- new compose templates + READMEs for the three LXC apps (110-112)
- Makefile deploy targets (rackula pre-owns its data dir for uid 1001)
- Caddy vhosts for all four, incl. Hermes /auth/login redirect workaround
- firewall docs: CADDY->TRUSTED rules for LXCs 110-113
- Add compose stacks for apps already proxied by Caddy: bento-pdf,
it-tools, paperless-ngx, and beszel-hub (with Makefile targets)
- Remove the unused Vault stack and the drawio Caddyfile block
- Fix Caddyfile gramps upstream to port 80 to match the compose file
- Bring immich and gramps-web up to the shared template pattern
(no-new-privileges, log rotation, memory limits, healthchecks)
- Single-quote vaultwarden SSO_AUDIENCE_TRUSTED so regex values like
^\d{18}$ render as valid YAML
- Move root docs into kebab-case topic folders, rebuild the docs index
to cover every doc, and fix all broken links
Updated rack order reflects current hardware (UDM Pro SE in place, dual Pi 4B shelf,
USW-Lite moved to shelf 9). Removed udm-pro-zones-migration.md — migration complete.
README links updated to point to firewall-rules.md instead.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Repo is being renamed from synology-docker-services to
homelab-blueprint to reflect the actual scope (compose stacks,
network/rack docs, DNS recipes, Caddy config) and the Synology
retirement called out in the migration guide.
- Custom Dockerfile installs node-red-contrib-home-assistant-websocket
into the base image (not /data) to avoid volume mount conflicts
- Joins ha-network so Node-RED reaches homeassistant:8123 by container name
- HA_URL and HA_TOKEN passed as env vars so the token stays out of flow files;
use $(HA_URL) and $(HA_TOKEN) when configuring the server node in the editor
- credentialSecret substituted at setup time via setup-node-red.sh, consistent
with the rest of the project; auto-generates NODE_RED_CREDENTIAL_SECRET if absent
- appdata/node-red owned by uid 1000 to match the container user
- README updated with stack docs, env vars, and deployment steps
Caddyfile
- Add Home Automation Stack section with ha. and z2m. subdomains
proxying to the mini PC on the IoT VLAN (CADDY_IOT_PREFIX.X)
- Comment references Caddy trusted proxy requirement handled by
ha_configuration.yaml
homeassistant/config/ha_configuration.yaml (new)
- Minimal HA configuration.yaml template with http.trusted_proxies
set to CADDY_OFFICE_PREFIX.5 (Caddy's static Office VLAN IP per
network docs) — rendered via substitute_env.sh before first run
Stale reference cleanup
- homeassistant/template.yaml: remove CADDY_HA_HOST from comment,
add ha_configuration.yaml to pre-run steps
- homeassistant/config/zigbee2mqtt_configuration.yaml: replace
{{DOCKERCONFDIR}} path comment with ./appdata/ relative path
- README.md: replace $DOCKERCONFDIR in workflow example and stack
config template paths with ./appdata/; relabel DOCKERCONFDIR env
var as arr-stack only
Fixed three critical issues reported by user:
1. Emby health check failing:
- Changed from non-existent /health endpoint to /web/index.html
- Increased retries to 5 and start_period to 120s
- Using wget --spider for lightweight check
2. Bazarr health check failing:
- Changed from /api/system/status (requires auth) to root path /
- Increased retries to 5 and start_period to 90s
- Using wget --spider for lightweight check
3. Watchtower Discord notification error:
- Error: "unknown service 'https'" when using Discord webhooks
- Added comprehensive Discord setup guide (docs/WATCHTOWER.md)
- Updated .env.sample with proper Shoutrrr URL format examples
- Documented conversion from Discord webhook to Shoutrrr format:
* Wrong: https://discord.com/api/webhooks/ID/TOKEN
* Correct: discord://TOKEN@ID
Documentation updates:
- Created docs/WATCHTOWER.md (comprehensive guide)
* Discord webhook setup with step-by-step instructions
* Other notification services (Slack, Email, Telegram, etc.)
* Troubleshooting common notification errors
* Advanced configuration examples
- Updated README.md with Watchtower troubleshooting section
- Added WATCHTOWER.md to documentation index
Health check improvements:
- Both services now use wget instead of curl for consistency
- Increased start_period to allow proper initialization
- Increased retries for better resilience
- Using lightweight --spider checks
Fixes: Emby/Bazarr containers unhealthy despite running correctly
Fixes: Watchtower crashes with Discord notification URL format error
Tested: YAML validation passed, health check endpoints verified
