updated response codes on error pages and pve hostname in traefik config

.gitignore

@@ -11,7 +11,7 @@ apps/nextcloud/config/
 core/crowdsec/config/
 **/.env
 !monitoring/node-red/data/
-apps/stockfill/
+apps/stockfill
 apps/shift-recorder/
 
 !apps/searxng/

apps/gitea/docker-compose.yml

@@ -25,6 +25,7 @@ services:
       - "traefik.http.services.gitea.loadbalancer.server.port=3000"
       - "io.portainer.accesscontrol.public"
       - "traefik.docker.network=core_traefik"
+      - "wud.watch=true"
 
     healthcheck:
       test: ["CMD-SHELL", "curl -fsS http://localhost:3000/api/healthz >/dev/null"]
@@ -52,6 +53,7 @@ services:
       - ${DOCKER_VOLUMES}/gitea/runner:/data
     networks:
       - traefik
+      - docker-socket-proxy
 
 #volumes:
 #  gitea_data:

apps/gramps/docker-compose.yml

@@ -52,6 +52,7 @@ services:
       - "io.portainer.accesscontrol.public"
       - "traefik.http.services.gramps.loadbalancer.server.port=5000"
       - "traefik.docker.network=core_traefik"
+      - "wud.watch=true"
     networks:
       - traefik
       - gramps
@@ -108,6 +109,8 @@ services:
       - ${DOCKER_VOLUMES}/gramps-data/db:/root/.gramps/grampsdb
       - ${DOCKER_VOLUMES}/gramps-data/media:/app/media
       - ${DOCKER_VOLUMES}/gramps-data/tmp:/tmp
+    labels:
+      - "wud.watch=true"
 
     networks:
       - gramps
@@ -122,7 +125,7 @@ services:
 
   gramps-redis:
     profiles: ["apps","all","gramps"]
-    image: valkey/valkey:8-alpine
+    image: valkey/valkey:9-trixie
     container_name: gramps-redis
     restart: always
     networks:
@@ -135,6 +138,8 @@ services:
       timeout: 5s
       retries: 6
       start_period: 10s
+    labels:
+      - "wud.watch=true"
 
 networks:
   gramps:

apps/nextcloud/docker-compose.yml

@@ -1,6 +1,7 @@
 services:
   nextcloud-webapp:
     profiles: ["apps","all","nextcloud"]
+    image: nextcloud:production
     build:
       context: ${PROJECT_ROOT}/apps/nextcloud
     container_name: nextcloud-webapp
@@ -62,6 +63,7 @@ services:
       - "traefik.http.middlewares.nextcloud-webfinger.redirectregex.regex=https://(.*)/.well-known/webfinger"
       - "traefik.http.middlewares.nextcloud-webfinger.redirectregex.replacement=https://$${1}/nextcloud/index.php/.well-known/webfinger"
       - "traefik.docker.network=core_traefik"
+      - "wud.watch=true"
     healthcheck:
       test:
         - CMD-SHELL
@@ -76,7 +78,7 @@ services:
       start_period: 180s
 
   nextcloud-db:
-    image: mariadb:11.4
+    image: mariadb:${NEXTCLOUD_DB_VERSION}
     restart: always
     profiles: ["apps","all","nextcloud"]
     container_name: nextcloud-db
@@ -103,12 +105,16 @@ services:
       - nextcloud
     labels:
       - "io.portainer.accesscontrol.public"
+      - "wud.watch=true"
+      - 'wud.tag.include=^11\.4(?:\.\d+)?$'
+#      - "wud.tag.exclude=${NEXTCLOUD_DB_VERSION}-*"
     healthcheck:
       test: ["CMD-SHELL", "mariadb-admin ping -u $$MYSQL_USER --password=$$(cat /run/secrets/nextcloud_db_password) --silent"]
       interval: 10s
       timeout: 5s
       retries: 12
       start_period: 60s
+      
 
   nextcloud-redis:
     image: "redis"
@@ -121,12 +127,13 @@ services:
 #      - nextcloud_redis_password
     volumes:
 #      - ${PROJECT_ROOT}/apps/nextcloud/data/redis:/data:rw
-      - ${DOCKER_VOLUMES}/nextcloud/redis:/data:rw
+      - ${DOCKER_DATABASES}/nextcloud/redis:/data:rw
     restart: always
     networks:
       - nextcloud
     labels:
       - "io.portainer.accesscontrol.public"
+      - "wud.watch=true"
     healthcheck:
 #      test: ["CMD-SHELL", "redis-cli -a \"$$(cat /run/secrets/nextcloud_redis_password)\" PING | grep -q PONG"]
       test: ["CMD-SHELL", "redis-cli  PING | grep -q PONG"]

apps/passbolt/docker-compose.yml

@@ -2,7 +2,7 @@ services:
   passbolt-db:
     profiles: ["apps","all","passbolt"]
     container_name: passbolt-db
-    image: mariadb:12
+    image: mariadb:latest
     restart: always
 #    env_file:
 #      - ${PROJECT_ROOT}/secrets/stack-secrets.env
@@ -25,7 +25,8 @@ services:
       retries: 12
       start_period: 60s
     labels:
-       - "io.portainer.accesscontrol.public"
+      - "io.portainer.accesscontrol.public"
+      - "wud.watch=true"
 
   passbolt-webapp:
     image: passbolt/passbolt:latest-ce
@@ -71,6 +72,7 @@ services:
       - "traefik.http.routers.passbolt.tls.certresolver=myresolver"
       - "io.portainer.accesscontrol.public"
       - "traefik.docker.network=core_traefik"
+      - "wud.watch=true"
     healthcheck:
       test: ["CMD-SHELL", "curl -fsS http://localhost/healthcheck/status | grep -qx OK"]
       interval: 30s

apps/searxng/docker-compose.yml

@@ -13,13 +13,14 @@ services:
     networks:
       - traefik
     labels:
-       - "traefik.http.routers.searxng.rule=Host(`searxng.lan.ddnsgeek.com`)"
-       - "traefik.enable=true"
-       - "traefik.http.routers.searxng.entrypoints=websecure"
-       - "traefik.http.routers.searxng.tls.certresolver=myresolver"
-       - "io.portainer.accesscontrol.public"
+      - "traefik.http.routers.searxng.rule=Host(`searxng.lan.ddnsgeek.com`)"
+      - "traefik.enable=true"
+      - "traefik.http.routers.searxng.entrypoints=websecure"
+      - "traefik.http.routers.searxng.tls.certresolver=myresolver"
+      - "io.portainer.accesscontrol.public"
 #       - "traefik.http.routers.searxng.middlewares=crowdsec@file,secHeaders@file,error-pages-middleware"
-       - "traefik.http.services.searxng.loadbalancer.server.port=8080"
+      - "traefik.http.services.searxng.loadbalancer.server.port=8080"
+      - "wud.watch=true"
     healthcheck:
       test: ["CMD-SHELL", "python3 -c \"import urllib.request,sys; r=urllib.request.urlopen('http://127.0.0.1:8080/', timeout=3); sys.exit(0 if 200<=r.status<400 else 1)\""]
       interval: 20s

archive/dynamic-system/monitoring/influxdb/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   influxdb:
     profiles: ["monitoring","all","influxdb", "prometheus"]
-    image: influxdb:2.7
+    image: influxdb:2
     container_name: influxdb
     restart: unless-stopped
 #    env_file:

core/authelia/docker-compose.yml

@@ -31,3 +31,4 @@ services:
       - traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true
       - traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups
       - traefik.http.middlewares.authelia.forwardauth.maxResponseBodySize=2097152
+      - "wud.watch=true"

core/crowdsec/Dockerfile

@@ -1,6 +1,6 @@
 FROM crowdsecurity/crowdsec:latest
 
-COPY config/ /etc/crowdsec
+#COPY config/ /etc/crowdsec
 # Install required components at build time
-RUN cscli hub update && \
-    cscli collections install crowdsecurity/traefik --force 
+#RUN cscli hub update && \
+#    cscli collections install crowdsecurity/traefik --force 

core/crowdsec/docker-compose.yml

@@ -1,8 +1,8 @@
 services:
   crowdsec:
     profiles: ["core","all","crowdsec", "traefik"]
-#    image: crowdsecurity/crowdsec:latest
-    build: ${PROJECT_ROOT}/core/crowdsec
+    image: crowdsecurity/crowdsec:latest
+#    build: ${PROJECT_ROOT}/core/crowdsec
     container_name: crowdsec
     restart: always
     environment:
@@ -14,7 +14,10 @@ services:
 #      - ${PROJECT_ROOT}/core/crowdsec/config:/etc/crowdsec
       - ${DOCKER_VOLUMES}/crowdsec/logs:/logs:ro
       - ${DOCKER_VOLUMES}/crowdsec/data:/var/lib/crowdsec/data
-      - ${DOCKER_VOLUMES}/crowdsec/config:/etc/crowdsec
+#      - ${DOCKER_VOLUMES}/crowdsec/config.yaml:/etc/crowdsec/config.yaml
+#      - ${DOCKER_VOLUMES}/crowdsec/config:/etc/crowdsec
+      - ${PROJECT_ROOT}/core/crowdsec/acquis.d:/etc/crowdsec/acquis.d
+      - ${PROJECT_ROOT}/core/crowdsec/profiles.yaml:/etc/crowdsec/profiles.yaml
     networks:
 #      - reverse_proxy
       - traefik
@@ -24,3 +27,5 @@ services:
       timeout: 10s
       retries: 3
       start_period: 15s
+    labels:
+      - "wud.watch=true"

core/crowdsec/profiles.yaml

@@ -0,0 +1,29 @@
+name: default_ip_remediation
+#debug: true
+filters:
+ - Alert.Remediation == true && Alert.GetScope() == "Ip"
+decisions:
+ - type: ban
+   duration: 4h
+#duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
+# notifications:
+#   - slack_default  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
+#   - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
+#   - http_default   # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
+#   - email_default  # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
+on_success: break
+---
+name: default_range_remediation
+#debug: true
+filters:
+ - Alert.Remediation == true && Alert.GetScope() == "Range"
+decisions:
+ - type: ban
+   duration: 4h
+#duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
+# notifications:
+#   - slack_default  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
+#   - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
+#   - http_default   # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
+#   - email_default  # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
+on_success: break

core/docker-socket-proxy/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   docker-socket-proxy:
-    profiles: ["monitoring","all","docker-socket-proxy", "core", "traefik", "prometheus"]
+    profiles: ["monitoring","all","docker-socket-proxy", "core", "traefik", "uptime-kuma", "beszel", "wud", "apps"]
     image: tecnativa/docker-socket-proxy:latest
     container_name: docker-socket-proxy
     hostname: docker-socket-proxy
@@ -20,7 +20,7 @@ services:
       SYSTEM: 1
       SERVICES: 1
       SWARM: 1
-      NODES: 1
+      NODES: 1  
       SECRETS: 1
       TASKS: 1
       VERSION: 1
@@ -43,5 +43,10 @@ services:
     security_opt:
       - no-new-privileges:true
     networks:
-      - monitor
+#      - monitor
       - traefik
+      - docker-socket-proxy
+    ports:
+      - 2375:2375
+    labels:
+      - "wud.watch=true"

core/error-pages/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   error-pages:
     profiles: ["core","all","error-pages", "traefik"]
-    image: tarampampam/error-pages:3
+    image: tarampampam/error-pages:latest
     restart: always
     container_name: error-pages
     read_only: true
@@ -19,9 +19,10 @@ services:
       - "traefik.http.routers.error-pages-router.entrypoints=web"
       - "traefik.http.routers.error-pages-router.middlewares=error-pages-middleware"
       # "errors" middleware settings
-      - "traefik.http.middlewares.error-pages-middleware.errors.status=400-599"
+      - "traefik.http.middlewares.error-pages-middleware.errors.status=400,402-502,504-599"
       - "traefik.http.middlewares.error-pages-middleware.errors.service=error-pages-service"
       - "traefik.http.middlewares.error-pages-middleware.errors.query=/{status}.html"
       # define service properties
       - "traefik.http.services.error-pages-service.loadbalancer.server.port=8080"
       - "io.portainer.accesscontrol.public"
+      - "wud.watch=true"

core/traefik/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   traefik:
     profiles: ["core","all","traefik"]
-    image: traefik:3
+    image: traefik:latest
     container_name: traefik
     restart: always
     read_only: true
@@ -48,8 +48,10 @@ services:
       - "io.portainer.accesscontrol.public"
       - "traefik.docker.network=core_traefik"
       - "traefik.http.routers.traefik.observability.tracing=true"
-
+      - "wud.watch=true"
+      
     networks:
 #      - reverse_proxy
 #      - prometheus_edge
       - traefik
+      - docker-socket-proxy

core/traefik/dynamic.yml

@@ -32,6 +32,63 @@ http:
 #          - tracing-middleware@file
           - error-pages-middleware@docker
 
+  serversTransports:
+    insecureTransport:
+      insecureSkipVerify: true
+
+  routers:
+    pve1:
+      rule: "Host(`pve1.lan.ddnsgeek.com`)"
+      entryPoints:
+        - websecure
+      service: pve1
+      middlewares:
+        - authelia@docker
+      tls:
+        certResolver: myresolver
+        options: mtls-private-admin@file
+
+    pbs:
+      rule: "Host(`pbs.lan.ddnsgeek.com`)"
+      entryPoints:
+        - websecure
+      service: pbs
+      middlewares:
+        - authelia@docker
+      tls:
+        certResolver: myresolver
+        options: mtls-private-admin@file
+
+    pdm:
+      rule: "Host(`pdm.lan.ddnsgeek.com`)"
+      entryPoints:
+        - websecure
+      service: pdm
+      middlewares:
+        - authelia@docker
+      tls:
+        certResolver: myresolver
+        options: mtls-private-admin@file
+
+  services:
+    pve1:
+      loadBalancer:
+        serversTransport: insecureTransport
+        servers:
+          - url: "https://pve1.sweet.home:8006"
+
+    pbs:
+      loadBalancer:
+        serversTransport: insecureTransport
+        servers:
+          - url: "https://pbs.sweet.home:8007"
+
+    pdm:
+      loadBalancer:
+        serversTransport: insecureTransport
+        servers:
+          - url: "https://pdm.sweet.home:8443"
+
 tls:
   options:
     mtls-private-admin:

core/traefik/traefik.yml

@@ -1,5 +1,5 @@
 log:
-  level: INFO
+  level: DEBUG
 
 accessLog:
   filePath: /logs/access.log

default-environment.env

@@ -1,20 +1,25 @@
-PROJECT_ROOT=/home/nixos/docker
+DATA_ROOT=/mnt/docker
+PROJECT_ROOT=${DATA_ROOT}/config
 DOMAIN=lan.ddnsgeek.com
 TZ=Australia/Brisbane
 EMAIL=wayne.bennett@live.com
 SECRETS_ENV_FILE=${PROJECT_ROOT}/secrets/stack-secrets.env
 
+# Data locations 
+
+DOCKER_VOLUMES=${DATA_ROOT}/volumes
+DOCKER_DATABASES=${DATA_ROOT}/databases
+
 # Core
 CROWDSEC_COLLECTIONS=crowdsecurity/traefik
 ERROR_PAGES_TEMPLATE_NAME=app-down
-DOCKER_VOLUMES=/mnt/docker-volumes
-DOCKER_DATABASES=/mnt/docker-databases
+
 
 # Gitea
 GITEA_USER_UID=1000
 GITEA_USER_GID=1000
 GITEA_DB_TYPE=sqlite3
-GITEA_ROOT_URL=https://gitea.lan.ddnsgeek.com/
+GITEA_ROOT_URL=https://gitea.${DOMAIN}/
 # Generate a token in Gitea: Site Administration → Actions → Runners
 # or Repo → Settings → Actions → Runners
 GITEA_RUNNER_REGISTRATION_TOKEN=vYDNxzMvayREkXoaAR3x3UREkxQB2PU4eORzmkZ9
@@ -22,12 +27,13 @@ GITEA_RUNNER_NAME=docker-runner-01
 GITEA_RUNNER_LABELS=ubuntu-latest:docker://node:20-bookworm,ubuntu-22.04:docker://node:20-bookworm,linux:docker://node:20-bookworm,docker:docker://docker:cli
 
 # Grafana
-GRAFANA_ROOT_URL=https://grafana.lan.ddnsgeek.com/
+GRAFANA_ROOT_URL=https://grafana.${DOMAIN}/
 
 # Nextcloud
+NEXTCLOUD_DB_VERSION=11.4
 NEXTCLOUD_MYSQL_DATABASE=nextcloud
 NEXTCLOUD_MYSQL_HOST=nextcloud_db:3306
-NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.lan.ddnsgeek.com
+NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.${DOMAIN}
 NEXTCLOUD_OVERWRITEPROTOCOL=https
 NEXTCLOUD_OVERWRITECLIURL=https://${NEXTCLOUD_TRUSTED_DOMAINS}
 NEXTCLOUD_SMTP_HOST=smtp.gmail.com
@@ -43,12 +49,12 @@ NEXTCLOUD_DATA=/mnt/nextcloud-data
 PASSBOLT_MYSQL_RANDOM_ROOT_PASSWORD=true
 PASSBOLT_MYSQL_DATABASE=passbolt
 PASSBOLT_MYSQL_USER=passbolt
-PASSBOLT_APP_FULL_BASE_URL=https://passbolt.lan.ddnsgeek.com
+PASSBOLT_APP_FULL_BASE_URL=https://passbolt.${DOMAIN}
 PASSBOLT_DATASOURCES_DEFAULT_HOST=passbolt-db
 
 # Gramps
 GRAMPSWEB_TREE=main
-GRAMPSWEB_BASE_URL=https://familytree.lan.ddnsgeek.com
+GRAMPSWEB_BASE_URL=https://familytree.${DOMAIN}
 GRAMPSWEB_REGISTRATION_DISABLED=true
 GRAMPSWEB_EMAIL_HOST=smtp.gmail.com
 GRAMPSWEB_EMAIL_PORT=587
@@ -84,4 +90,14 @@ MTLS_BRIDGE_CLIENT_KEY=/certs/clients/office-pc/office-pc.key
 MTLS_BRIDGE_CLIENT_CERT=/certs/clients/office-pc/office-pc.crt
 MTLS_BRIDGE_TARGET_URL=http://node-red:1880
 MTLS_BRIDGE_ALLOWED_PATHS_FILE=
-MTLS_BRIDGE_CORS_ALLOW_ORIGIN=https://grafana.lan.ddnsgeek.com
+MTLS_BRIDGE_CORS_ALLOW_ORIGIN=https://grafana.${DOMAIN}
+
+# Whats up Docker
+WUD_WATCHER_LOCAL_CRON="0 */6 * * *"
+WUD_WATCHER_LOCAL_HOST=docker-socket-proxy
+WUD_WATCHER_LOCAL_WATCHBYDEFAULT=false
+WUD_WATCHER_RASPI_HOST=raspberrypi.tail13f623.ts.net
+WUD_TRIGGER_GOTIFY_URL=http://gotify
+WUD_TRIGGER_GOTIFY_TOKEN=ARPi3hyrAdEUSu6
+WUD_TRIGGER_GOTIFY_PRIORITY=5
+

default-network.yml

@@ -4,4 +4,5 @@ networks:
     ipam:
       config:
         - subnet: 172.21.0.0/16
-  monitor:
+#  monitor:
+  docker-socket-proxy:

monitoring/beszel/docker-compose.yml

@@ -0,0 +1,63 @@
+services:
+  beszel:
+    profiles: ["monitoring","all","beszel"]
+    image: henrygd/beszel:latest
+    container_name: beszel
+    restart: always
+    environment:
+      APP_URL: https://beszel.lan.ddnsgeek.com
+    ports:
+      - 8090:8090
+    volumes:
+      - ${DOCKER_VOLUMES}/beszel/data:/beszel_data
+      - ${DOCKER_VOLUMES}/beszel/socket:/beszel_socket
+    healthcheck:
+      test: ['CMD', '/beszel', 'health', '--url', 'http://localhost:8090']
+      interval: 120s
+      start_period: 10s
+      timeout: 5s
+    networks:
+      - traefik
+ #     - beszel
+ #     - monitor
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.beszel.rule=Host(`beszel.lan.ddnsgeek.com`)"
+      - "traefik.http.routers.beszel.entrypoints=websecure"
+      - "traefik.http.routers.beszel.tls=true"
+      - "traefik.http.routers.beszel.tls.certresolver=myresolver"
+      - "traefik.http.services.beszel.loadbalancer.server.port=8090"
+      - "io.portainer.accesscontrol.public"
+      - "traefik.docker.network=core_traefik"
+      - "traefik.http.routers.beszel.tls.options=mtls-private-admin@file"
+      - "wud.watch=true"
+
+  beszel-agent:
+    profiles: ["monitoring","all","beszel"]
+    image: henrygd/beszel-agent:latest
+    container_name: beszel-agent
+    restart: always
+    network_mode: host
+    volumes:
+      - ${DOCKER_VOLUMES}/beszel/agent:/var/lib/beszel-agent
+      - ${DOCKER_VOLUMES}/beszel/socket:/beszel_socket
+#      - /var/run/docker.sock:/var/run/docker.sock:ro
+#      - /mnt/docker/volumes/.beszel:/extra-filesystems/docker-volumes:ro
+    environment:
+      LISTEN: /beszel_socket/beszel.sock
+      HUB_URL: http://localhost:8090
+      KEY: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG'
+      TOKEN: ee2f2df3-d79b-4695-8840-bc936dd7b121
+      DOCKER_HOST: tcp://localhost:2375
+#      EXTRA_FILESYSTEMS: /mnt/docker/volumes
+    healthcheck:
+      test: ['CMD', '/agent', 'health']
+      interval: 120s
+#    networks:
+#      - beszel
+#      - monitor
+    labels:
+      - "wud.watch=true"
+
+#networks:
+#  beszel:

monitoring/gotify/docker-compose.yml

@@ -27,6 +27,7 @@ services:
       - "traefik.http.routers.gotify.tls.certresolver=myresolver"
       - "traefik.http.routers.gotify.tls.options=mtls-private-admin@file"
       - "traefik.http.services.gotify.loadbalancer.server.port=80"
+      - "wud.watch=true"
     ports:
       - 8080:80
 #volumes:

monitoring/uptime-kuma/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   monitor-kuma:
     profiles: ["monitoring","all","uptime-kuma"]
-    image: louislam/uptime-kuma:2.1.1
+    image: louislam/uptime-kuma
     container_name: monitor-kuma
     restart: always
     depends_on:
@@ -26,10 +26,12 @@ services:
       - traefik.docker.network=core_traefik
       # Service -> container port
       - traefik.http.services.monitor.loadbalancer.server.port=3001
+      - "wud.watch=true"
     networks:
 #      - traefik_reverse_proxy
       - traefik
-      - monitor
+#      - monitor
+      - docker-socket-proxy
 
 #networks:
 #  traefik_reverse_proxy:

monitoring/wud/docker-compose.yml

@@ -0,0 +1,57 @@
+services:
+  wud:
+    profiles: ["monitoring","all","wud"]
+    image: getwud/wud
+    container_name: wud
+    restart: always
+
+    # ports:
+    #   - "3000:3000"
+    depends_on:
+      - docker-socket-proxy
+    volumes:
+      - ${DOCKER_VOLUMES}/wud:/store
+ #     - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      TZ: ${TZ}
+      WUD_LOG_LEVEL: TRACE
+      # Docker Socket Proxy
+      WUD_WATCHER_LOCAL_HOST: ${WUD_WATCHER_LOCAL_HOST}
+#      WUD_WATCHER_LOCAL_SOCKET: /var/run/docker.sock
+      # Check every 6 hours
+      WUD_WATCHER_LOCAL_CRON: ${WUD_WATCHER_LOCAL_CRON}
+      WUD_WATCHER_LOCAL_WATCHBYDEFAULT: ${WUD_WATCHER_LOCAL_WATCHBYDEFAULT}
+
+      WUD_WATCHER_RASPI_HOST: ${WUD_WATCHER_RASPI_HOST}
+      WUD_WATCHER_RASPI_CRON: ${WUD_WATCHER_LOCAL_CRON}
+      # Gotify
+      # WUD_TRIGGER_GOTIFY_URL: ${WUD_TRIGGER_GOTIFY_URL}
+      # WUD_TRIGGER_GOTIFY_TOKEN: ${WUD_TRIGGER_GOTIFY_TOKEN}
+      # WUD_TRIGGER_GOTIFY_PRIORITY: ${WUD_TRIGGER_GOTIFY_PRIORITY}
+      # WUD_TRIGGER_GOTIFY_TITLE: ${WUD_TRIGGER_GOTIFY_TITLE} 
+
+      WUD_TRIGGER_GOTIFY_APP_PRIORITY: ${WUD_TRIGGER_GOTIFY_PRIORITY}
+      WUD_TRIGGER_GOTIFY_APP_TOKEN: ${WUD_TRIGGER_GOTIFY_TOKEN}
+      WUD_TRIGGER_GOTIFY_APP_URL: ${WUD_TRIGGER_GOTIFY_URL}
+
+
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=core_traefik"
+      - "io.portainer.accesscontrol.public"
+      - "traefik.http.routers.wud.rule=Host(`wud.lan.ddnsgeek.com`)"
+      - "traefik.http.routers.wud.entrypoints=websecure"
+      - "traefik.http.routers.wud.tls.certresolver=myresolver"
+      - "traefik.http.routers.wud.tls.options=mtls-private-admin@file"
+      - "traefik.http.services.wud.loadbalancer.server.port=3000"
+
+    networks:
+      - traefik
+      - docker-socket-proxy
+
+    healthcheck:
+      test: curl --fail http://localhost:${WUD_SERVER_PORT:-3000}/health || exit 1
+      interval: 10s
+      timeout: 10s
+      retries: 3
+      start_period: 10s