All HTTP-served containers (web UIs + metrics APIs) now carry explicit
router-rule labels so dnsweaver manages their arnoutvw.nl rewrites end
to end (no more relying on traefik defaultRule). krusader fixed to
noVNC 8080-ish label -> 6080. EXCLUDE_DOMAINS reduced to databases,
workers and agents (postgres14/mariadb/redis/postgresql17/komodo-mongo/
bookorbit-db/immich_postgres/immich_ml/dawarich_*db-redis-sidekiq/
influxdb/newt*/komodo-periphery/dockersocket/subsyncarr/wordpress-blues).
Newt 1.18.1 enforces this feature; newt runs on the default bridge and
resource targets are host-IP ports, so the host-container lookup can never
match -> 'failed to find host container' on every docker event, breaking
docker-label blueprint provisioning (since 1.12.5->1.18.1 bump on Oct 2).
:latest and floating tags pinned to the exact digest/tag each
container currently runs, verified against registry manifest
digests. Digest-pinned where no matching version tag exists
(mealie, homepage, syncthing, glances, telegraf, fileflows,
teslacamplayer, sockpuppetbrowser, postgres-exporter, cadvisor,
plex-exporter). Renovate can now update each to real releases.
- glances: new image crashes without TERM (curses init) — set TERM=xterm.
- photon: commented out. New image layout (no uv) and its OSM update
wants 153GB temp / 137GB available on docker.img nvme. Re-enable
after disk decision.
- Pocket-ID: ENCRYPTION_KEY contains $ — Komodo .env interpolation
eats it. Inline with $$ YAML escape (value already in git history
from master.yaml; rotate later).
- photon: image dropped uv; use image default CMD, strip stale PATH/JAVA.
- glances: PYTHON_VERSION must be 3.14 to match image venv.
Arnout van Westen