🛠️ AI All-in-One Blueprint

This blueprint builds a private, self-hosted AI powerhouse that unites over 20 open-source tools into one seamless system. It replaces Google NotebookLM, paid voice cloning, token-wasting workflows, and fragmented agent setups with a single Docker stack running on your own hardware.

Core principles: unlimited local AI, zero external data sharing (unless you opt into APIs), token optimization via Headroom, and enterprise‑grade agent orchestration with PaperClick/n8n.

Everything runs behind a reverse proxy with automatic Let's Encrypt certificates. All apps share a single .env file and a common Docker network, making integration effortless.

Data flow highlights: Documents go through MarkItDown/PaddleOCR → vector store → Open Notebook & AnythingLLM. Voice recordings enter VoiceBox → transcription via Whisper → stored as text. n8n/PaperClick orchestrate multi-step jobs: research agent uses Dearflow + Thy Days, drafting in Open Notebook, voiceover in VoiceBox, video in Hyperframe. All LLM calls pass through Headroom for token compression. Security tools scan skill packages and codebases before deployment.

Every service is defined in Docker Compose with Traefik labels. They share a .env file. Below are example snippets. (Full compose in Deployment section)

# .env (shared)
DOMAIN=yourdomain.com
TRAEFIK_NETWORK=traefik-public
OLLAMA_HOST=ollama
HEADROOM_URL=http://headroom:8080
AUTHELIA_JWT_SECRET=change-me

# docker-compose snippet: Open Notebook with Traefik
  open-notebook:
    image: opennotebook/open-notebook:latest
    environment:
      - OLLAMA_BASE_URL=http://ollama:11434
      - VECTOR_DB=chroma
    volumes:
      - notebook_data:/data
    networks:
      - traefik-public
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.notebook.rule=Host(`notebook.${DOMAIN}`)"
      - "traefik.http.routers.notebook.entrypoints=websecure"
      - "traefik.http.routers.notebook.tls.certresolver=letsencrypt"

# Voice Box integration
  voicebox:
    image: voicebox/voicebox:latest
    environment:
      - WHISPER_MODEL=base
      - TTS_MODEL=quen-tts
    volumes:
      - voice_data:/models
    networks:
      - traefik-public
    labels:
      - "traefik.http.routers.voicebox.rule=Host(`voice.${DOMAIN}`)"

Ollama is the backbone: all services that need local LLMs point to http://ollama:11434. Headroom is called as a pre-processing middleware in n8n or Python scripts.

version: '3.9'
services:
  traefik:
    image: traefik:v3.0
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.email=admin@${DOMAIN}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - letsencrypt_data:/letsencrypt
    networks:
      - traefik-public

  authelia:
    image: authelia/authelia:4
    volumes:
      - ./authelia/config:/config
    environment:
      - AUTHELIA_JWT_SECRET_FILE=/run/secrets/jwt
    networks:
      - traefik-public
    labels:
      - "traefik.http.routers.authelia.rule=Host(`auth.${DOMAIN}`)"
      - "traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://auth.${DOMAIN}"

  ollama:
    image: ollama/ollama:latest
    volumes:
      - ollama_data:/root/.ollama
    networks:
      - traefik-public
    deploy:
      resources:
        reservations:
          devices:
            - capabilities: [gpu]

  open-notebook:
    image: opennotebook/open-notebook:latest
    environment:
      - OLLAMA_BASE_URL=http://ollama:11434
    volumes:
      - notebook_data:/data
    networks:
      - traefik-public
    labels:
      - "traefik.http.routers.notebook.rule=Host(`notebook.${DOMAIN}`)"
      - "traefik.http.routers.notebook.tls=true"

  voicebox:
    image: voicebox/voicebox:latest
    volumes:
      - voice_data:/models
    networks:
      - traefik-public
    labels:
      - "traefik.http.routers.voicebox.rule=Host(`voice.${DOMAIN}`)"

  anythingllm:
    image: mintplexlabs/anythingllm:latest
    environment:
      - STORAGE_DIR=/app/server/storage
      - OLLAMA_BASE_URL=http://ollama:11434
    volumes:
      - anythingllm_data:/app/server/storage
    networks:
      - traefik-public
    labels:
      - "traefik.http.routers.anythingllm.rule=Host(`llm.${DOMAIN}`)"

  n8n:
    image: n8nio/n8n:latest
    environment:
      - N8N_BASIC_AUTH_ACTIVE=true
      - N8N_BASIC_AUTH_USER=admin
      - N8N_BASIC_AUTH_PASSWORD=admin
    volumes:
      - n8n_data:/home/node/.n8n
    networks:
      - traefik-public
    labels:
      - "traefik.http.routers.n8n.rule=Host(`n8n.${DOMAIN}`)"

  paperclick:
    image: paperclick/paperclick:latest
    environment:
      - OLLAMA_URL=http://ollama:11434
    networks:
      - traefik-public
    labels:
      - "traefik.http.routers.paperclick.rule=Host(`paperclick.${DOMAIN}`)"

  headroom:
    image: headroom/optimizer:latest
    networks:
      - traefik-public

  # ... (all other services follow the same pattern: BrowserUse, Firecrawl, etc.)

volumes:
  letsencrypt_data:
  ollama_data:
  notebook_data:
  voice_data:
  anythingllm_data:
  n8n_data:

networks:
  traefik-public:
    external: true

Quick start: Create .env with your domain, then docker network create traefik-public, docker compose up -d. All apps will be available under their subdomains with automatic HTTPS.

PaperClick acts as the CEO, delegating to specialized agents. A typical multi-agent workflow:

1. Research Agent (Dearflow + Thy Days + BrowserUse) gathers web trends, social opinions, and deep analysis.
2. Content Agent (Open Notebook + AnythingLLM) drafts documents, notes, and scripts using Ollama models.
3. Voice Agent (VoiceBox) narrates the script, clones your voice, or generates TTS.
4. Video Agent (Hyperframe + Open Montage) produces the final video with animations.

n8n ties them together with a visual workflow: on a schedule, it triggers research → stores in vector DB → passes to Notebook → generates voice → renders video → saves to shared volume. All API calls are compressed by Headroom before hitting any external LLM.

• Skill Spector: Before installing any community skill or plugin, run skill-spector scan ./skill-folder to detect 68 vulnerability patterns.
• Brond F: Automatically audits codebases and reports vulnerabilities before publishing apps.
• Anthropic Cyber Security Skills: 66+ audit checks for cloud, web, malware. Integrate into CI/CD.
• Headroom: Route all outgoing LLM requests through Headroom. Example n8n node: POST http://headroom:8080/compress before sending to OpenAI API, reducing tokens by 80%+.
• Backups: Docker volumes are mounted; cron job runs docker run --rm -v notebook_data:/data alpine tar czf /backup/notebook-$(date +%F).tgz -C /data .
• Updates: docker compose pull && docker compose up -d

Sarah wants to create a weekly AI news video without relying on any cloud service.

1. She opens Open Notebook (notebook.yourdomain.com) and creates a project “AI Weekly Recap”.

2. An n8n workflow kicks off: Thy Days scrapes trending Reddit threads and YouTube comments; Dearflow performs deep research on the hottest topics.

3. The findings are saved as Markdown files via MarkItDown and stored in the vector database.

4. AnythingLLM drafts a script using the collected data. Sarah reviews and tweaks it inside the same notebook.

5. She sends the script to VoiceBox (voice.yourdomain.com) and generates a natural voiceover.

6. Hyperframe receives the script and voiceover, plus a branding template (HTML/CSS), and renders an MP4 video.

7. The final video is saved to a shared volume; Sarah downloads it or shares via the local network. Throughout, Headroom minimized token costs for any external API calls, and Skill Spector verified all newly installed plugins.

Quick-Start Commands

docker network create traefik-public
cp .env.example .env   # set DOMAIN and secrets
docker compose up -d
# Verify: curl -k https://notebook.yourdomain.com

Official Documentation Links

• Open Notebook: https://github.com/open-notebook
• Voice Box: https://voicebox.ai (open source)
• Headroom: https://github.com/headroom
• Skill Spector: https://github.com/NVIDIA/skill-spector
• PaperClick: https://paperclick.dev
• AnythingLLM: https://docs.anythingllm.com
• n8n: https://docs.n8n.io
• ComfyUI: https://github.com/comfyanonymous/ComfyUI
• Ollama: https://ollama.ai
• MarkItDown: https://github.com/microsoft/markitdown
• PaddleOCR: https://github.com/PaddlePaddle/PaddleOCR
• BrowserUse: https://docs.browser-use.com
• Firecrawl: https://firecrawl.dev
• Dearflow: https://github.com/dearflow
• Hyperframe: https://hyperframe.ai
• Open Montage: https://openmontage.org
• Gstack: https://gstack.io
• Superpowers: https://github.com/superpowers
• Brond F: https://brondf.dev
• Anthropic Cyber Skills: https://github.com/anthropics/cyber-skills
• Open Generative AI: https://open-gen.ai
• Obsidian: https://obsidian.md
• Hermes Agent: https://github.com/NousResearch/hermes
• Yang: https://github.com/yang (chat UI)

Troubleshooting

If a service doesn't start, check logs with docker compose logs service-name. Ensure the .env file is correctly sourced and the traefik-public network exists. For GPU support in Ollama, install nvidia-container-toolkit.