Stapelwerk is a guided Docker stack composer that checks your stack before it ever boots — the VPN kill-switch verified by construction, no port collisions, no default secrets — and hands you a clean docker-compose.yml you can run anywhere.
# Media server · composed & checked jellyfin ✓ ready sonarr radarr ✓ ready prowlarr ✓ linked qbittorrent ✗ not routed through gluetun — your IP would leak port 8096 ✗ collides with another service → remap resources ✓ fits your Pi 4 (3.1 / 4 GB) # fix the 2 flags → export a compose that actually boots
A torrent client running beside a VPN container looks safe — until the tunnel drops and your real IP leaks. It's the most common wiring mistake in self-hosted media stacks, and you usually find out the hard way. Stapelwerk encodes the fix once and verifies it on every build:
network_mode: service:gluetun), publishes no ports of its own, and depends on the gateway.cap_add: [NET_ADMIN] + /dev/net/tun and owns the routed ports.It isn't advice that looks right — an LLM can type that. It's a checked, versioned, runnable artifact: the wiring rules live in code and are enforced on every single build.
The Media Server template ships pre-wired: Jellyfin + Sonarr / Radarr / Prowlarr + qBittorrent + Gluetun, download client already confined to the tunnel. Add or swap services from a curated catalog.
Compatibility, port collisions, required dependencies, resource budget ("does this fit my Pi 4?"), and the kill-switch check — live, with a jump-to-fix for every finding.
A secret-secured docker-compose.yml plus a key-sovereign deploy.sh that runs on your machine over your SSH — or hand it to Coolify, Portainer, Dokploy or Openship. No lock-in, ever.
One time, per stack: Stapelwerk generates an ed25519-signed report attesting what was actually verified in your compose — a provenance artifact you can keep, share, and check against our published public key.
* Honest scope: the report attests the configuration is safe by construction — it names exactly what was checked and marks everything else "not checked". It is not a promise about software you install later or CVEs discovered tomorrow. On local-socket deploys you can additionally run a runtime attestation that boots the stack and confirms traffic actually dies when the VPN drops.
| Pos. | Item | Price | |
|---|---|---|---|
1.0 |
Free foreverCompose from templates & catalog · all checks, incl. the kill-switch · export compose + deploy.sh + handoff guides. No account needed to self-host. |
€0 | Start composing |
2.0 |
Verified deployed25519-signed deploy-safety report · kill-switch + safety audit, attested · verifiable with our public key. | €29one time, per stack | Get verified |
3.0 |
SupporterFunds independent development · your name in SUPPORTERS. A thank-you, not a feature unlock. |
€99per year | Become a supporter |
// the self-host promise: a self-hosted Stapelwerk has every feature and zero gates — signed reports included, free. Plan limits exist only on the hosted instance. That's what AGPL-3.0 open-core means here.
docker-compose.yml you can run anywhere.network_mode: service:gluetun), publishes no ports of its own and depends on the gateway. If a stack has a download client and a VPN but is not routed through it, Stapelwerk raises a hard VPN-leak error before deploy.(SHTAH-pel-verk) — Stapel is German for stack, and a Stapellauf is the moment a shipyard launches a correctly built ship. Stapelwerk is the works where your stack gets built, checked and verified — before it launches.