Fleet-wide fix matching the vm-db precedent (e3a0ab5). In all-mode autoheal
restarts ANY container Docker marks unhealthy, so a healthcheck that blips
under load (redis-cli ping timing out) triggers an endless restart loop of a
healthy container -- observed on docs 2026-08-14 (paperless-redis +
docs_watchtower). Opt-in heals only containers labelled autoheal=true; real
crashes stay covered by restart: unless-stopped.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Add/standardize a ## Secrets section listing the vault_* keys pulled from Infisical at deploy time, grouped by folder. Part of a fleet-wide README secrets-documentation sweep.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Self-hosted location history. 4-container compose: Rails 8 app + Sidekiq
+ PostGIS 16-3.4 + Redis 7, plus watchtower. Authentik OIDC end-to-end.
Image pinned at freikin/dawarich:1.7.11 (OIDC support requires >= 1.7.8).
PostGIS DB lives in this LXC, not on the central DB VM (.172) — central
image is postgres:16-alpine without postgis, swapping it carries broader
blast radius than colocating here. Convention exception captured in
homelab-docs project_dawarich memory.
Roles:
- dawarich: system + Docker + compose + weekly prune timer
- alloy: logs+journald → Loki, node metrics → Prometheus
Bring-up sequence proven 2026-06-01. README documents the 5-trap build
chain (image version, entrypoint scripts, solid_cache SQLite bind mount,
APPLICATION_HOSTS+localhost, force_ssl+healthcheck).
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
