- Pin nodered/node-red:4.1.17-22 (was floating 4.1 on Node 20)
- Remove `adminAuth: false` from settings.js: Node-RED checks
`adminAuth != null`, so false enabled auth with no users and the
editor showed an empty login dialog. Auth is handled by Authelia.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every service now uses `logging: *default-logging` (json-file,
10m x 3). Previously ~35 services had no limit and grew unbounded.
Also fix the broken restart line in x-common-keys-monitoring.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- wordpress:5.6.0-apache (PHP 7.4) -> wordpress:php8.4-apache
- mysql:5.7 -> mysql:8.4 with new datadir peekskog/db84 (imported
from dump; old 5.7 datadir kept for rollback)
- Remove duplicate router middlewares label so www-redirect is applied
- Add upgrade-insecure-requests to CSP and a Permissions-Policy header
- Ignore local peek_backup/ directory
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CouchDB is served at livesync.${DOMAIN} via Traefik without a middleware
chain, since CouchDB handles CORS itself. livesync-bridge mirrors the
vault to ~/repo/notes, and notes-autocommit.sh pushes it from cron.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Simon