All HTTP-served containers (web UIs + metrics APIs) now carry explicit
router-rule labels so dnsweaver manages their arnoutvw.nl rewrites end
to end (no more relying on traefik defaultRule). krusader fixed to
noVNC 8080-ish label -> 6080. EXCLUDE_DOMAINS reduced to databases,
workers and agents (postgres14/mariadb/redis/postgresql17/komodo-mongo/
bookorbit-db/immich_postgres/immich_ml/dawarich_*db-redis-sidekiq/
influxdb/newt*/komodo-periphery/dockersocket/subsyncarr/wordpress-blues).
:latest and floating tags pinned to the exact digest/tag each
container currently runs, verified against registry manifest
digests. Digest-pinned where no matching version tag exists
(mealie, homepage, syncthing, glances, telegraf, fileflows,
teslacamplayer, sockpuppetbrowser, postgres-exporter, cadvisor,
plex-exporter). Renovate can now update each to real releases.
- glances: new image crashes without TERM (curses init) — set TERM=xterm.
- photon: commented out. New image layout (no uv) and its OSM update
wants 153GB temp / 137GB available on docker.img nvme. Re-enable
after disk decision.
- Pocket-ID: ENCRYPTION_KEY contains $ — Komodo .env interpolation
eats it. Inline with $$ YAML escape (value already in git history
from master.yaml; rotate later).
- photon: image dropped uv; use image default CMD, strip stale PATH/JAVA.
- glances: PYTHON_VERSION must be 3.14 to match image venv.
Remove node_exporter (owned by infra stack), add Grafana service
from live container config. Secrets to ${VAR} (Komodo stack env),
strip Unraid template noise, normalize restart to unless-stopped.
Arnout van Westen