Restarts any container that goes unhealthy, giving the 'healthcheck on every
container' convention teeth (previously only mediapvr had autoheal, and in
opt-in label mode = inert). Raw docker.sock RW (restart needs POST; can't use
the read-only socket-proxy). Sweep 2b.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Image must exist in the registry >=24h before Watchtower adopts it, so a
compromised/broken just-pushed :latest isn't pulled instantly. Per-container
override via com.centurylinklabs.watchtower.cooldown-delay. Fleet-wide.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
The pinned 1.40 client can't recreate containers that use newer-API features
(VolumeOptions.Subpath needs 1.45), which silently deleted the sonarr container
on its watchtower update (2026-07-05). Unset = the nicholas-fedor fork negotiates
the daemon's max API version per host. Fleet-wide sweep.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Fleet-wide the WATCHTOWER_NOTIFICATIONS_HOSTNAME / _TITLE_TAG had drifted into
4 styles (FQDN, ALLCAPS, abbreviations like Dash/NC, lowercase). Standardize on
HOSTNAME=<host>.balders.ca + TITLE_TAG=<Host> (capitalized Loki/DNS host label)
so every Watchtower update notification reads consistently:
[Mediapvr] Watchtower updates on mediapvr.balders.ca
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Self-hosted location history. 4-container compose: Rails 8 app + Sidekiq
+ PostGIS 16-3.4 + Redis 7, plus watchtower. Authentik OIDC end-to-end.
Image pinned at freikin/dawarich:1.7.11 (OIDC support requires >= 1.7.8).
PostGIS DB lives in this LXC, not on the central DB VM (.172) — central
image is postgres:16-alpine without postgis, swapping it carries broader
blast radius than colocating here. Convention exception captured in
homelab-docs project_dawarich memory.
Roles:
- dawarich: system + Docker + compose + weekly prune timer
- alloy: logs+journald → Loki, node metrics → Prometheus
Bring-up sequence proven 2026-06-01. README documents the 5-trap build
chain (image version, entrypoint scripts, solid_cache SQLite bind mount,
APPLICATION_HOSTS+localhost, force_ssl+healthcheck).
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
