Navidrome indexes the existing music library on nas_media for Subsonic
access. SUB/WAVE (byo-proxy variant, LAN-only) provides the Icecast
broadcast, Liquidsoap crossfade/ducking, and AI DJ controller, reusing
the existing Ollama instance over npm-network for the LLM and Piper
for TTS.
Detects unauthorized miners (and other runtime threats) via Falco's
syscall/eBPF monitoring, following the 2026-08-06 gitea/xmrig
compromise. Wired into netdata rather than a new notification channel:
Falco exposes a Prometheus /metrics endpoint, netdata scrapes it, and a
new health.d alarm pages through netdata's already-configured Telegram
bot - no new alerting infra needed.
Includes a custom process-name rule for known miner binaries (the stock
Stratum-protocol rule wouldn't have caught the actual gitea incident,
which used a bare host:port with no scheme prefix), an outbound
miner-pool-port rule as a second layer, and rule_matching: all in the
Falco config - without it, Falco silently drops all but the first
matching rule per event, which would have suppressed our custom rule
whenever a stock rule also matched the same process.
Two cryptominer incursions (inbox-zero, then gitea) went unnoticed until
found manually — there was no alerting on sustained host CPU. Wired
netdata's existing 10min_cpu_usage alarm to notify via the shared Telegram
bot (config is host-only, not committed). Also narrowed the dashboard port
from 0.0.0.0 to the host's LAN IP to reduce exposure.
Same category of risk as the gitea :nightly issue: floating dev/beta tags
let watchtower silently pull unvetted upstream builds. couchdb had no tag
at all (implicit :latest); filebrowser and statping only publish
beta/dev channels upstream so pinned to the exact version in use rather
than a moving target.
Pin image to digest instead of :nightly (DB schema already ahead of
stable 1.27, downgrading would break startup) and disable open
self-registration/OpenID signup, which attackers used to plant xmrig
via a git hook.
- quizmaster: removed entirely (test service, no longer used); also removed Portainer stack and /srv/quizmaster data
- leafweb: removed orphaned MSSQL compose file (no running container, no Portainer stack, no data on disk)
- authelia, gitea, couchdb, portainer, immich (server + ml): add com.centurylinklabs.watchtower.monitor-only=true so watchtower still notifies on new versions without auto-applying them
- ladder: restore restart: unless-stopped (was commented out)
- rackpeek: add missing TZ env var
- watchtower: move Telegram token/chat ID to .env instead of plaintext in compose
- plex: remove stale/dead PLEX_CLAIM token
- uptime-kuma: mount docker.sock read-only (only needs to read container state)
- home-assistant: drop privileged: true (no device passthrough configured)
- glances: drop privileged: true, bind dashboard port to 127.0.0.1
- couchdb, docker-registry, leafweb: bind ports to 127.0.0.1 (proxy/localhost-only access confirmed, no direct LAN clients)
immich-server auto-updated to v3.0.1 via watchtower but postgres stayed
pinned to the old pgvecto.rs image, causing a crash loop (missing vector
extension). Per official Immich migration guide.
open-webui was sending OAuth credentials via both client_secret_basic
(header) and client_secret_post (body) simultaneously, which Authelia
rejects. Setting OAUTH_TOKEN_ENDPOINT_AUTH_METHOD=client_secret_post
forces a single method and matches the updated Authelia client config.
WEBUI_SECRET_KEY is now a stable env var so watchtower image updates
no longer invalidate all user sessions.
These vhost.d entries were symlinks to a non-existent 'public' file.
Portainer refuses to clone repos containing symlinks, blocking all
git-based stack redeployments. Replace with empty regular files
(equivalent behavior: no extra nginx config = public access).
NFS named volumes go ESTALE when unRAID drives spin down and Docker cannot recover.
systemd automount handles NFS reconnection transparently; Docker just sees a bind mount.
poprhythm