Upgrade HeyForm from v0.1.0 to v3.0.5

v0.1.0 (Feb 2025) has dozens of published security advisories fixed in
v3. Tested against a copy of the database first; forms load unchanged.

v3 listens on 9157, keeps uploads under packages/server, and uses Redis 8
commands, so KeyDB is replaced by redis:8-alpine. The homepage URL is now
https (v3's CORS allowlist is built from it), Caddy is the trusted proxy,
public sign-up is off, and integration credentials get their own key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/README.md

@@ -48,7 +48,7 @@ Tags: each category file has a category tag, each service its own tag.
 | `paperlessngx` | Paperless-ngx | Version pinned by `paperless_version` in `group_vars/docker/services.yml`; read the release notes before bumping. Redis, Gotenberg, Tika (pinned to the versions Paperless ships with). Pocket ID through django-allauth (`paperlessngx.env.j2`). Rejects duplicate documents. Daily S3 backup of the data and media volumes. |
 | `baikal` | Baikal | CalDAV/CardDAV. Caddy redirects the `.well-known` paths. |
 | `syncthing` | Syncthing | Ports on the Tailscale IP only. |
-| `heyform` | HeyForm | MongoDB (Percona) and KeyDB. On `forms.nerder.land`. |
+| `heyform` | HeyForm v3 | Pinned version. MongoDB 4.4 (Percona, as upstream) and Redis 8 (v3 needs it). Port 9157. Public sign-up is off; people join through workspace invitations. On `forms.nerder.land`. |
 | `dawarich` | Dawarich | App, Sidekiq, PostGIS, Redis. Based on the upstream production compose file. |
 | `obsidian-livesync` | CouchDB for Obsidian LiveSync | Port 5984 on the Tailscale IP only. Has a restart handler. |
 | `gokapi` | Gokapi | Pocket ID login. `config.json` is only written on a fresh install, because Gokapi rewrites it on upgrade. To change it, delete `/opt/stacks/gokapi/config/config.json` and redeploy. |

roles/docker/tasks/productivity/heyform.yml

@@ -17,4 +17,5 @@
   community.docker.docker_compose_v2:
     project_src: /opt/stacks/heyform
     files:
-    - compose.yml
+    - compose.yml
+    remove_orphans: true  # KeyDB was replaced by Redis

roles/docker/templates/Caddyfile.j2

@@ -103,7 +103,7 @@ nerder.land {
 }
 
 forms.nerder.land {
-    reverse_proxy heyform-heyform-1:8000
+    reverse_proxy heyform-heyform-1:9157
 }
 
 listmonk.nerder.land {

roles/docker/templates/heyform-compose.yml.j2

@@ -1,19 +1,26 @@
 services:
   heyform:
-    image: heyform/community-edition:latest
+    # Pinned: v3 changed the port, paths and Redis requirements. Read the
+    # release notes before bumping.
+    image: heyform/community-edition:v3.0.5
     restart: always
     volumes:
       # Persist uploaded images
-      - assets:/app/static/upload
+      - assets:/app/packages/server/static/upload
     depends_on:
       - mongo
-      - keydb
+      - redis
     environment:
-      - APP_HOMEPAGE_URL=http://{{ subdomains.heyform }}
+      - APP_HOMEPAGE_URL=https://{{ subdomains.heyform }}
+      # Only Caddy may set X-Forwarded-For
+      - TRUST_PROXY={{ docker.hairpin_ip }}
+      # No public sign-up; new people join through workspace invitations
+      - APP_DISABLE_REGISTRATION=true
       - SESSION_KEY={{ vault_heyform.session_key }}
       - FORM_ENCRYPTION_KEY={{ vault_heyform.encryption_key }}
-      - MONGO_URI='mongodb://mongo:27017/heyform'
-      - REDIS_HOST=keydb
+      - INTEGRATION_ENCRYPTION_KEY={{ vault_heyform.integration_encryption_key }}
+      - MONGO_URI=mongodb://mongo:27017/heyform
+      - REDIS_HOST=redis
       - REDIS_PORT=6379
       - SMTP_FROM=nerderland@{{ email_domains.updates }}
       - SMTP_HOST={{ smtp.host }}
@@ -23,29 +30,32 @@ services:
       - SMTP_SECURE=true
 
   mongo:
+    # HeyForm's own compose files still use 4.4
     image: percona/percona-server-mongodb:4.4
     restart: always
     volumes:
       # Persist MongoDB data
       - database:/data/db
 
-  keydb:
-    image: eqalpha/keydb:latest
+  redis:
+    # v3 needs Redis 8 commands (HGETDEL), so KeyDB no longer works
+    image: redis:8-alpine
     restart: always
-    command: keydb-server --appendonly yes
+    command: redis-server --appendonly yes
+    labels:
+      mag37.dockcheck.update: true
     volumes:
-      # Persist KeyDB data
-      - keydb:/data
+      - redis:/data
 
 volumes:
   assets:
     driver: local
   database:
     driver: local
-  keydb:
+  redis:
     driver: local
 
 networks:
   default:
     external: true
-    name: {{ docker.network_name }}
+    name: {{ docker.network_name }}