normalize all stacks to conventions

- VOL_PATH always defaults to /data; vscode/opencode VOL_PROJECTS nests it
- TZ defaults to America/Vancouver (was UTC in etherpad, ntfy, redis)
- compose section order fixed (volumes before environment, command after networks)
- all default secrets are the literal ChangeThisPassword (grep-friendly,
  users must change them); removed a real key from ollama sample.env
- sample.env synced with compose: missing vars added with defaults, dead vars removed
- invoiceninja_dev/openarchiver_dev: app services had no environment block,
  wired all sample.env vars through so the stacks actually work
- opencode: sample.env OLLAMA_HOST renamed to OLLAMA_HOST_URL to match compose
- TZ values unquoted consistently

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

openarchiver_dev/compose.yaml

@@ -7,18 +7,18 @@ services:
     environment:
       - POSTGRES_DB=${POSTGRES_DB:-open_archive}
       - POSTGRES_USER=${POSTGRES_USER:-admin}
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-password}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-ChangeThisPassword}
     networks:
       - internal
 
   valkey:
     image: ${VALKEY_IMAGE:-valkey/valkey:8-alpine}
     restart: ${OPENARCHIVER_RESTART:-unless-stopped}
-    command: valkey-server --requirepass ${REDIS_PASSWORD:-RedisPasswordChangeMe}
     volumes:
       - ${VOL_PATH:-/data}/openarchiver/valkeydata:/data
     networks:
       - internal
+    command: valkey-server --requirepass ${REDIS_PASSWORD:-ChangeThisPassword}
 
   meilisearch:
     image: ${MEILISEARCH_IMAGE:-getmeili/meilisearch:v1.15}
@@ -26,7 +26,7 @@ services:
     volumes:
       - ${VOL_PATH:-/data}/openarchiver/meilidata:/meili_data
     environment:
-      - MEILI_MASTER_KEY=${MEILI_MASTER_KEY:-aSampleMasterKey}
+      - MEILI_MASTER_KEY=${MEILI_MASTER_KEY:-ChangeThisPassword}
     networks:
       - internal
 
@@ -41,6 +41,28 @@ services:
     restart: ${OPENARCHIVER_RESTART:-unless-stopped}
     volumes:
       - ${VOL_PATH:-/data}/openarchiver/archiver-data:/var/data/open-archiver
+    environment:
+      - NODE_ENV=${NODE_ENV:-production}
+      - PORT_BACKEND=${PORT_BACKEND:-4000}
+      - PORT_FRONTEND=${PORT_FRONTEND:-3000}
+      - SYNC_FREQUENCY=${SYNC_FREQUENCY:-* * * * *}
+      - DATABASE_URL=postgresql://${POSTGRES_USER:-admin}:${POSTGRES_PASSWORD:-ChangeThisPassword}@postgres:5432/${POSTGRES_DB:-open_archive}
+      - MEILI_HOST=${MEILI_HOST:-http://meilisearch:7700}
+      - MEILI_MASTER_KEY=${MEILI_MASTER_KEY:-ChangeThisPassword}
+      - MEILI_INDEXING_BATCH=${MEILI_INDEXING_BATCH:-500}
+      - REDIS_HOST=${REDIS_HOST:-valkey}
+      - REDIS_PORT=${REDIS_PORT:-6379}
+      - REDIS_PASSWORD=${REDIS_PASSWORD:-ChangeThisPassword}
+      - REDIS_TLS_ENABLED=${REDIS_TLS_ENABLED:-false}
+      - STORAGE_TYPE=${STORAGE_TYPE:-local}
+      - BODY_SIZE_LIMIT=${BODY_SIZE_LIMIT:-100M}
+      - STORAGE_LOCAL_ROOT_PATH=${STORAGE_LOCAL_ROOT_PATH:-/var/data/open-archiver}
+      - RATE_LIMIT_WINDOW_MS=${RATE_LIMIT_WINDOW_MS:-60000}
+      - RATE_LIMIT_MAX_REQUESTS=${RATE_LIMIT_MAX_REQUESTS:-100}
+      - JWT_SECRET=${JWT_SECRET:-ChangeThisPassword}
+      - JWT_EXPIRES_IN=${JWT_EXPIRES_IN:-7d}
+      - ENCRYPTION_KEY=${ENCRYPTION_KEY:-ChangeThisPassword}
+      - TIKA_URL=${TIKA_URL:-http://tika:9998}
     ports:
       - "${OPENARCHIVER_PORT:-3000}:3000"
     networks:

openarchiver_dev/sample.env

@@ -14,11 +14,10 @@ SYNC_FREQUENCY='* * * * *'
 # PostgreSQL
 POSTGRES_DB=open_archive
 POSTGRES_USER=admin
-POSTGRES_PASSWORD=password
-DATABASE_URL="postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}"
+POSTGRES_PASSWORD=ChangeThisPassword
 
 # Meilisearch
-MEILI_MASTER_KEY=aSampleMasterKey
+MEILI_MASTER_KEY=ChangeThisPassword
 MEILI_HOST=http://meilisearch:7700
 # The number of emails to batch together for indexing. Defaults to 500.
 MEILI_INDEXING_BATCH=500
@@ -26,7 +25,7 @@ MEILI_INDEXING_BATCH=500
 # Redis (We use Valkey, which is Redis-compatible and open source)
 REDIS_HOST=valkey
 REDIS_PORT=6379
-REDIS_PASSWORD=RedisPasswordChangeMe
+REDIS_PASSWORD=ChangeThisPassword
 # If you run Valkey service from Docker Compose, set the REDIS_TLS_ENABLED variable to false.
 REDIS_TLS_ENABLED=false
 
@@ -52,14 +51,21 @@ RATE_LIMIT_MAX_REQUESTS=100
 
 # JWT
 # IMPORTANT: Change this to a long, random, and secret string in your .env file
-JWT_SECRET=a-very-secret-key-that-you-should-change
+JWT_SECRET=ChangeThisPassword
 JWT_EXPIRES_IN="7d"
 
 # Master Encryption Key for sensitive data (Such as Ingestion source credentials and passwords)
 # IMPORTANT: Generate a secure, random 32-byte hex string for this
 # You can use `openssl rand -hex 32` to generate a key.
-ENCRYPTION_KEY=bbffe1e3ae16ee30e8e4f15b401a46d34582147e14526a0f37f93d4ad5c6cb04
+ENCRYPTION_KEY=ChangeThisPassword
 
 # Apache Tika Integration
 # ONLY active if TIKA_URL is set
 TIKA_URL=http://tika:9998
+MEILISEARCH_IMAGE=getmeili/meilisearch:v1.15
+OPENARCHIVER_IMAGE=logiclabshq/open-archiver:latest
+OPENARCHIVER_PORT=3000
+OPENARCHIVER_RESTART=unless-stopped
+POSTGRES_IMAGE=postgres:17-alpine
+TIKA_IMAGE=apache/tika:3.2.2.0-full
+VALKEY_IMAGE=valkey/valkey:8-alpine