- Add compose stacks for apps already proxied by Caddy: bento-pdf,
it-tools, paperless-ngx, and beszel-hub (with Makefile targets)
- Remove the unused Vault stack and the drawio Caddyfile block
- Fix Caddyfile gramps upstream to port 80 to match the compose file
- Bring immich and gramps-web up to the shared template pattern
(no-new-privileges, log rotation, memory limits, healthchecks)
- Single-quote vaultwarden SSO_AUDIENCE_TRUSTED so regex values like
^\d{18}$ render as valid YAML
- Move root docs into kebab-case topic folders, rebuild the docs index
to cover every doc, and fix all broken links
Updated rack order reflects current hardware (UDM Pro SE in place, dual Pi 4B shelf,
USW-Lite moved to shelf 9). Removed udm-pro-zones-migration.md — migration complete.
README links updated to point to firewall-rules.md instead.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
