuration**, **Tracking Settings**, and copy the tracking code.
+
+   {{< screenshot src="mautic/tracking-code.png" alt="Mautic Tracking Settings with the tracking script" caption="**Configuration**, **Tracking Settings**." >}}
+
+2. Paste it into your website's pages, before the closing `</body>` tag. On [WordPress](/apps/wordpress/), use a Mautic integration plugin or a header-and-footer plugin.
+3. Visit your site and confirm a new anonymous visitor appears in **Contacts**.
+
+Tracking personal behavior is subject to privacy laws such as GDPR. Make sure your website asks for consent where required.
+
+### Import contacts
+
+**Contacts**, then the dropdown next to **New**, **Import**. Upload a CSV, map the columns to Mautic fields, and choose a segment to add them to.
+
+## Build segments
+
+Go to **Segments**, **New**. Add filters, for example "Country is Canada" and "Tags include webinar-2026". Contacts join and leave the segment automatically as their data changes.
+
+## Send an email
+
+1. Go to **Channels**, **Emails**, **New**.
+2. Choose **Segment email** for a broadcast to segments, or **Template email** for use in campaigns.
+
+   {{< screenshot src="mautic/email-type.png" alt="Mautic asking whether to create a Triggered email or a Segment email" caption="Choosing the email type. Current Mautic versions call template emails **Triggered email**." >}}
+
+3. Pick a theme and open the **Builder** to design the message. Use tokens like `{contactfield=firstname}` to personalize.
+4. Send a test, then save. Segment emails are sent from the email's page.
+
+## Create a campaign
+
+1. Go to **Campaigns**, **New**, and choose the **segments** or **forms** that feed contacts into it.
+
+   {{< screenshot src="mautic/new-campaign.png" alt="The Mautic New Campaign form with the Launch Campaign Builder button" caption="A new campaign. **Launch Campaign Builder** opens the builder." >}}
+
+2. In the **Campaign Builder**, add:
+   - **Actions** (send email, add to segment, adjust points, update a field).
+   - **Decisions** (opens email, clicks link, visits a page, submits a form).
+   - **Conditions** (field values, segment membership).
+3. Set delays between steps, publish the campaign, and watch contacts flow through it.
+
+## Forms and landing pages
+
+- **Components**, **Forms** creates forms you can embed on any website. Submissions create or update contacts and can trigger actions.
+- **Components**, **Landing Pages** builds simple pages hosted on your Mautic address.
+
+## Administer Mautic
+
+Open the gear icon:
+
+- **Users** and **Roles**: who can use Mautic and what they can change.
+- **Configuration**: system settings, email settings (sending service), tracking, and privacy options.
+- **Custom Fields**: add your own contact and company fields.
+- **Plugins**: connect CRMs and other services.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Mautic." >}}
+
+- **Access**: choose which groups are given the Mautic address.
+
+Mautic depends on scheduled tasks to update segments, run campaigns, and send queued email. Federated Computer runs these for you. If campaigns seem stuck, contact support.
+
+{{< warning title="Send through a delivery service" >}}
+For anything beyond small volumes, configure a dedicated email delivery service under **Configuration**, **Email Settings** and set up SPF, DKIM, and DMARC on your domain.
+{{< /warning >}}

content/apps/n8n.md

@@ -0,0 +1,106 @@
+---
+title: "n8n"
+linkTitle: "n8n"
+category: "Development and automation"
+tagline: "Connect your apps and automate repetitive work with visual workflows."
+replaces: ["Zapier", "Make", "Microsoft Power Automate", "IFTTT"]
+address: "n8n.example.com"
+website: "https://n8n.io/"
+upstreamDocs: "https://docs.n8n.io/"
+links:
+  - name: "n8n documentation"
+    url: "https://docs.n8n.io/"
+  - name: "Integrations (nodes) directory"
+    url: "https://n8n.io/integrations/"
+  - name: "Workflow templates"
+    url: "https://n8n.io/workflows/"
+  - name: "Expressions"
+    url: "https://docs.n8n.io/code/expressions/"
+  - name: "n8n community forum"
+    url: "https://community.n8n.io/"
+---
+
+## Overview
+
+n8n is a workflow automation tool. You connect **nodes** on a canvas: a **trigger** that starts the workflow (a schedule, a webhook, a new email, a new form entry) followed by steps that fetch, transform, and send data between services.
+
+Main capabilities:
+
+- Hundreds of built-in **integrations**, plus a generic **HTTP Request** node for any API.
+- **Triggers**: schedules, webhooks, app events, form submissions, and manual runs.
+- **Logic**: IF, Switch, Merge, Loop, Wait, and error handling.
+- **Data transformation** with expressions, and **Code** nodes for JavaScript or Python.
+- **AI nodes** for working with language models, if you provide an API key.
+- **Executions log** to inspect every run, step by step.
+- **Credentials** stored encrypted and reused across workflows.
+- **Templates** to start from common automations.
+
+### What it replaces
+
+n8n replaces Zapier, Make (formerly Integromat), Microsoft Power Automate, and IFTTT, without per-task pricing.
+
+## Signing in
+
+Open your n8n address and sign in with the account created for you. The first account on a new instance becomes the **owner**.
+
+## Build your first workflow
+
+Example: post a message in [Element](/apps/element/) whenever someone submits a [Baserow](/apps/baserow/) form.
+
+1. Choose **Create workflow**.
+2. Add a **trigger**: search for the app (or use **Webhook** or **Schedule Trigger**).
+
+   {{< screenshot src="n8n/add-trigger.png" alt="The n8n trigger picker listing manual, app event, schedule, webhook, and form triggers" caption="Choosing a trigger for a new workflow." >}}
+
+3. Select **+** after the trigger to add the next step, and choose an action node.
+
+   {{< screenshot src="n8n/add-action.png" alt="Adding a step after a Schedule Trigger in n8n, with HTTP Request in the search results" caption="Adding the next step after the trigger." >}}
+
+4. In each node, create or pick **credentials** for the service.
+
+   {{< screenshot src="n8n/trigger-settings.png" alt="The settings panel of an n8n Schedule Trigger node" caption="A node's settings, here for the Schedule Trigger." >}}
+
+5. Use **expressions** to map data from earlier steps. Drag a field from the input panel into a parameter, or type `{{ $json.fieldName }}`.
+6. Choose **Test workflow** (or **Execute step**) to run it with sample data and check each node's output.
+
+   {{< screenshot src="n8n/canvas.png" alt="An n8n workflow canvas with an Execute workflow button and a Publish button" caption="Run the workflow with **Execute workflow**. Turn it on with **Publish** at the top right." >}}
+
+7. Save, then switch the workflow to **Active** so it runs on its own.
+
+## Webhooks
+
+The **Webhook** node gives you two URLs:
+
+- A **test URL**, which works only while you're listening in the editor.
+- A **production URL**, which works once the workflow is active.
+
+Use the production URL in other services, such as [DocuSeal](/apps/docuseal/), [Gitea](/apps/gitea/), or [Cal.com](/apps/calcom/) webhooks.
+
+## Monitor and fix workflows
+
+- **Executions** lists every run with its status. Open one to see the data at each step.
+- Create an **error workflow** (with the **Error Trigger** node) that notifies you when another workflow fails, and select it in each workflow's **Settings**.
+- Pin data on a node during development to avoid calling external services repeatedly.
+
+## Credentials
+
+Credentials (API keys, passwords, OAuth connections) are stored encrypted on your server. Share a credential with colleagues from its **Sharing** tab rather than copying secrets around. Use dedicated service accounts or API tokens with the minimum permissions needed.
+
+## Administer n8n
+
+The owner and admins can open **Settings**:
+
+- **Users**: invite colleagues and set roles.
+- **Community nodes**: install extra nodes published by the community, if enabled on your instance.
+- **Variables** and **external secrets** are part of n8n's paid features and may not be available.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for n8n and whether community nodes are allowed." >}}
+
+- **Access**: choose which groups are given the n8n address.
+- **Owner account**: Federated Computer sets up the initial owner account; contact support to transfer ownership.
+
+{{< warning title="Workflows run with real access" >}}
+A workflow can read and change data in every service it has credentials for. Review workflows before activating them, and limit who can edit them.
+{{< /warning >}}

content/apps/nextcloud.md

@@ -0,0 +1,120 @@
+---
+title: "Nextcloud"
+category: "Files, photos, and documents"
+tagline: "Files, sharing, calendars, contacts, and collaborative editing in one workspace."
+replaces: ["Google Drive", "Dropbox", "Microsoft OneDrive", "Box", "Google Calendar"]
+address: "nextcloud.example.com"
+website: "https://nextcloud.com/"
+upstreamDocs: "https://docs.nextcloud.com/server/latest/user_manual/en/"
+links:
+  - name: "Nextcloud user manual"
+    url: "https://docs.nextcloud.com/server/latest/user_manual/en/"
+  - name: "Nextcloud administration manual"
+    url: "https://docs.nextcloud.com/server/latest/admin_manual/"
+  - name: "Desktop and mobile apps"
+    url: "https://nextcloud.com/install/#install-clients"
+  - name: "Sync calendars and contacts (CalDAV and CardDAV)"
+    url: "https://docs.nextcloud.com/server/latest/user_manual/en/groupware/sync_android.html"
+  - name: "Nextcloud App Store"
+    url: "https://apps.nextcloud.com/"
+---
+
+## Overview
+
+Nextcloud is a file sync and collaboration platform. At its core it keeps your files in sync between your server and your computers and phones, like Dropbox or Google Drive. Around that it adds calendars, contacts, task lists, notes, chat, and in-browser document editing.
+
+Main capabilities:
+
+- **Files**: upload, organize, search, preview, version history, and a trash bin for deleted files.
+- **Sharing**: share with colleagues, groups, or anyone via a link with optional password, expiry date, and upload-only "file drop" mode.
+- **Desktop sync** for Windows, macOS, and Linux, including virtual files that download on demand.
+- **Mobile apps** for iOS and Android with automatic photo upload.
+- **Calendar, Contacts, and Tasks**, which sync to phones and desktop clients using the standard CalDAV and CardDAV protocols.
+- **Office editing** of Word, Excel, and PowerPoint documents in the browser when an office suite (Nextcloud Office or OnlyOffice) is enabled on your server.
+- **Talk** for chat and video calls, **Deck** for kanban boards, **Notes**, **Forms**, and hundreds more apps.
+
+### What it replaces
+
+Nextcloud replaces file services such as Google Drive, Dropbox, Microsoft OneDrive, and Box, and the calendar and contacts parts of Google Workspace and Microsoft 365. With an office suite enabled it also covers basic Google Docs and Office Online editing.
+
+## Signing in
+
+Open your Nextcloud address and sign in with your organization account. If you're sent to the Authelia portal, sign in there first.
+
+{{< note title="Desktop and mobile apps use app passwords" >}}
+The desktop and mobile apps open a browser window to sign you in. If your organization requires two-factor authentication, or you prefer not to give a device your main password, create an **app password** under your avatar, **Personal settings**, **Security**, then **Devices & sessions**. You can revoke it there if the device is lost.
+{{< /note >}}
+
+## Work with files
+
+### Upload and organize
+
+- Drag files or folders onto the **Files** page, or select **+ New** to upload, create a folder, or create a new document.
+- Use **Favorites** (the star) for files you open often, and **Tags** to group files across folders.
+- Search from the magnifier at the top: it searches file names and, where enabled, file contents.
+
+### Recover a deleted or overwritten file
+
+- Deleted files go to **Deleted files** in the left sidebar, where you can restore them.
+- To get back an older version, open the file's details (the **…** menu, then **Details**), go to the **Versions** tab, and restore the version you want.
+
+Retention for deleted files and versions is limited by storage space and server settings, so don't rely on it as a long-term archive.
+
+### Install the desktop client
+
+1. Download the desktop client from [nextcloud.com/install](https://nextcloud.com/install/#install-clients).
+2. Enter your Nextcloud address, for example `https://nextcloud.example.com`, and sign in through the browser window that opens.
+3. Choose which folders to sync. On Windows and macOS, enable **virtual files** to see everything without downloading it all.
+
+## Share files and folders
+
+1. Open the file's **Sharing** tab (the share icon next to the name).
+
+   {{< screenshot src="nextcloud/sharing-tab.png" alt="The Nextcloud Sharing tab for a folder, with internal shares, external shares, and Create public link" caption="The **Sharing** tab. Share with colleagues under **Internal shares**, or create a public link under **External shares**." >}}
+
+2. To share with a colleague, type their name or a group name. Choose whether they can edit, re-share, or only view.
+3. To share with anyone, select **Create a new share link**. Open the link's **…** menu to set a password, an expiry date, or **hide download**.
+
+   {{< screenshot src="nextcloud/link-menu.png" alt="A Nextcloud share link's menu with Customize link, Generate QR code, Add another link, and Unshare" caption="A link's **…** menu. Password, expiry date, and download options are under **Customize link**." >}}
+
+4. For a folder where people outside your organization can upload without seeing other files, choose **File drop (upload only)** in the link's permissions.
+
+   {{< screenshot src="nextcloud/link-permissions.png" alt="A Nextcloud share link's permission menu with View only, Can edit, File request, and Custom permissions" caption="A link's permissions. Current Nextcloud versions call upload-only links **File request**." >}}
+
+Shares appear in the **Shares** section of the sidebar, where you can review and revoke them.
+
+## Calendars and contacts
+
+The **Calendar** and **Contacts** apps work in the browser. To use them in other apps:
+
+- **iPhone and iPad**: in Settings, add a CalDAV and a CardDAV account with server `nextcloud.example.com`, your username, and an app password.
+- **Android**: install DAVx⁵, add an account with your Nextcloud address and an app password, and choose which calendars and address books to sync.
+- **Thunderbird and macOS Calendar**: add a CalDAV account using the link copied from the calendar's **…** menu, **Copy internal link**.
+
+Calendars can be shared with colleagues or published as a read-only link. Use the **Appointments** feature for simple booking pages, or [Cal.com](/apps/calcom/) for more advanced scheduling.
+
+## Edit documents in the browser
+
+If an office suite is enabled on your server, click any `.docx`, `.xlsx`, `.pptx`, or OpenDocument file to open it in the editor. Several people can edit at once, and changes are saved automatically. Use **+ New** to create a document, spreadsheet, or presentation.
+
+## Administer Nextcloud
+
+Administrators see **Administration settings** in the avatar menu. Common tasks:
+
+- **Apps**: enable or disable apps from the **Apps** menu. Only enable apps you need; each one adds maintenance.
+- **Sharing**: under **Administration settings**, **Sharing**, decide whether public links are allowed, whether they need passwords, and default expiry dates.
+- **Theming**: set your organization's name, logo, colors, and background.
+- **Groups and quotas**: see the **Accounts** page. Accounts come from your central directory, so add people in Superpanel, then use Nextcloud to set storage quotas or group folders.
+- **Overview** shows security and setup warnings. Some warnings relate to server settings managed by Federated Computer; contact support if you're unsure.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Nextcloud." >}}
+
+- **Access**: choose which groups can sign in to Nextcloud.
+- **Administrators**: choose who gets Nextcloud admin rights.
+- **Storage**: see how much space your VM has. Contact Federated Computer to increase it.
+
+{{< enterprise >}}
+Enterprise customers can run Nextcloud's `occ` command inside the Nextcloud container for tasks such as rescanning files added directly on disk (`occ files:scan --all`), managing apps in bulk, running maintenance mode, or repairing the file cache. See the [occ documentation](https://docs.nextcloud.com/server/latest/admin_manual/occ_command.html).
+{{< /enterprise >}}

content/apps/plane.md

@@ -0,0 +1,86 @@
+---
+title: "Plane"
+category: "Business operations"
+tagline: "Project and issue tracking with sprints, roadmaps, and docs, for software and beyond."
+replaces: ["Jira", "Linear", "Asana", "Monday.com", "ClickUp"]
+address: "plane.example.com"
+website: "https://plane.so/"
+upstreamDocs: "https://docs.plane.so/"
+links:
+  - name: "Plane documentation"
+    url: "https://docs.plane.so/"
+  - name: "Plane developer docs"
+    url: "https://developers.plane.so/"
+  - name: "Plane on GitHub"
+    url: "https://github.com/makeplane/plane"
+---
+
+## Overview
+
+Plane is a project management tool for planning, tracking, and shipping work. It's popular with software teams as a Jira or Linear alternative, but it works for any team that manages work as tasks moving through stages.
+
+Main capabilities:
+
+- **Work items** (issues) with states, priorities, assignees, labels, due dates, estimates, and sub-items.
+- **Cycles**: time-boxed iterations (sprints) with progress charts.
+- **Modules**: groups of work items for a feature, initiative, or milestone.
+- **Views**: list, kanban board, spreadsheet, calendar, and Gantt, with saved filters.
+- **Pages**: documents for specs, meeting notes, and plans, linked to work.
+- **Intake** for requests from outside the project team.
+- **Workspaces** and **projects** with member roles.
+
+Some features (for example certain importers, advanced views, and workflows) are part of Plane's paid editions. The community edition is what most installations run.
+
+### What it replaces
+
+Plane replaces Jira, Linear, Asana, Monday.com, ClickUp, and Trello.
+
+## Signing in
+
+Open your Plane address and sign in. If it's your first time, you'll be asked to join or create a **workspace**; your administrator will usually have invited you to an existing one.
+
+## Set up a project
+
+1. In the sidebar, select **+** next to **Projects** and give the project a name and identifier (a short code, such as `WEB`, used in work item IDs like `WEB-42`).
+
+   {{< screenshot src="plane/new-project.png" alt="The Plane new project dialog with name Website relaunch and identifier WEB" caption="A new project with the identifier `WEB`." >}}
+
+2. Open **Project settings** to:
+   - Add **members** and set their roles.
+   - Customize **states** (for example Backlog, Todo, In progress, In review, Done).
+   - Create **labels** and set an **estimate** system (points or hours).
+   - Turn features like Cycles, Modules, Pages, and Intake on or off.
+
+   {{< screenshot src="plane/project-states.png" alt="Plane project settings showing the States page" caption="**Project settings**, **States**." >}}
+
+## Work items
+
+- Press <kbd>C</kbd> anywhere in a project to create a work item.
+- Set the state, priority, assignee, labels, and dates from the item's properties.
+- Add **sub-items** to break work down, and **relations** (blocking, blocked by, duplicate) to link items.
+- Comment and @mention colleagues. Mentions and assignments show up in **Inbox** (notifications).
+
+## Plan with cycles and modules
+
+- **Cycles**: create a cycle with start and end dates, then drag work items into it. The cycle page shows a burn-down chart and progress by state, assignee, and label. Unfinished items can be carried over to the next cycle.
+- **Modules**: group items that make up a feature or project, with a lead, members, and target date.
+
+## Views
+
+Switch the layout from the top bar: **List**, **Kanban**, **Spreadsheet**, **Calendar**, or **Gantt**. Apply filters and display options, then save as a **View** to share with the team.
+
+## Pages
+
+Create pages under **Pages** in a project for specs and notes. Type `/` for blocks (headings, lists, tables, images), and convert lines into work items directly from the page.
+
+## Administer Plane
+
+- **Workspace settings** (from the workspace name menu): members, invites, billing (for paid editions), and integrations.
+- **Instance admin** (sometimes called "god mode", at `/god-mode`): instance-wide settings such as sign-up rules, email, and authentication methods. Only instance administrators can open it.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Plane." >}}
+
+- **Access**: choose which groups are given the Plane address.
+- **Instance administrator**: Federated Computer sets up the first instance admin; contact support to change it.

content/apps/plausible.md

@@ -0,0 +1,96 @@
+---
+title: "Plausible"
+category: "Marketing and analytics"
+tagline: "Simple, privacy-friendly website statistics on a single page."
+replaces: ["Google Analytics", "Fathom Analytics", "Simple Analytics"]
+address: "plausible.example.com"
+website: "https://plausible.io/"
+upstreamDocs: "https://plausible.io/docs"
+links:
+  - name: "Plausible documentation"
+    url: "https://plausible.io/docs"
+  - name: "Custom events and goals"
+    url: "https://plausible.io/docs/custom-event-goals"
+  - name: "Plausible Community Edition"
+    url: "https://github.com/plausible/analytics"
+---
+
+## Overview
+
+Plausible gives you the website numbers most people actually need (visitors, pages, sources, countries, devices) on one clear dashboard. It uses no cookies and collects no personal data, so in most cases you don't need a cookie banner for it.
+
+Main capabilities:
+
+- A **single-page dashboard** with unique visitors, page views, bounce rate, and visit duration.
+- **Top sources**, including UTM campaign parameters.
+- **Top pages**, entry pages, and exit pages.
+- **Locations** and **devices** (browser, operating system, screen size).
+- **Goals** and **custom events**, such as sign-ups, downloads, or outbound link clicks.
+- **Funnels** to see where visitors drop off.
+- **Shared links** and public dashboards, plus weekly and monthly email reports.
+- A lightweight script (under 1 KB) that doesn't slow your site.
+
+### What it replaces
+
+Plausible replaces Google Analytics for teams that want a simple overview, and paid privacy-friendly analytics such as Fathom and Simple Analytics. For deeper analysis, see [Matomo](/apps/matomo/).
+
+## Signing in
+
+Open your Plausible address and sign in with the account created for you.
+
+## Add a website
+
+1. Choose **+ Add website**.
+2. Enter your domain (for example `example.com`, without `https://` or `www`) and time zone.
+
+   {{< screenshot src="plausible/add-website.png" alt="The Plausible Add website info form with domain and reporting timezone" caption="Adding a website." >}}
+
+3. Copy the snippet Plausible shows. It looks like this:
+
+   ```html
+   <script defer data-domain="example.com" src="https://plausible.example.com/js/script.js"></script>
+   ```
+
+   {{< screenshot src="plausible/snippet.png" alt="The Plausible Script installation step with the tracking snippet and a Copy button" caption="The snippet to copy, from your own Plausible." >}}
+
+4. Paste it into the `<head>` of every page. On [WordPress](/apps/wordpress/), you can use the official Plausible plugin, which lets you set a self-hosted address.
+5. Visit your site; the dashboard shows the visit within a minute.
+
+   {{< screenshot src="plausible/dashboard.png" alt="A Plausible dashboard showing visitors, pageviews, and a visitor graph for the last 28 days" caption="A Plausible dashboard once visits are coming in." demo="true" >}}
+
+Newer versions of Plausible may show a site-specific script instead. Always copy the snippet from your own dashboard.
+
+## Track goals and events
+
+1. Open the site's **Settings**, **Goals**, and choose **+ Add goal**.
+
+   {{< screenshot src="plausible/goals.png" alt="Plausible Goals settings with the Add goal menu open showing Pageview, Custom event, and Scroll depth" caption="The **Add goal** menu." >}}
+
+2. Choose a **pageview goal** (for example, visits to `/thank-you`) or a **custom event**.
+3. For custom events, either add a class like `plausible-event-name=Signup` to a button or link (requires the script variant with tagged events), or call `plausible('Signup')` from your own JavaScript.
+
+Goals appear at the bottom of the dashboard, with conversion rates.
+
+## Share your dashboard
+
+Under **Settings**, **Visibility**:
+
+- Create a **shared link** (optionally password-protected) for clients or colleagues without accounts.
+- Or make the dashboard **public**.
+
+Add team members under **Settings**, **People**, with **viewer** or **admin** access.
+
+## Email reports
+
+Under **Settings**, **Email reports**, choose weekly or monthly summaries and who receives them. Traffic spike notifications can also be enabled here.
+
+## Import from Google Analytics
+
+Under **Settings**, **Imports & Exports**, you can import historical data from Google Analytics or a CSV export, so your charts don't start from zero.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Plausible." >}}
+
+- **Access**: choose which groups are given the Plausible address.
+- **Registration**: new accounts are usually created by invitation only.

content/apps/powerdns.md

@@ -0,0 +1,101 @@
+---
+title: "PowerDNS"
+category: "Networking and infrastructure"
+tagline: "Authoritative DNS for your domains, so names point to the right servers and email gets delivered."
+replaces: ["Cloudflare DNS", "Amazon Route 53", "Registrar DNS (GoDaddy, Namecheap)"]
+address: "dns.example.com"
+website: "https://www.powerdns.com/"
+upstreamDocs: "https://doc.powerdns.com/authoritative/"
+links:
+  - name: "PowerDNS Authoritative Server documentation"
+    url: "https://doc.powerdns.com/authoritative/"
+  - name: "DNS record types explained (Cloudflare Learning)"
+    url: "https://www.cloudflare.com/learning/dns/dns-records/"
+  - name: "DMARC overview"
+    url: "https://dmarc.org/overview/"
+  - name: "Check your DNS records (Google Admin Toolbox Dig)"
+    url: "https://toolbox.googleapps.com/apps/dig/"
+---
+
+## Overview
+
+PowerDNS is an **authoritative DNS server**. It answers the question "where is `www.example.com`?" for the domains it's responsible for. On Federated Core, it can host the DNS for your domain so that your applications, website, and email all resolve correctly.
+
+What it does:
+
+- Hosts **zones** (domains) and their **records**: A, AAAA, CNAME, MX, TXT, SRV, CAA, and more.
+- Serves records quickly and reliably to the whole internet.
+- Supports **DNSSEC** signing to protect against spoofed answers.
+- Lets Federated Computer add the records your applications need automatically.
+
+### What it replaces
+
+PowerDNS replaces the DNS service you'd otherwise get from Cloudflare, Amazon Route 53, or your domain registrar.
+
+## How DNS on Federated Core works
+
+There are two separate things:
+
+1. **Your registrar** (where you bought the domain) says which nameservers are authoritative for it.
+2. **Those nameservers** hold the actual records.
+
+To have PowerDNS on your Federated Core server serve your domain, the nameservers at your registrar must point to it. Federated Computer gives you the nameserver names during setup. If you prefer to keep DNS at your registrar or with Cloudflare, you can: copy the records shown in Superpanel into that provider instead.
+
+## Manage records
+
+{{< review "confirm whether customers edit PowerDNS records through Superpanel, a PowerDNS-Admin web UI, or both, and update the steps below." >}}
+
+DNS records are managed through Superpanel (and, where provided, a web interface for PowerDNS at the address shown in Superpanel). To add or change a record:
+
+1. Open the zone for your domain.
+2. Add a record with:
+   - **Name**: the part before your domain, such as `www`, or `@` for the domain itself.
+   - **Type**: for example `A`, `CNAME`, `MX`, or `TXT`.
+   - **Content**: the IP address, hostname, or text value.
+   - **TTL**: how long other servers cache the answer. `3600` (one hour) is a sensible default; lower it to `300` a day before planned changes.
+
+   {{< screenshot src="powerdns/add-record.png" alt="A new CNAME record being added in the PowerDNS-Admin zone editor" caption="A new record in the zone editor. Choose **Save** on the row, then **Save Changes** to apply it." >}}
+
+3. Save. Changes reach most of the internet within the TTL of the old record.
+
+{{< warning title="Don't remove Federated Core records" >}}
+Records that point your application subdomains (such as `nextcloud`, `auth`, or `mail`) to your server are required for those apps to work. Removing or changing them can take apps offline or break email. If you're unsure, ask Federated Computer support first.
+{{< /warning >}}
+
+## Common record types
+
+| Type | What it does | Example |
+| --- | --- | --- |
+| A | Points a name to an IPv4 address | `www` → `203.0.113.10` |
+| AAAA | Points a name to an IPv6 address | `www` → `2001:db8::10` |
+| CNAME | Makes one name an alias of another | `shop` → `shops.myshopify.com.` |
+| MX | Says which server receives email | `@` → `10 mail.example.com.` |
+| TXT | Holds text, used for verification and email security | `@` → `"v=spf1 mx -all"` |
+| CAA | Limits which certificate authorities can issue certificates | `@` → `0 issue "letsencrypt.org"` |
+
+## Email records
+
+For email sent from your domain to reach inboxes rather than spam folders, these records must be correct:
+
+- **MX**: points to the server that receives your mail.
+- **SPF** (a TXT record on `@`): lists the servers allowed to send mail for your domain. If you also send through a newsletter service, include it here; a domain may have only one SPF record.
+- **DKIM** (a TXT record on a selector such as `default._domainkey`): a public key used to verify your mail's signature. Federated Computer provides the value for your mail server.
+- **DMARC** (a TXT record on `_dmarc`): tells receivers what to do with mail that fails SPF and DKIM, and where to send reports. Start with `v=DMARC1; p=none; rua=mailto:dmarc@example.com` and tighten to `quarantine` or `reject` once reports look clean.
+
+## Verify your changes
+
+Use a lookup tool such as [Google Admin Toolbox Dig](https://toolbox.googleapps.com/apps/dig/), or from a terminal on your own computer:
+
+```bash
+dig +short MX example.com
+dig +short TXT _dmarc.example.com
+```
+
+## Superpanel settings
+
+- **DNS records**: the records your Federated Core applications need, and, where your plan includes it, the ability to add your own.
+- **Nameservers**: the nameserver names to set at your registrar if you want Federated Core to host your DNS.
+
+{{< enterprise >}}
+Enterprise customers can use `pdnsutil` in the PowerDNS container for bulk changes, for example importing a zone file exported from another provider (`pdnsutil load-zone`) or managing DNSSEC keys.
+{{< /enterprise >}}

content/apps/roundcube.md

@@ -0,0 +1,83 @@
+---
+title: "Roundcube"
+category: "Communication"
+tagline: "Webmail for your organization's email accounts, with filters, signatures, and contacts."
+replaces: ["Gmail (web)", "Outlook on the web", "Yahoo Mail"]
+address: "mail.example.com"
+website: "https://roundcube.net/"
+upstreamDocs: "https://docs.roundcube.net/doc/help/1.1/en_US/"
+links:
+  - name: "Roundcube user help"
+    url: "https://docs.roundcube.net/doc/help/1.1/en_US/"
+  - name: "Roundcube project wiki"
+    url: "https://github.com/roundcube/roundcubemail/wiki"
+  - name: "Thunderbird email client"
+    url: "https://www.thunderbird.net/"
+---
+
+## Overview
+
+Roundcube is a webmail app: it lets you read and send email from your organization's mailboxes in a browser, from any computer. It works with the mail server on your Federated Core installation, so the same mailbox is also available in desktop and phone mail apps.
+
+Main capabilities:
+
+- Read, write, search, and organize mail in folders, with drag and drop.
+- **Conversation (thread) view**, flags, and attachment previews.
+- **Identities and signatures**, including multiple sending addresses.
+- **Filters** that sort, forward, or reply to mail automatically, including **out-of-office** replies.
+- An **address book** with groups and import from vCard or CSV.
+- Light and dark themes, and a responsive layout for phones and tablets.
+
+### What it replaces
+
+Roundcube replaces the web interfaces of Gmail, Outlook on the web, and other hosted email services when your mail is hosted on your own domain with Federated Computer.
+
+## Signing in
+
+Open your Roundcube address and sign in with your full email address (or username, if told to) and your password.
+
+## Read and write mail
+
+- Select **Compose** to write a message. Attach files with the paperclip or by dragging them in.
+- Choose **HTML** in the editor options for formatted mail, or keep **plain text** for maximum compatibility.
+- Use the search box with the dropdown to search in the subject, sender, body, or all folders.
+- Right-click (or use the **More** menu) to mark messages as read, flag them, or move them.
+
+## Set up your signature and sending addresses
+
+1. Go to **Settings**, then **Identities**.
+2. Edit your identity to set your display name and **signature**.
+
+   {{< screenshot src="roundcube/identity.png" alt="Editing an identity in Roundcube with display name, email, organization, and signature" caption="Editing an identity." >}}
+
+3. If you're allowed to send from other addresses (such as `info@`), add them as extra identities. You can then pick the address in the **From** field when composing.
+
+## Filters and out-of-office replies
+
+Filters run on the server, so they work even when Roundcube isn't open.
+
+1. Go to **Settings**, then **Filters**.
+2. Select **Create** and give the filter a name.
+3. Set the rules (for example, "From contains newsletter@") and the actions (move to a folder, forward, mark as read, or delete).
+
+   {{< screenshot src="roundcube/filter.png" alt="A Roundcube filter that marks messages from newsletter@ as read" caption="A filter that marks newsletters as read." >}}
+
+For an automatic **out-of-office** reply, use **Settings**, then **Out of Office** (or **Vacation**, depending on your version). Set the dates, subject, and message, and turn it on.
+
+## Contacts
+
+Open **Contacts** to add people and create groups. Use **Import** to load contacts from a `.vcf` or `.csv` file exported from another service. Addresses you type are suggested automatically when composing.
+
+## Use your mailbox in other apps
+
+Your mailbox works with any email app that supports IMAP and SMTP, such as Thunderbird, Apple Mail, Outlook, or the mail app on your phone. Get the server names and ports from Superpanel or from Federated Computer support. Changes, such as reading or moving a message, sync everywhere.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel options for mailboxes, aliases, and mail client settings." >}}
+
+- **Mailboxes**: email accounts are created with your users in Superpanel.
+- **Aliases and shared addresses**: where offered, add extra addresses that deliver to an existing mailbox.
+- **Mail client settings**: the IMAP and SMTP server names and ports to use in desktop and mobile apps.
+
+For mail to be delivered reliably, your domain needs correct MX, SPF, DKIM, and DMARC DNS records. See [PowerDNS](/apps/powerdns/#email-records).

content/apps/vaultwarden.md

@@ -0,0 +1,122 @@
+---
+title: "Vaultwarden"
+category: "Identity and security"
+tagline: "A password manager for you and your team, compatible with all Bitwarden apps."
+replaces: ["1Password", "LastPass", "Dashlane", "Bitwarden cloud", "Keeper"]
+address: "vaultwarden.example.com"
+website: "https://github.com/dani-garcia/vaultwarden"
+upstreamDocs: "https://bitwarden.com/help/"
+links:
+  - name: "Vaultwarden wiki"
+    url: "https://github.com/dani-garcia/vaultwarden/wiki"
+  - name: "Bitwarden: Connect clients to a self-hosted server"
+    url: "https://bitwarden.com/help/change-client-environment/"
+  - name: "Bitwarden: Download apps and browser extensions"
+    url: "https://bitwarden.com/download/"
+  - name: "Bitwarden: Organizations and collections"
+    url: "https://bitwarden.com/help/about-organizations/"
+---
+
+## Overview
+
+Vaultwarden is a password manager server that works with the official Bitwarden apps, browser extensions, and command-line tool. Your encrypted vault is stored on your Federated Core server instead of a vendor's cloud. Because the vault is encrypted on your device with your master password, nobody on the server side, including Federated Computer, can read your passwords.
+
+What you can store and do:
+
+- Logins, credit cards, identities, and secure notes, with custom fields and file attachments.
+- Autofill in Chrome, Firefox, Safari, and Edge, and on iOS and Android.
+- A password generator and a health report that flags weak, reused, or exposed passwords.
+- **Organizations** to share passwords with your team, organized into **collections** with per-person permissions.
+- **Send**, for sharing a piece of text or a file with an expiry date and optional password.
+- Two-step login, emergency access for a trusted contact, and authenticator codes (TOTP) stored alongside logins.
+
+### What it replaces
+
+Vaultwarden replaces paid team password managers such as 1Password Business, LastPass Teams, Dashlane, and Bitwarden's own hosted Teams and Enterprise plans. Features that Bitwarden charges for, like organizations and attachments, are included.
+
+## Before you start: your master password
+
+Your vault is protected by a **master password** that is separate from your organization sign-in. It is never sent to the server, so **it can't be reset or recovered**. If you forget it, your vault is lost.
+
+- Choose a long passphrase you can remember, for example four or five random words.
+- Set a **master password hint** that only makes sense to you.
+- Consider writing it down and storing it somewhere physically safe.
+
+## Create your account
+
+How accounts are created depends on how your organization set things up:
+
+- **By invitation.** Your administrator invites you to the organization. Open the invitation email and follow the link to create your account.
+- **Open registration.** If enabled, go to your Vaultwarden address and choose **Create account**.
+
+Use your work email address, set your master password, and sign in.
+
+{{< screenshot src="vaultwarden/set-master-password.png" alt="Vaultwarden asking for a master password, a confirmation, and an optional hint" caption="When you first sign in with your organization account, Vaultwarden asks you to set a master password." >}}
+
+## Connect the apps to your server
+
+All Bitwarden apps connect to Bitwarden's cloud by default. Point them at your server instead:
+
+1. Install the Bitwarden browser extension, desktop app, or mobile app from [bitwarden.com/download](https://bitwarden.com/download/).
+2. On the sign-in screen, find the **Logging in on** or region selector and choose **Self-hosted**.
+3. Enter your server URL, for example `https://vaultwarden.example.com`, and save.
+4. Sign in with your email address and master password.
+
+   {{< screenshot src="vaultwarden/login.png" alt="The Vaultwarden sign-in page with an email field and Use single sign-on" caption="The web vault sign-in page." >}}
+
+## Everyday use
+
+### Save and fill passwords
+
+- When you sign in to a website, the browser extension offers to save the login. Accept, and choose a folder if you like.
+- To fill, select the extension icon and pick the login, or use the keyboard shortcut (<kbd>Ctrl</kbd>/<kbd>Cmd</kbd> + <kbd>Shift</kbd> + <kbd>L</kbd> in most browsers).
+- On mobile, enable Bitwarden as your autofill service in your phone's settings.
+
+### Generate strong passwords
+
+Use the **Generator** tab to create a random password or passphrase. When changing a password on a website, generate it from the extension so it's saved at the same time.
+
+### Store two-factor codes
+
+Edit a login and paste the site's 2FA setup key into the **Authenticator key (TOTP)** field. Vaultwarden then shows the current code next to the login and can copy it after autofill.
+
+## Share passwords with your team
+
+Shared passwords live in an **organization**, grouped into **collections** (for example "Finance", "Social media", "Infrastructure").
+
+1. In the web vault, open your organization. Administrators create collections and invite members under **Members**.
+
+   {{< screenshot src="vaultwarden/invite-member.png" alt="The Vaultwarden Invite member dialog with email and member role" caption="Inviting a member from the organization's **Members** page." >}}
+
+2. To share an item you already have, open it and choose **Assign to collections** or move it to the organization.
+3. Members only see the collections they have been given access to, and can be limited to read-only or "hide passwords" access.
+
+When someone leaves, remove them from the organization and **change any passwords they had access to**.
+
+## Secure your account
+
+- Turn on **two-step login** under **Settings**, then **Security**, then **Two-step login**. An authenticator app or a security key is recommended.
+- Save the **recovery code** shown when you enable two-step login. It's the only way back in if you lose your second factor.
+- Set up **Emergency access** if you'd like a trusted person to be able to request access to your vault.
+
+## Import from another password manager
+
+1. Export your data from your old password manager (most offer a CSV or JSON export).
+2. In the web vault, go to **Tools**, then **Import data**, choose the format, and upload the file.
+
+   {{< screenshot src="vaultwarden/import.png" alt="The Vaultwarden Import page with vault, folder, file format, and file fields" caption="The **Import** page." >}}
+
+3. Delete the export file afterwards: it contains your passwords unencrypted.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for Vaultwarden." >}}
+
+- **Access.** Choose which groups should be told about Vaultwarden and given its address.
+- **Registration and invitations.** Where offered, choose whether anyone can create an account or only people invited to an organization.
+
+Vaultwarden also has a server admin page (`/admin`). On Federated Core it's managed by Federated Computer; contact support if you need a server-level change such as allowing sign-ups for a new email domain.
+
+{{< enterprise >}}
+Enterprise customers can be given the admin token for the Vaultwarden `/admin` page, which controls sign-ups, invitations, SMTP, and user management at the server level.
+{{< /enterprise >}}

content/apps/wordpress.md

@@ -0,0 +1,104 @@
+---
+title: "WordPress"
+category: "Websites and media"
+tagline: "Build and run your website or blog, with thousands of themes and plugins."
+replaces: ["Squarespace", "Wix", "WordPress.com", "Medium", "Webflow"]
+address: "www.example.com"
+website: "https://wordpress.org/"
+upstreamDocs: "https://wordpress.org/documentation/"
+links:
+  - name: "WordPress documentation"
+    url: "https://wordpress.org/documentation/"
+  - name: "Learn WordPress (free courses)"
+    url: "https://learn.wordpress.org/"
+  - name: "Block editor guide"
+    url: "https://wordpress.org/documentation/article/wordpress-block-editor/"
+  - name: "Theme directory"
+    url: "https://wordpress.org/themes/"
+  - name: "Plugin directory"
+    url: "https://wordpress.org/plugins/"
+---
+
+## Overview
+
+WordPress powers a large share of the world's websites. Use it for your organization's public site, a blog, a news section, or a simple online shop.
+
+Main capabilities:
+
+- **Pages** for permanent content and **posts** for news and blog entries.
+- The **block editor** for building layouts with text, images, columns, buttons, galleries, and embeds.
+- **Full site editing** with block themes: change headers, footers, and templates visually.
+- **Themes** to change the design and **plugins** to add features (forms, SEO, shops, memberships).
+- **Media library** for images, documents, and video.
+- **Users and roles** (Administrator, Editor, Author, Contributor, Subscriber).
+- **Comments**, categories, tags, menus, and RSS feeds.
+
+### What it replaces
+
+WordPress replaces website builders such as Squarespace, Wix, and Webflow, hosted blogging platforms like WordPress.com and Medium, and, with WooCommerce, basic Shopify stores.
+
+## Signing in
+
+Go to your site's address followed by `/wp-admin`, for example `https://www.example.com/wp-admin`, and sign in. This opens the **Dashboard**.
+
+## Create content
+
+### Pages and posts
+
+1. Go to **Pages**, **Add New** (or **Posts**, **Add New**).
+2. Enter a title, then add content. Type `/` to insert a block, such as `/image` or `/columns`.
+3. In the sidebar, set the featured image, excerpt, categories and tags (posts), and the URL slug.
+4. Choose **Publish**, or **Schedule** a date. Use **Preview** first to check the result.
+
+### Images and media
+
+Drag images into the editor or upload them under **Media**. Add **alt text** to every image: it describes the image for screen reader users and search engines. Resize large photos before uploading to keep your site fast.
+
+## Change the design
+
+- **Appearance**, **Themes**: install and activate themes. Block themes are edited in **Appearance**, **Editor**; classic themes use **Appearance**, **Customize**.
+- **Menus**: in block themes, edit the **Navigation** block in the site editor; in classic themes use **Appearance**, **Menus**.
+- **Site identity**: set your site title, tagline, logo, and site icon.
+
+## Plugins
+
+Go to **Plugins**, **Add New** to search the plugin directory. Before installing, check that the plugin is actively maintained, compatible with your WordPress version, and well reviewed.
+
+Useful plugins for Federated Core customers:
+
+- **Connect Matomo** or the **Plausible Analytics** plugin for [Matomo](/apps/matomo/) or [Plausible](/apps/plausible/).
+- A contact form plugin, or embed a [Listmonk](/apps/listmonk/) subscription form.
+- A Cal.com embed for booking from [Cal.com](/apps/calcom/).
+
+{{< warning title="Keep plugins to a minimum" >}}
+Every plugin is code running on your server, and outdated plugins are the most common way WordPress sites are compromised. Remove plugins you don't use, and keep the ones you do up to date.
+{{< /warning >}}
+
+## Users and roles
+
+Under **Users**, add people and choose a role:
+
+| Role | Can |
+| --- | --- |
+| Administrator | Everything, including themes, plugins, and settings |
+| Editor | Publish and manage everyone's posts and pages |
+| Author | Publish and manage their own posts |
+| Contributor | Write posts, but not publish them |
+| Subscriber | Manage their own profile only |
+
+Give people the lowest role that lets them do their job.
+
+## Updates and backups
+
+Federated Computer keeps the server and WordPress installation maintained. Check **Dashboard**, **Updates** regularly for theme and plugin updates. Your VM is backed up by Federated Computer; for an extra copy of your content, use **Tools**, **Export** to download your posts and pages as an XML file.
+
+## Superpanel settings
+
+{{< review "confirm Superpanel option names for WordPress, which domain the site is served on, and the update policy for plugins/themes." >}}
+
+- **Domain**: choose which address your WordPress site is served on, such as your main domain or a subdomain.
+- **Administrator account**: the first administrator account is provided through Superpanel or Federated Computer support.
+
+{{< enterprise >}}
+Enterprise customers can use **WP-CLI** (`wp`) in the WordPress container for bulk tasks such as search-and-replace after a domain change (`wp search-replace`), resetting a password, or managing plugins in bulk.
+{{< /enterprise >}}

content/getting-started/_index.md

@@ -0,0 +1,9 @@
+---
+title: "Getting started"
+tagline: "How Federated Core is set up, how you sign in, and where to change settings."
+weight: 10
+---
+
+Federated Core is the collection of open-source applications that Federated Computer installs, runs, and maintains for you. Each customer gets their own virtual machine, and each application on it is installed separately for that customer. You use the applications in a web browser (and, for some, in desktop and mobile apps); Federated Computer handles servers, updates, backups, and security patches.
+
+Read these guides in order if you are new. They apply to every application in this documentation.

content/getting-started/accounts-and-sign-in.md

@@ -0,0 +1,39 @@
+---
+title: "Accounts and signing in"
+tagline: "One account for your organization's apps, protected by Authelia."
+weight: 20
+---
+
+## One account, many apps
+
+People in your organization are created once, in Superpanel. That account is stored in a central user directory on your server, and most applications check sign-ins against it. In practice this means:
+
+- The **same username and password** work across the apps that are connected to the directory.
+- When someone's password changes, it changes everywhere.
+- When someone leaves and their account is disabled in Superpanel, they lose access to the connected apps at the same time.
+
+Many apps also sign you in through [Authelia](/apps/authelia/), the single sign-on portal. When you open one of these apps and aren't signed in yet, you are sent to the Authelia sign-in page first, then returned to the app.
+
+{{< note title="Some apps keep their own accounts" >}}
+A few applications are designed for people outside your organization or hold especially sensitive data, so they use separate accounts. Examples include [Vaultwarden](/apps/vaultwarden/) (your password vault has its own master password), and public-facing community or newsletter features in [Discourse](/apps/discourse/) and [Listmonk](/apps/listmonk/). Each application's page says how sign-in works for that app.
+{{< /note >}}
+
+## Signing in for the first time
+
+1. Look for the welcome email from your administrator or from Federated Computer. It contains your username and either a temporary password or a link to set one.
+2. Open any application address on your domain. If you're sent to the Authelia portal, enter your username and password there.
+
+   {{< screenshot src="authelia/sign-in.png" alt="The Authelia sign-in page with username and password fields" caption="The Authelia sign-in page." >}}
+
+3. If your organization requires two-factor authentication, Authelia will ask you to register a second factor. See [Set up two-factor authentication](/apps/authelia/#set-up-two-factor-authentication).
+4. Change any temporary password straight away.
+
+## Forgotten passwords
+
+Use the **Reset password** link on the Authelia sign-in page. A reset link is sent to the email address on your account. If you no longer have access to that mailbox, ask an administrator to reset your password in Superpanel.
+
+## Good habits
+
+- Turn on two-factor authentication, even if it's optional for your organization.
+- Store your password in [Vaultwarden](/apps/vaultwarden/) rather than reusing it.
+- Sign out on shared computers. Signing out of Authelia ends your single sign-on session for all connected apps.

content/getting-started/command-line-access.md

@@ -0,0 +1,34 @@
+---
+title: "Command-line access"
+tagline: "What the Enterprise option adds, and how to get advanced tasks done without it."
+weight: 40
+---
+
+## Standard installations
+
+On a standard Federated Core installation, you do **not** have shell or SSH access to your virtual machine. You manage everything through:
+
+- **Superpanel**, for people, groups, application access, and server-level options.
+- **Each application's own admin screens**, for everything inside the app.
+
+This covers nearly everything most organizations need. When a task in these guides needs the command line, it's marked like this:
+
+{{< enterprise >}}
+This step uses a command run on the server.
+{{< /enterprise >}}
+
+If you see that callout and you don't have Enterprise, contact Federated Computer support and describe what you want done. They can run the command for you.
+
+## Enterprise installations
+
+If Federated Core was installed using the Enterprise option, your designated administrators also have command-line access to the VM. That makes extra tasks possible, such as:
+
+- Running application maintenance tools (for example Nextcloud's `occ`, Discourse's Rails console, or Bookstack's `artisan` commands).
+- Bulk imports and exports that are too large for a web upload.
+- Inspecting application logs directly.
+
+{{< warning title="Shared responsibility" >}}
+Command-line changes can affect updates and backups that Federated Computer performs. Before changing application configuration files or installed versions, check with Federated Computer support so that your change isn't overwritten by the next update.
+{{< /warning >}}
+
+Applications on Federated Core run in containers. Commands in these guides that start with an application tool (such as `occ` or `php artisan`) must be run inside that application's container. Federated Computer will tell Enterprise customers how containers are named on their server.

content/getting-started/getting-help.md

@@ -0,0 +1,26 @@
+---
+title: "Getting help"
+tagline: "Where to go when something isn't working or you're not sure how to do something."
+weight: 50
+---
+
+## Start here
+
+1. **Search this site.** Press <kbd>/</kbd> anywhere to jump to the search box. You can search by app name or by the service you're used to, such as "Dropbox" or "Zoom".
+2. **Check the application's official documentation.** Every app page links to it. Upstream manuals are detailed and cover features these guides only summarize.
+3. **Ask your administrator.** Account, password, and access problems are usually solved in Superpanel.
+
+## Contact Federated Computer support
+
+Contact support when:
+
+- An application is down, slow, or showing server errors.
+- You need a task done that requires the command line and you don't have the Enterprise option.
+- You want to add an application to your plan.
+- You think something is wrong with backups, email delivery, or certificates.
+
+When you write, include the application's address, what you were trying to do, what happened instead, and the time it happened. Screenshots help.
+
+## Community help
+
+Each project has its own community forum or chat. These are good places to ask "how do I…" questions about features. Don't post passwords, internal addresses, or customer data in public forums.

content/getting-started/how-federated-core-works.md

@@ -0,0 +1,41 @@
+---
+title: "How Federated Core works"
+tagline: "Your own server, your own domain, and open-source applications maintained for you."
+weight: 10
+---
+
+## What you get
+
+When you sign up, Federated Computer creates a virtual machine (VM) for your organization and installs the applications included in your plan. Each application is installed individually for you. There is no shared, multi-tenant database: your files, messages, and records are stored on your VM.
+
+Every application is open source. That means:
+
+- **No per-seat licence fees** to the software vendor. You pay Federated Computer for hosting and maintenance.
+- **No lock-in.** Data is kept in standard, documented formats, and the same software can run anywhere.
+- **Upstream documentation applies.** Each app has a large community and its own manual. These guides link to it wherever it helps.
+
+## Where your applications live
+
+Each application is published on its own web address under your domain. The address usually follows the pattern `https://appname.yourdomain.com`, for example `https://nextcloud.example.com` or `https://vaultwarden.example.com`. The exact address of every app on your server is listed in Superpanel.
+
+{{< note title="Bookmark your start page" >}}
+Save the addresses of the apps you use every day as browser bookmarks, or pin them as installed web apps in Chrome, Edge, or Safari. Several apps (Nextcloud, Element, Vaultwarden, Immich) also have mobile and desktop apps; you will need the address when you first sign in.
+{{< /note >}}
+
+## Who does what
+
+| Task | Who handles it |
+| --- | --- |
+| Server hardware, operating system, and networking | Federated Computer |
+| Installing and updating applications | Federated Computer |
+| TLS certificates (the padlock in your browser) | Federated Computer |
+| Backups of the VM | Federated Computer |
+| Adding people, resetting passwords, assigning access | Your administrators, in Superpanel |
+| Settings inside each application (branding, workflows, content) | Your administrators, in each app's own admin screens |
+| Using the applications | Everyone in your organization |
+
+## Two ways Federated Core can be installed
+
+Most customers use the **standard** installation. You manage everything through web interfaces: Superpanel, plus each application's own settings pages. You do not have shell (command-line) access to the VM.
+
+Customers who chose the **Enterprise** option during installation also get command-line access to their VM. Some advanced tasks in these guides (marked with an Enterprise callout) can only be done that way. If you don't have Enterprise and need one of those tasks done, contact Federated Computer support. See [Command-line access](../command-line-access/).

content/getting-started/superpanel.md

@@ -0,0 +1,50 @@
+---
+title: "Superpanel"
+tagline: "The web control panel for your Federated Core server: people, access, and application settings."
+weight: 30
+---
+
+Superpanel is where administrators in your organization manage the Federated Core server without needing the command line. If a task in these guides says "in Superpanel", this is the place.
+
+{{< review "Menu labels below describe Superpanel's functions in general terms. Confirm wording against the current Superpanel release before publishing." >}}
+
+## Who can use Superpanel
+
+Only people your organization has made Superpanel administrators can sign in to it. Everyone else uses the applications directly. If you need something changed and you aren't an administrator, ask one of your administrators or contact Federated Computer support.
+
+## What you can do in Superpanel
+
+### Manage people
+
+- **Add a person.** Enter their name, username, and email address. The account is created in your central directory and becomes available in every connected application.
+- **Reset a password** for someone who is locked out.
+- **Disable or remove an account** when someone leaves. Disabling is usually the better first step: the person can no longer sign in, but files and records they own stay in place until you've reassigned them.
+- **Make someone an administrator** of Superpanel or of individual applications.
+
+### Manage groups and application access
+
+Groups let you grant access to several people at once. Typical uses are giving a team access to a particular application, or giving a smaller group administrator rights inside an app. Changes made here apply to the connected applications the next time the person signs in.
+
+### See and manage applications
+
+Superpanel lists every application installed on your server, along with its web address. From here, administrators can:
+
+{{< screenshot src="superpanel/dashboard.png" alt="The Superpanel dashboard showing account and group counts, storage, and installed applications" caption="The Superpanel dashboard. Each application in the sidebar links to its address." >}}
+
+- Find the address of each application to share with colleagues.
+- Request or enable an application that is available for your plan but not yet installed.
+- Change the options Federated Computer exposes for that application, such as whether it is visible to all users or only to certain groups.
+
+The options available for each application are listed on that application's page in this documentation, under **Superpanel settings**.
+
+### Domain and email settings
+
+Federated Core publishes applications on your own domain. Superpanel shows the DNS records your domain needs and, where your plan includes it, lets you manage DNS through [PowerDNS](/apps/powerdns/). If you host your domain's DNS elsewhere, copy the records shown into your DNS provider.
+
+## Settings that live inside each app
+
+Superpanel handles accounts, access, and server-level options. Everything else (branding, workflows, content, notification preferences, integrations) is configured in the application itself, usually under a menu called **Settings**, **Administration**, or **Admin**. Each application page in this documentation explains where to find those screens.
+
+{{< note title="What Superpanel doesn't do" >}}
+Superpanel doesn't give access to the VM's operating system, files on disk, or application configuration files. Those require command-line access, which is only available with the Enterprise option. For standard installations, Federated Computer support can make those changes for you.
+{{< /note >}}

hugo.toml

@@ -0,0 +1,61 @@
+baseURL = "https://docs.example.com/"
+locale = "en-us"
+title = "Federated Computer Documentation"
+enableGitInfo = false
+disableKinds = ["taxonomy", "term", "rss"]
+
+[params]
+  description = "How to use the applications hosted for you by Federated Computer on Federated Core."
+  company = "Federated Computer"
+  companyURL = "https://www.federated.computer"
+  # Shown in examples. Customers replace this with their own domain.
+  exampleDomain = "example.com"
+
+
+[outputs]
+  home = ["HTML", "JSON"]
+
+[markup.goldmark.renderer]
+  unsafe = true
+[markup.tableOfContents]
+  startLevel = 2
+  endLevel = 3
+[markup.highlight]
+  noClasses = false
+  style = "github"
+
+[menus]
+  [[menus.main]]
+    name = "Getting started"
+    pageRef = "/getting-started"
+    weight = 10
+  [[menus.main]]
+    name = "Applications"
+    pageRef = "/apps"
+    weight = 20
+
+# Category order and descriptions used on the home page and in the sidebar.
+[[params.appGroups]]
+  name = "Identity and security"
+  blurb = "Sign in once, keep passwords safe."
+[[params.appGroups]]
+  name = "Files, photos, and documents"
+  blurb = "Store, share, write, and sign."
+[[params.appGroups]]
+  name = "Communication"
+  blurb = "Chat, meet, email, and discuss."
+[[params.appGroups]]
+  name = "Business operations"
+  blurb = "Customers, support, projects, time, and finance."
+[[params.appGroups]]
+  name = "Marketing and analytics"
+  blurb = "Newsletters, campaigns, and visitor statistics."
+[[params.appGroups]]
+  name = "Websites and media"
+  blurb = "Publish sites and podcasts."
+[[params.appGroups]]
+  name = "Development and automation"
+  blurb = "Code hosting and workflow automation."
+[[params.appGroups]]
+  name = "Networking and infrastructure"
+  blurb = "DNS and private networking."

layouts/_markup/render-link.html

@@ -0,0 +1,7 @@
+{{- $u := urls.Parse .Destination -}}
+{{- $href := .Destination -}}
+{{- if and (not $u.IsAbs) (strings.HasPrefix .Destination "/") -}}
+  {{- $href = relURL (strings.TrimPrefix "/" .Destination) -}}
+{{- end -}}
+<a href="{{ $href | safeURL }}"{{ with .Title }} title="{{ . }}"{{ end }}{{ if $u.IsAbs }} rel="noopener"{{ end }}>{{ .Text }}</a>
+{{- /* chomp */ -}}

layouts/_partials/directory.html

@@ -0,0 +1,25 @@
+{{/* Application directory grouped by category. Context: dict with "headingLevel". */}}
+{{ $apps := (site.GetPage "/apps").Pages }}
+{{ $h := .headingLevel | default 2 }}
+<div class="directory">
+{{ range site.Params.appGroups }}
+  {{ $group := .name }}
+  {{ $inGroup := where $apps "Params.category" $group }}
+  {{ with $inGroup }}
+  <section class="dir-group" id="{{ $group | anchorize }}">
+    <header class="dir-group-head">
+      <h{{ $h }}>{{ $group }}</h{{ $h }}>
+    </header>
+    <ul class="dir-list">
+      {{ range .ByTitle }}
+      <li class="dir-row">
+        <a class="dir-name" href="{{ .RelPermalink }}">{{ .LinkTitle }}</a>
+        <span class="dir-desc">{{ .Params.tagline }}</span>
+        {{ with .Params.replaces }}<span class="dir-replaces"><span class="visually-hidden">Use instead of </span>{{ range $i, $n := first 3 . }}{{ if $i }}<span class="sep">, </span>{{ end }}<s>{{ $n }}</s>{{ end }}</span>{{ end }}
+      </li>
+      {{ end }}
+    </ul>
+  </section>
+  {{ end }}
+{{ end }}
+</div>

layouts/_partials/footer.html

@@ -0,0 +1,6 @@
+<footer class="site-footer">
+  <div class="site-footer-inner">
+    <p>Documentation for applications hosted by <a href="{{ site.Params.companyURL }}">{{ site.Params.company }}</a> on Federated Core. Each application runs on your own virtual machine.</p>
+    <p>Application names and trademarks belong to their respective projects. Links to upstream documentation open the project's own website.</p>
+  </div>
+</footer>

layouts/_partials/header.html

@@ -0,0 +1,23 @@
+<header class="masthead">
+  <div class="masthead-inner">
+    <button class="nav-toggle" type="button" aria-controls="sidebar" aria-expanded="false">
+      <span class="nav-toggle-bars" aria-hidden="true"></span><span class="visually-hidden">Menu</span>
+    </button>
+    <a class="brand" href="{{ "/" | relURL }}">
+      {{ partial "mark.html" . }}
+      <span class="brand-text">Federated Computer <span class="brand-sub">Docs</span></span>
+    </a>
+    <nav class="topnav" aria-label="Primary">
+      {{ $current := . }}
+      {{ range site.Menus.main }}
+        <a href="{{ .URL }}"{{ if or ($current.IsMenuCurrent "main" .) ($current.HasMenuCurrent "main" .) (and .Page ($current.IsDescendant .Page)) }} aria-current="true"{{ end }}>{{ .Name }}</a>
+      {{ end }}
+    </nav>
+    <div class="search" role="search">
+      <label class="visually-hidden" for="search-input">Search the documentation</label>
+      <input id="search-input" type="search" placeholder="Search apps and guides" autocomplete="off" spellcheck="false" aria-controls="search-results" aria-expanded="false">
+      <kbd class="search-key" aria-hidden="true">/</kbd>
+      <ol id="search-results" class="search-results" hidden></ol>
+    </div>
+  </div>
+</header>

layouts/_partials/mark.html

@@ -0,0 +1 @@
+<img class="mark" src="{{ "clifford.svg" | relURL }}" width="32" height="28" alt="">

layouts/_partials/pager.html

@@ -0,0 +1,15 @@
+{{ $pages := slice }}
+{{ if eq .Section "apps" }}
+  {{ $pages = (site.GetPage "/apps").Pages.ByTitle }}
+{{ else }}
+  {{ with .CurrentSection }}{{ $pages = .Pages.ByWeight }}{{ end }}
+{{ end }}
+{{ if and $pages (not .IsSection) }}
+{{ $prev := $pages.Prev . }}
+{{ $next := $pages.Next . }}
+{{/* Pages.Next/Prev are reversed relative to reading order */}}
+<nav class="pager" aria-label="Previous and next">
+  {{ with $next }}<a class="pager-prev" href="{{ .RelPermalink }}"><span>Previous</span>{{ .LinkTitle }}</a>{{ end }}
+  {{ with $prev }}<a class="pager-next" href="{{ .RelPermalink }}"><span>Next</span>{{ .LinkTitle }}</a>{{ end }}
+</nav>
+{{ end }}

layouts/_partials/replaces.html

@@ -0,0 +1,6 @@
+{{/* Renders the list of proprietary services an app can replace, struck through. */}}
+{{ with .Params.replaces }}
+<span class="replaces">
+  {{ range $i, $name := . }}{{ if $i }}<span class="sep">, </span>{{ end }}<s>{{ $name }}</s>{{ end }}
+</span>
+{{ end }}

layouts/_partials/sidebar.html

@@ -0,0 +1,31 @@
+{{ $current := . }}
+<nav id="sidebar" class="sidebar" aria-label="Documentation">
+  {{ with site.GetPage "/getting-started" }}
+  <div class="side-group">
+    <a class="side-heading{{ if eq $current . }} is-current{{ end }}" href="{{ .RelPermalink }}"{{ if eq $current . }} aria-current="page"{{ end }}>{{ .Title }}</a>
+    <ul>
+      {{ range .Pages.ByWeight }}
+      <li><a href="{{ .RelPermalink }}"{{ if eq $current . }} aria-current="page"{{ end }}>{{ .LinkTitle }}</a></li>
+      {{ end }}
+    </ul>
+  </div>
+  {{ end }}
+  {{ with site.GetPage "/apps" }}
+  {{ $apps := .Pages }}
+  <div class="side-group">
+    <a class="side-heading{{ if eq $current . }} is-current{{ end }}" href="{{ .RelPermalink }}"{{ if eq $current . }} aria-current="page"{{ end }}>Applications</a>
+    {{ range site.Params.appGroups }}
+      {{ $group := .name }}
+      {{ $inGroup := where $apps "Params.category" $group }}
+      {{ with $inGroup }}
+      <p class="side-sub">{{ $group }}</p>
+      <ul>
+        {{ range .ByTitle }}
+        <li><a href="{{ .RelPermalink }}"{{ if eq $current . }} aria-current="page"{{ end }}>{{ .LinkTitle }}</a></li>
+        {{ end }}
+      </ul>
+      {{ end }}
+    {{ end }}
+  </div>
+  {{ end }}
+</nav>