feat(dnsweaver): traefik router labels on all HTTP UIs; exclude list trimmed to DBs/agents

All HTTP-served containers (web UIs + metrics APIs) now carry explicit router-rule labels so dnsweaver manages their arnoutvw.nl rewrites end to end (no more relying on traefik defaultRule). krusader fixed to noVNC 8080-ish label -> 6080. EXCLUDE_DOMAINS reduced to databases, workers and agents (postgres14/mariadb/redis/postgresql17/komodo-mongo/ bookorbit-db/immich_postgres/immich_ml/dawarich_*db-redis-sidekiq/ influxdb/newt*/komodo-periphery/dockersocket/subsyncarr/wordpress-blues).
2026-10-05 09:10:52 +02:00
1 parent 5060226c23
commit 0eb590f455
@@ -52,6 +52,9 @@ services:
    ipc: "private"

    labels:
+      traefik.enable: "true"
+      traefik.http.routers.mealie.rule: Host(`mealie.arnoutvw.nl`)
+      traefik.http.services.mealie.loadbalancer.server.port: "9000"
      net.unraid.docker.managed: "dockerman"
      net.unraid.docker.webui: "http://[IP]:[PORT:9926]"
      org.opencontainers.image.created: "2026-05-06T18:51:16.487Z"
@@ -255,6 +258,9 @@ services:
    ipc: "private"

    labels:
+      traefik.enable: "true"
+      traefik.http.routers.ntfy.rule: Host(`ntfy.arnoutvw.nl`)
+      traefik.http.services.ntfy.loadbalancer.server.port: "80"
      cloudflare.tunnel.enable: "true"
      cloudflare.tunnel.hostname: "ntfy.arnoutvw.nl"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/binwiederhier/ntfy:v2.28.0/main/docs/static/img/ntfy.png"
@@ -326,6 +332,9 @@ services:
    ipc: "private"

    labels:
+      traefik.enable: "true"
+      traefik.http.routers.wallos.rule: Host(`wallos.arnoutvw.nl`)
+      traefik.http.services.wallos.loadbalancer.server.port: "80"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/devzwf/unraid-docker-templates/main/images/wallos.png"
      net.unraid.docker.managed: "dockerman"
      net.unraid.docker.webui: "http://[IP]:[PORT:80]/"
@@ -475,6 +484,9 @@ services:
    ipc: "private"

    labels:
+      traefik.enable: "true"
+      traefik.http.routers.homepage.rule: Host(`homepage.arnoutvw.nl`)
+      traefik.http.services.homepage.loadbalancer.server.port: "3000"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/gethomepage/homepage/main/public/android-chrome-512x512.png"
      net.unraid.docker.managed: "dockerman"
      net.unraid.docker.webui: "http://[IP]:[PORT:3000]"
@@ -615,6 +627,9 @@ services:
    ipc: "private"

    labels:
+      traefik.enable: "true"
+      traefik.http.routers.paperless-ng.rule: Host(`paperless-ng.arnoutvw.nl`)
+      traefik.http.services.paperless-ng.loadbalancer.server.port: "8000"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/selfhosters/unRAID-CA-templates/master/templates/img/paperless.png"
      net.unraid.docker.managed: "dockerman"
      net.unraid.docker.webui: "http://[IP]:[PORT:8000]"
@@ -701,6 +716,9 @@ services:
    ipc: "private"

    labels:
+      traefik.enable: "true"
+      traefik.http.routers.paperless-ngx-kristin.rule: Host(`paperless-ngx-kristin.arnoutvw.nl`)
+      traefik.http.services.paperless-ngx-kristin.loadbalancer.server.port: "8000"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/selfhosters/unRAID-CA-templates/master/templates/img/paperless.png"
      net.unraid.docker.managed: "dockerman"
      net.unraid.docker.webui: "http://[IP]:[PORT:8000]"
@@ -833,6 +851,9 @@ services:
    ipc: "private"

    labels:
+      traefik.enable: "true"
+      traefik.http.routers.syncthing.rule: Host(`syncthing.arnoutvw.nl`)
+      traefik.http.services.syncthing.loadbalancer.server.port: "8384"
      build_version: "Linuxserver.io version:- v2.0.16-ls216 Build-date:- 2026-05-09T04:12:55+00:00"
      maintainer: "thelamer"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/syncthing-icon.png"
@@ -74,6 +74,10 @@ services:
      - "PGADMIN_DEFAULT_EMAIL=arnoutvw@gmail.com"
      - "PGADMIN_DEFAULT_PASSWORD=${PGADMIN_PASSWORD}"
    image: "dpage/pgadmin4:9.18"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.pgadmin4.rule=Host(`pgadmin4.arnoutvw.nl`)
+      - traefik.http.services.pgadmin4.loadbalancer.server.port=80
    ipc: "private"
    logging:
      driver: "json-file"
@@ -107,6 +111,10 @@ services:
      - "MEMORY_LIMIT=512M"
      - "UPLOAD_LIMIT=8192K"
    image: "lscr.io/linuxserver/phpmyadmin:5.2.3-ls252"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.phpmyadmin.rule=Host(`phpmyadmin.arnoutvw.nl`)
+      - traefik.http.services.phpmyadmin.loadbalancer.server.port=80
    ipc: "private"
    logging:
      driver: "json-file"
@@ -11,6 +11,9 @@ services:
      - "PUID=99"
    image: "binhex/arch-jackett:0.24"
    labels:
+      traefik.enable: "true"
+      traefik.http.routers.binhex-jackett.rule: Host(`binhex-jackett.arnoutvw.nl`)
+      traefik.http.services.binhex-jackett.loadbalancer.server.port: "9117"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/binhex/docker-templates/master/binhex/images/jackett-icon.png"
      net.unraid.docker.webui: "http://[IP]:[PORT:9117]/"
      org.opencontainers.image.authors: "binhex"
@@ -211,6 +214,9 @@ services:
      - "SPOTWEB_DB_NAME=spotweb"
    image: "jgeusebroek/spotweb:20260919"
    labels:
+      traefik.enable: "true"
+      traefik.http.routers.spotweb.rule: Host(`spotweb.arnoutvw.nl`)
+      traefik.http.services.spotweb.loadbalancer.server.port: "80"
      Author: "Jeroen Geusebroek <me@jeroengeusebroek.nl>"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/riffsphereha/Unraid-Templates/main/spotweb/Spotweb.webp"
      net.unraid.docker.webui: "http://[IP]:[PORT:80]"
@@ -293,6 +299,9 @@ services:
      - "HOST_HOSTNAME=Atlas"
    image: "ghcr.io/thecfu/scraparr:3.2.0"
    labels:
+      traefik.enable: "true"
+      traefik.http.routers.scraparr.rule: Host(`scraparr.arnoutvw.nl`)
+      traefik.http.services.scraparr.loadbalancer.server.port: "7100"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/jordan-dalby/unraidtemplates/refs/heads/main/images/scraparr.png"
      net.unraid.docker.webui: "http://[IP]:[PORT:7100]/metrics"
      org.opencontainers.image.created: "2025-06-16T13:12:32.406Z"
@@ -348,6 +357,9 @@ services:
      - "WEBUI_PORTS=9696/tcp,9696/udp"
    image: "ghcr.io/hotio/prowlarr:release-2.5.2.5491"
    labels:
+      traefik.enable: "true"
+      traefik.http.routers.prowlarr.rule: Host(`prowlarr.arnoutvw.nl`)
+      traefik.http.services.prowlarr.loadbalancer.server.port: "9696"
      net.unraid.docker.icon: "https://hotio.dev/webhook-avatars/prowlarr.png"
      net.unraid.docker.webui: "http://[IP]:[PORT:9696]"
      org.opencontainers.image.created: "2025-07-08T23:37:25.000Z"
@@ -454,6 +466,9 @@ services:
    volumes:
      - /mnt/user/appdata/wizarrr:/data
    labels:
+      traefik.enable: "true"
+      traefik.http.routers.wizarr.rule: Host(`wizarr.arnoutvw.nl`)
+      traefik.http.services.wizarr.loadbalancer.server.port: "5690"
      pangolin.proxy-resources.wizarr.name: wizarr
      pangolin.proxy-resources.wizarr.full-domain: wizarr.arnoutvw.nl
      pangolin.proxy-resources.wizarr.protocol: http
@@ -482,7 +497,10 @@ services:

  kavita:
    image: ghcr.io/kareadita/kavita:0.9.1    # Using the stable branch from ghcr.io
-    container_name: kavita
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.kavita.rule=Host(`kavita.arnoutvw.nl`)
+      - traefik.http.services.kavita.loadbalancer.server.port=5000
    network_mode: bridge
    volumes:
      - /mnt/user/books:/books
@@ -628,7 +646,10 @@ services:
      - "TZ=Europe/Berlin"
      - "NZBHYDRA2_RELEASE_TYPE=Release"
    image: "lscr.io/linuxserver/nzbhydra2:v7.16.3-ls62"
-    ipc: "private"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.hydra2.rule=Host(`hydra2.arnoutvw.nl`)
+      - traefik.http.services.hydra2.loadbalancer.server.port=5076
    logging:
      driver: "json-file"
      options:
@@ -77,6 +77,10 @@ services:
    # For hardware acceleration, add one of -[armnn, cuda, rocm, openvino, rknn] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:v3.2.4-openvino
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.immich_machine_learning.rule=Host(`immich_machine_learning.arnoutvw.nl`)
+      - traefik.http.services.immich_machine_learning.loadbalancer.server.port=3003
    extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
      file: hwaccel.ml.yml
      service: openvino # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
@@ -134,6 +138,9 @@ services:
      - "EXPORTER_LOG_LEVEL=INFO"
    image: "friendlyfriend/prometheus-immich-exporter:1.2.4-dev"
    labels:
+      traefik.enable: "true"
+      traefik.http.routers.prometheus-immich-exporter.rule: Host(`prometheus-immich-exporter.arnoutvw.nl`)
+      traefik.http.services.prometheus-immich-exporter.loadbalancer.server.port: "8000"
      net.unraid.docker.icon: "https://github.com/friendlyFriend4000/prometheus-immich-exporter/blob/master/unraid/immich-logo.png?raw=true"
      net.unraid.docker.managed: "dockerman"
      net.unraid.docker.webui: "http://[IP]:[PORT:8000]"
@@ -30,7 +30,7 @@ services:
      DNSWEAVER_ADGUARD_TARGET: 192.168.10.144
      DNSWEAVER_ADGUARD_ZONE: arnoutvw.nl
      DNSWEAVER_ADGUARD_DOMAINS: "*.arnoutvw.nl"
-      DNSWEAVER_ADGUARD_EXCLUDE_DOMAINS: adguard-exporter.arnoutvw.nl,bazarr.arnoutvw.nl,binhex-jackett.arnoutvw.nl,binhex-krusader.arnoutvw.nl,bookorbit-db.arnoutvw.nl,cadvisor.arnoutvw.nl,chrome.arnoutvw.nl,cloudcommander.arnoutvw.nl,dawarich_db.arnoutvw.nl,dawarich_redis.arnoutvw.nl,dawarich_sidekiq.arnoutvw.nl,dockersocket.arnoutvw.nl,duplicati.arnoutvw.nl,fileflows.arnoutvw.nl,grafana.arnoutvw.nl,homepage.arnoutvw.nl,hydra2.arnoutvw.nl,immich_machine_learning.arnoutvw.nl,immich_postgres.arnoutvw.nl,influxdb-1.8.arnoutvw.nl,kavita.arnoutvw.nl,komodo-mongo.arnoutvw.nl,komodo-periphery.arnoutvw.nl,maintainerr.arnoutvw.nl,mariadb.arnoutvw.nl,mealie.arnoutvw.nl,n8n.arnoutvw.nl,netbootxyz.arnoutvw.nl,newt-secondary.arnoutvw.nl,newt.arnoutvw.nl,ntfy.arnoutvw.nl,paperless-ng.arnoutvw.nl,paperless-ngx-kristin.arnoutvw.nl,pgadmin4.arnoutvw.nl,phpmyadmin.arnoutvw.nl,postgres14.arnoutvw.nl,postgres_exporter.arnoutvw.nl,postgresql17.arnoutvw.nl,qdirstat.arnoutvw.nl,redis.arnoutvw.nl,scraparr.arnoutvw.nl,stash.arnoutvw.nl,stirlingpdf.arnoutvw.nl,wallos.arnoutvw.nl,wordpress-blues.arnoutvw.nl
+      DNSWEAVER_ADGUARD_EXCLUDE_DOMAINS: postgres14.arnoutvw.nl,mariadb.arnoutvw.nl,redis.arnoutvw.nl,postgresql17.arnoutvw.nl,komodo-mongo.arnoutvw.nl,bookorbit-db.arnoutvw.nl,immich_postgres.arnoutvw.nl,dawarich_db.arnoutvw.nl,dawarich_redis.arnoutvw.nl,dawarich_sidekiq.arnoutvw.nl,influxdb-1.8.arnoutvw.nl,newt.arnoutvw.nl,newt-secondary.arnoutvw.nl,komodo-periphery.arnoutvw.nl,dockersocket.arnoutvw.nl,subsyncarr.arnoutvw.nl,wordpress-blues.arnoutvw.nl

  smartctl-exporter:
    image: quay.io/prometheuscommunity/smartctl-exporter:v0.14.0
@@ -44,7 +44,10 @@ services:
      - "9633:9633"
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:v0.55.1
-    container_name: cadvisor
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.cadvisor.rule=Host(`cadvisor.arnoutvw.nl`)
+      - traefik.http.services.cadvisor.loadbalancer.server.port=8080
    pull_policy: always
    restart: unless-stopped
    network_mode: bridge
@@ -70,6 +73,9 @@ services:
      - "HOST_CONTAINERNAME=prometheus"
    image: "prom/prometheus:v3.15.0"
    labels:
+      traefik.enable: "true"
+      traefik.http.routers.prometheus.rule: Host(`prometheus.arnoutvw.nl`)
+      traefik.http.services.prometheus.loadbalancer.server.port: "9090"
      maintainer: "The Prometheus Authors <prometheus-developers@googlegroups.com>"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/selfhosters/unRAID-CA-templates/master/templates/img/prometheus.png"
      net.unraid.docker.managed: "dockerman"
@@ -12,6 +12,10 @@ services:
      - "STASH_CONFIG_FILE=/root/.stash/config.yml"
      - "TZ=Europe/Berlin"
    image: "stashapp/stash:v0.31.1"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.stash.rule=Host(`stash.arnoutvw.nl`)
+      - traefik.http.services.stash.loadbalancer.server.port=9999
    ipc: "private"
    logging:
      driver: "json-file"
@@ -44,6 +48,10 @@ services:
      - "CacheFilePath=/config/clips.json"
      - "ASPNETCORE_URLS=http://+:5000"
    image: "ghcr.io/imagegenius/teslacamplayer:2024.8.11.923-ig37"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.teslacamplayer.rule=Host(`teslacamplayer.arnoutvw.nl`)
+      - traefik.http.services.teslacamplayer.loadbalancer.server.port=5000
    ipc: "private"
    logging:
      driver: "json-file"
@@ -48,6 +48,10 @@ services:
      - "ADGUARD_PASSWORDS=${ADGUARD_PASSWORDS}"
      - "TZ=Europe/Berlin"
    image: "ghcr.io/henrywhitaker3/adguard-exporter:v1.2.1"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.adguard-exporter.rule=Host(`adguard-exporter.arnoutvw.nl`)
+      - traefik.http.services.adguard-exporter.loadbalancer.server.port=9618
    ipc: "private"
    logging:
      driver: "json-file"
@@ -105,6 +109,10 @@ services:
    environment:
      - "TZ=Europe/Berlin"
    image: "quay.io/prometheuscommunity/postgres-exporter:v0.20.1"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.postgres_exporter.rule=Host(`postgres_exporter.arnoutvw.nl`)
+      - traefik.http.services.postgres_exporter.loadbalancer.server.port=9187
    ipc: "private"
    logging:
      driver: "json-file"
@@ -168,6 +176,10 @@ services:
      - "GF_SERVER_ROOT_URL=http://grafana.arnoutvw.nl"
      - "GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}"
    image: "grafana/grafana:13.2.3"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.grafana.rule=Host(`grafana.arnoutvw.nl`)
+      - traefik.http.services.grafana.loadbalancer.server.port=3000
    ipc: "private"
    logging:
      driver: "json-file"
@@ -37,6 +37,9 @@ services:
    ipc: "private"

    labels:
+      traefik.enable: "true"
+      traefik.http.routers.adguardhome-sync.rule: Host(`adguardhome-sync.arnoutvw.nl`)
+      traefik.http.services.adguardhome-sync.loadbalancer.server.port: "8080"
      build_version: "Linuxserver.io version:- v0.9.0-ls163 Build-date:- 2026-04-22T08:08:27+00:00"
      maintainer: "thespad"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/linuxserver-ls-logo.png"
@@ -175,6 +178,9 @@ services:
    ipc: "private"

    labels:
+      traefik.enable: "true"
+      traefik.http.routers.netbootxyz.rule: Host(`netbootxyz.arnoutvw.nl`)
+      traefik.http.services.netbootxyz.loadbalancer.server.port: "3000"
      maintainer: "antonym"
      net.unraid.docker.icon: "https://raw.githubusercontent.com/linuxserver/docker-templates/master/linuxserver.io/img/netbootxyz-logo.png"
      net.unraid.docker.managed: "dockerman"
@@ -165,6 +165,9 @@ services:
    image: "ghcr.io/maintainerr/maintainerr:3.30.1"

    labels:
+      traefik.enable: "true"
+      traefik.http.routers.maintainerr.rule: Host(`maintainerr.arnoutvw.nl`)
+      traefik.http.services.maintainerr.loadbalancer.server.port: "6246"
      Description: "Contains the Maintainerr Docker image"
      net.unraid.docker.icon: "https://github.com/jorenn92/Maintainerr/blob/main/ui/public/logo.png?raw=true"
      net.unraid.docker.webui: "http://[IP]:[PORT:6246]"
@@ -237,7 +240,10 @@ services:

  prom-plex-exporter:
    image: ghcr.io/timothystewart6/prometheus-plex-exporter@sha256:90dc0799601c334f2945a3d5b4b552a06352b208a8ce88a428cf90d6c9aa51cd
-    ports:
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.prom-plex-exporter.rule=Host(`prom-plex-exporter.arnoutvw.nl`)
+      - traefik.http.services.prom-plex-exporter.loadbalancer.server.port=9000
      - "9403:9000/tcp"
    network_mode: "bridge"
    restart: always
@@ -10,6 +10,10 @@ services:
      - "cloudcmd_terminal_path=gritty"
      - "cloudcmd_open=false"
    image: "coderaiser/cloudcmd:19.21.1"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.cloudcommander.rule=Host(`cloudcommander.arnoutvw.nl`)
+      - traefik.http.services.cloudcommander.loadbalancer.server.port=8000
    ipc: "private"
    logging:
      driver: "json-file"
@@ -42,6 +46,10 @@ services:
      - "CA_TS_FALLBACK_DIR=/app/Data"
      - "DOTNET_CLI_TELEMETRY_OPTOUT=true"
    image: "revenz/fileflows:26.09"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.fileflows.rule=Host(`fileflows.arnoutvw.nl`)
+      - traefik.http.services.fileflows.loadbalancer.server.port=5000
    ipc: "private"
    logging:
      driver: "json-file"
@@ -85,6 +93,10 @@ services:
      - "SUP_GROUP_IDS="
      - "KEEP_APP_RUNNING=0"
    image: "jlesage/qdirstat:v26.09.1"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.qdirstat.rule=Host(`qdirstat.arnoutvw.nl`)
+      - traefik.http.services.qdirstat.loadbalancer.server.port=5800
    ipc: "private"
    logging:
      driver: "json-file"
@@ -169,6 +181,10 @@ services:
      - "TERM=xterm"
      - "LANG=en_GB.UTF-8"
    image: "ghcr.io/binhex/arch-krusader:2.9.0-2-01"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.binhex-krusader.rule=Host(`binhex-krusader.arnoutvw.nl`)
+      - traefik.http.services.binhex-krusader.loadbalancer.server.port=6080
    ipc: "private"
    logging:
      driver: "json-file"
@@ -243,6 +259,10 @@ services:
      - "DUPLICATI__WEBSERVICE_INTERFACE=any"
      - "DUPLICATI__WEBSERVICE_ALLOWED_HOSTNAMES=*"
    image: "linuxserver/duplicati:v2.4.0.0_stable_2026-09-03-ls310"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.duplicati.rule=Host(`duplicati.arnoutvw.nl`)
+      - traefik.http.services.duplicati.loadbalancer.server.port=8200
    ipc: "private"
    logging:
      driver: "json-file"
@@ -285,6 +305,10 @@ services:
      - "DISABLE_DRI3=false"
      - "DISABLE_ZINK=false"
    image: "lscr.io/linuxserver/chrome:154.0.8037.97-1-ls127"
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.chrome.rule=Host(`chrome.arnoutvw.nl`)
+      - traefik.http.services.chrome.loadbalancer.server.port=3000
    ipc: "private"
    logging:
      driver: "json-file"