All HTTP-served containers (web UIs + metrics APIs) now carry explicit
router-rule labels so dnsweaver manages their arnoutvw.nl rewrites end
to end (no more relying on traefik defaultRule). krusader fixed to
noVNC 8080-ish label -> 6080. EXCLUDE_DOMAINS reduced to databases,
workers and agents (postgres14/mariadb/redis/postgresql17/komodo-mongo/
bookorbit-db/immich_postgres/immich_ml/dawarich_*db-redis-sidekiq/
influxdb/newt*/komodo-periphery/dockersocket/subsyncarr/wordpress-blues).
:latest and floating tags pinned to the exact digest/tag each
container currently runs, verified against registry manifest
digests. Digest-pinned where no matching version tag exists
(mealie, homepage, syncthing, glances, telegraf, fileflows,
teslacamplayer, sockpuppetbrowser, postgres-exporter, cadvisor,
plex-exporter). Renovate can now update each to real releases.
Arnout van Westen