Update ghcr.io/traefik/traefik Docker tag to v3.6.15

Reviewed-on: #248

.archived/caddy-cloudflare/compose.yaml

@@ -1,6 +1,6 @@
 services:
   caddy:
-    image: ghcr.io/ryuupendragon/caddy-cloudflare:2.11.2@sha256:57fab8be6175f452b2ba98d1fbb54c76818560ae7067a0b80fb6cf037884e660
+    image: ghcr.io/ryuupendragon/caddy-cloudflare:2.11.2@sha256:ec153a5ca3522335d21bf144be0aad748b1542bf32198d65444a3ffa67180551
     container_name: caddy
     restart: unless-stopped
     cap_add:

.archived/pi-hole/compose.yaml

@@ -0,0 +1,66 @@
+services:
+  unbound_valkey:
+    container_name: unbound_valkey
+    image: ghcr.io/valkey-io/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
+    restart: unless-stopped
+    hostname: unbound_valkey
+    volumes:
+      - ./valkey-data:/data
+    networks:
+      - backend
+    healthcheck:
+      test: ["CMD-SHELL", "valkey-cli ping | grep PONG"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  unbound:
+    container_name: unbound
+    image: klutchell/unbound:1.24.2@sha256:cb9a0f06c803c764395e2ff50bd8a244470601290c78fb2cdcf1bd200a027cd6
+    restart: unless-stopped
+    depends_on:
+      unbound_valkey:
+        condition: service_healthy
+    volumes:
+      - ./unbound.conf:/etc/unbound/unbound.conf
+      - ./unbound-custom-conf:/etc/unbound/custom.conf.d
+    ports:
+      - 5354:53
+      - 5354:53/udp
+    networks:
+      - backend
+    healthcheck:
+      test: ['CMD', 'drill-hc', '@127.0.0.1', 'dnssec.works']
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  pihole:
+    container_name: pihole
+    image: ghcr.io/pi-hole/pihole:2026.02.0@sha256:ee348529cea9601df86ad94d62a39cad26117e1eac9e82d8876aa0ec7fe1ba27
+    restart: unless-stopped
+    cap_add:
+      - SYS_NICE
+    environment:
+      - TZ=${TZ}
+      - FTLCONF_dns_upstreams=unbound
+      - FTLCONF_dns_listeningMode=all
+      - FTLCONF_webserver_api_password=${FTLCONF_webserver_api_password}
+    volumes:
+      - ./pihole:/etc/pihole
+    ports:
+      - 5355:53/tcp
+      - 5355:53/udp
+      - 8055:80/tcp
+      - 4435:443/tcp
+    networks:
+      - frontend
+      - backend
+
+networks:
+  frontend:
+    external: true
+  backend:
+    external: true

.archived/vaultwarden/compose.yaml

@@ -1,71 +1,53 @@
-# Vaultwarden Configuration - (Bitwarden-compatible) Password Manager
 services:
   vaultwarden_db:
-    # PostgreSQL Database Configuration
     container_name: vaultwarden_db
     image: docker.io/library/postgres:17.5
-    restart: unless-stopped  # Auto-recover from crashes
-    
-    # Database credentials
+    restart: unless-stopped
     environment:
-      - POSTGRES_USER=${POSTGRES_USER}  # Database username
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}  # Database password
-      - POSTGRES_DB=${POSTGRES_DB}  # Database name
-    
-    # Persistent storage configuration
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=${POSTGRES_DB}
     volumes:
-      - ${APPDATA_PATH}/vaultwarden/db:/var/lib/postgresql/data  # Database files
-    
-    # Network configuration
+      - ${APPDATA_PATH}/vaultwarden/db:/var/lib/postgresql/data
     ports:
-      - ${DB_PORT}:5432  # PostgreSQL default port
+      - ${DB_PORT}:5432
     networks:
-      - backend  # Connects to backend network
-    
-    # Health monitoring
+      - backend
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -d ${POSTGRES_DB} -U ${POSTGRES_USER}"]  # Connection check
-      interval: 30s  # Check every 30 seconds
-      timeout: 5s  # Maximum check duration
-      retries: 5  # Allow 5 failures before marking unhealthy
-      start_period: 20s  # Initial grace period
+      test: ["CMD-SHELL", "pg_isready -d ${POSTGRES_DB} -U ${POSTGRES_USER}"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
 
   vaultwarden_server:
     container_name: vaultwarden_server
-    # Container configuration
-    image: ghcr.io/dani-garcia/vaultwarden:1.34.1  # Official Vaultwarden image
-    restart: unless-stopped  # Auto-restart on failure
+    image: ghcr.io/dani-garcia/vaultwarden:1.34.1
+    restart: unless-stopped
     depends_on:
       vaultwarden_db:
-        condition: service_healthy  # Wait for healthy database
-    
-    # Application settings
+        condition: service_healthy
     environment:
-      - PUID=${PUID}  # User ID for file permissions
-      - PGID=${PGID}  # Group ID for file permissions
-      - TZ=${TZ}  # Timezone configuration
-      - DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@vaultwarden_db:5432/${POSTGRES_DB}  # DB connection
-      - WEBSOCKET_ENABLED=${WEBSOCKET_ENABLED}  # Real-time updates
-      - LOG_FILE=/data/vaultwarden.log  # Log file location
+      - PUID=${PUID}
+      - PGID=${PGID}
+      - TZ=${TZ}
+      - DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@vaultwarden_db:5432/${POSTGRES_DB}
+      - WEBSOCKET_ENABLED=${WEBSOCKET_ENABLED}
+      - LOG_FILE=/data/vaultwarden.log
       # Uncomment and set these only on first run
-      # - DOMAIN=${DOMAIN}  # Domain Name
-      # - SIGNUPS_ALLOWED=${SIGNUPS_ALLOWED}  # User registration
-      # - ADMIN_TOKEN=${ADMIN_TOKEN}  # Admin interface access token
-    
-    # Persistent storage configuration
+      # - DOMAIN=${DOMAIN}
+      # - SIGNUPS_ALLOWED=${SIGNUPS_ALLOWED}
+      # - ADMIN_TOKEN=${ADMIN_TOKEN}
     volumes:
-      - ${APPDATA_PATH}/vaultwarden/data:/data  # Vault data storage
-    
-    # Network configuration
+      - ${APPDATA_PATH}/vaultwarden/data:/data
     ports:
-      - ${SERVER_PORT}:80  # Web interface port
+      - ${SERVER_PORT}:80
     networks:
-      - frontend  # Connects to frontend network
-      - backend  # Connects to backend network
+      - frontend
+      - backend
 
-# External network definitions
 networks:
   frontend:
-    external: true  # Uses existing frontend network
+    external: true
   backend:
-    external: true  # Uses existing backend network
+    external: true

.templates/valkey-without-pswd.yaml

@@ -9,7 +9,7 @@ services:
     ports:
       - ${VALKEY_PORT}:6379
     healthcheck:
-      test: ["CMD-SHELL", valkey-cli ping | grep PONG"]
+      test: ["CMD-SHELL", "valkey-cli ping | grep PONG"]
       interval: 10s
       timeout: 5s
       retries: 3

adminer/compose.yaml

@@ -1,7 +1,7 @@
 services:
   adminer:
     container_name: adminer
-    image: docker.io/library/adminer:5.4.2@sha256:2fb88b98da9f0ae0157d8fcb73f447a0747b09ee8d2ff8a8e0695b30afed2116
+    image: docker.io/library/adminer:5.4.2@sha256:41898b976011fd87f2d3037366ad97f7d89fddfebc8aa8b3a7d77d0c465aa37b
     restart: unless-stopped
     ports:
       - ${PORT}:8080

backrest/compose.yaml

@@ -1,7 +1,7 @@
 services:
   backrest:
     container_name: backrest
-    image: docker.io/garethgeorge/backrest:v1.12.0@sha256:448fee1cb4cdf3f7d7078078480d38713673924ad415bfdf84bf9e49ff570201
+    image: docker.io/garethgeorge/backrest:v1.12.1@sha256:f4d34bd6fa985d13bdb6c01c5d8727e07708899afa9567d800808357d77b9fb0
     restart: unless-stopped
     hostname: ${HOSTNAME}
     environment:

caddy-cloudflare-ddns-crowdsec/compose.yaml

@@ -1,7 +1,7 @@
 services:
   crowdsec:
     container_name: crowdsec
-    image: ghcr.io/crowdsecurity/crowdsec:v1.7.6@sha256:63b595fef92de1778573b375897a45dd226637ee9a3d3db9f57ac7355c369493
+    image: ghcr.io/crowdsecurity/crowdsec:v1.7.7@sha256:6ca53ad26196ca59ddd4fa692a586b73d8fcde085046163b9ca2f04887dca563
     restart: unless-stopped
     environment:
       - BOUNCER_KEY_CADDY=${CROWDSEC_API_KEY}
@@ -23,7 +23,7 @@ services:
 
   caddy:
     container_name: caddy
-    image: ghcr.io/ryuupendragon/caddy-cloudflare-ddns-crowdsec:2.11.2@sha256:0e83c732a9905f2443680d9d95b2d83b4c7f23dc089d735cffae60dc14bf37cf
+    image: ghcr.io/ryuupendragon/caddy-cloudflare-ddns-crowdsec:2.11.2@sha256:ba26a5f05c825d61f5ca6f43de368a3e01013c10b592bfe5fcd187d9328b6289
     restart: unless-stopped
     depends_on:
       crowdsec:

dockhand/compose.yaml

@@ -1,7 +1,7 @@
 services:
   dockhand_db:
     container_name: dockhand_db
-    image: docker.io/library/postgres:18.2@sha256:9b5bd946f3a507db72c55959700e517463e8d5dbb6f7eb30d920d5bcf6951431
+    image: docker.io/library/postgres:18.3@sha256:78481659c47e862334611ccdaf7c369c986b3046da9857112f3b309114a65fb4
     restart: unless-stopped
     environment:
       - POSTGRES_USER=${POSTGRES_USER}
@@ -21,7 +21,7 @@ services:
 
   dockhand:
     container_name: dockhand
-    image: fnsys/dockhand:v1.0.18@sha256:81ee6728840ea99978d811d9dfa61e5445467e01502320fa7733bcf7e567d105
+    image: fnsys/dockhand:v1.0.27@sha256:8c2f62e215d257e3b17fd0d458d4fcd134f67c4ee495831b818004677ad57e3b
     restart: unless-stopped
     depends_on:
       dockhand_db:

forgejo/compose.yaml

@@ -1,7 +1,7 @@
 services:
   forgejo:
     container_name: forgejo
-    image: codeberg.org/forgejo/forgejo:14.0.2-rootless@sha256:5552c9e25f353760420b8ac7a7f0f0a788ff571bbfd8e2c1e93503d3e2e1b87a
+    image: codeberg.org/forgejo/forgejo:15.0.1-rootless@sha256:4f4d168b4e792d0f73e5f4da0548f3b54b9c9d03fb85f277c97eb985cb9a290a
     restart: unless-stopped
     user: ${PUID}:${PGID}
     volumes:

gitea-runner/compose.yaml

@@ -1,7 +1,7 @@
 services:
   gitea_runner:
     container_name: gitea_runner
-    image: docker.io/gitea/act_runner:0.3.0@sha256:8368754bb612a1deb07ed604e3b955338aefc01576d4d0d92e8dd82f29250fcd
+    image: docker.io/gitea/act_runner:0.6.0@sha256:b2df7d04d17334ff8e741c32b0df099d5df046d96599cb330d4ed7c097cb087f
     restart: unless-stopped
     environment:
       CONFIG_FILE: /config.yml

gotify/compose.yaml

@@ -1,7 +1,7 @@
 services:
   gotify:
     container_name: gotify
-    image: ghcr.io/gotify/server:2.9.0@sha256:4df8c1bb23646b8d8b308e881866474bfae4a9a5b3980e5047f87eb84017e8a0
+    image: ghcr.io/gotify/server:2.9.1@sha256:a3af47067ce6aad76aadf5ba32d6ddfecd1ae576a961359f039fd1831e8b7652
     restart: unless-stopped
     environment:
       - TZ=${TZ}

hawser/compose.yaml

@@ -1,7 +1,7 @@
 services:
   hawser:
     container_name: hawser
-    image: ghcr.io/finsys/hawser:0.2.29@sha256:b6f8eabb5e839a1950fae5302db5a96e98dbe63e928e8178c3ca682aed008e26
+    image: ghcr.io/finsys/hawser:0.2.41@sha256:53bb1e23fb302f337d70fe111affee5f30f476c56aeb33c6c8c1d510fdc4133c
     restart: unless-stopped
     environment:
       - TOKEN=${TOKEN}

healthchecks/compose.yaml

@@ -1,7 +1,7 @@
 services:
   healthchecks:
     container_name: healthchecks
-    image: ghcr.io/linuxserver/healthchecks:4.0.20260216@sha256:9748ad5de1a8aaede64e54d742424f2e8a92ed661814c232b333e567de40d829
+    image: ghcr.io/linuxserver/healthchecks:4.2.20260428@sha256:2973440afcdcf5884b334782a70b7a7c292595810ad3a162f0289d2e878f2c80
     restart: unless-stopped
     environment:
       - PUID=${PUID}

home-assistant/compose.yaml

@@ -1,7 +1,7 @@
 services:
   home-assistant:
     container_name: home-assistant
-    image: ghcr.io/home-assistant/home-assistant:2026.2.3@sha256:96fa92d83fa8dae987fbbbcf58b1fea1140985ff6a8517b37f7b65c76ef20133
+    image: ghcr.io/home-assistant/home-assistant:2026.4.4@sha256:c1e5f0147f4cb51ccb05bb30b62a1269cc1bd48a6274792d3b38a77ab274dfd2
     restart: unless-stopped
     volumes:
       - ${APPDATA_PATH}/home-assistant/config:/config

homepage/compose-docker.yaml

@@ -15,7 +15,7 @@ services:
 
   homepage:
     container_name: homepage
-    image: ghcr.io/gethomepage/homepage:v1.10.1@sha256:0b596092c0b55fe4c65379a428a3fe90bd192f10d1b07d189a34fe5fabe7eedb
+    image: ghcr.io/gethomepage/homepage:v1.12.3@sha256:cc84f2f5eb3c7734353701ccbaa24ed02dacb0d119114e50e4251e2005f3990a
     restart: unless-stopped
     depends_on:
       homepage_socket_proxy:

homepage/compose.yaml

@@ -1,7 +1,7 @@
 services:
   homepage:
     container_name: homepage
-    image: ghcr.io/gethomepage/homepage:v1.10.1@sha256:0b596092c0b55fe4c65379a428a3fe90bd192f10d1b07d189a34fe5fabe7eedb
+    image: ghcr.io/gethomepage/homepage:v1.12.3@sha256:cc84f2f5eb3c7734353701ccbaa24ed02dacb0d119114e50e4251e2005f3990a
     restart: unless-stopped
     environment:
       - PUID=${PUID}

kiwix/compose.yaml

@@ -1,7 +1,7 @@
 services:
   kiwix:
     container_name: kiwix
-    image: ghcr.io/kiwix/kiwix-serve:3.8.1@sha256:9bffd4f940645d4d518f137e87b7865d3d0ef30f6c13fbe4a3b9e747be3cd1ad
+    image: ghcr.io/kiwix/kiwix-serve:3.8.2@sha256:0b6541355b250c6b45d2d7725e88f22f1d6a0f45ad9480d9c0bd4bc58436a12f
     restart: unless-stopped
     command:
       - '*.zim'

lldap/compose.yaml

@@ -1,7 +1,7 @@
 services:
   lldap_db:
     container_name: lldap_db
-    image: docker.io/library/postgres:18.2@sha256:9b5bd946f3a507db72c55959700e517463e8d5dbb6f7eb30d920d5bcf6951431
+    image: docker.io/library/postgres:18.3@sha256:78481659c47e862334611ccdaf7c369c986b3046da9857112f3b309114a65fb4
     restart: unless-stopped
     environment:
       - POSTGRES_USER=${POSTGRES_USER}

newt/compose.yaml

@@ -0,0 +1,10 @@
+services:
+  newt:
+    container_name: newt
+    image: fosrl/newt:1.12.2
+    restart: unless-stopped
+    environment:
+      - PANGOLIN_ENDPOINT=${PANGOLIN_ENDPOINT}
+      - NEWT_ID=${NEWT_ID}
+      - NEWT_SECRET=${NEWT_SECRET}
+    network_mode: host

pangolin/compose-local.yaml

@@ -0,0 +1,45 @@
+name: pangolin
+services:
+  pangolin:
+    container_name: pangolin
+    image: ghcr.io/fosrl/pangolin:1.18.0
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          memory: 1g
+        reservations:
+          memory: 256m
+    volumes:
+      - ./config:/app/config
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
+      interval: "10s"
+      timeout: "10s"
+      retries: 15
+
+  traefik:
+    container_name: traefik
+    image: ghcr.io/traefik/traefik:v3.6.15
+    restart: unless-stopped
+    depends_on:
+      pangolin:
+        condition: service_healthy
+    command:
+      - --configFile=/etc/traefik/traefik_config.yml
+    environment:
+      - CLOUDFLARE_DNS_API_TOKEN=${CLOUDFLARE_DNS_API_TOKEN}
+    volumes:
+      - ./config/traefik:/etc/traefik:ro # Volume to store the Traefik configuration
+      - ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
+      - ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs
+    ports:
+      - 443:443
+      - 80:80
+      - 22:22
+      - 2222:2222
+
+networks:
+  default:
+    driver: bridge
+    name: pangolin

pangolin/compose.yaml

@@ -0,0 +1,66 @@
+name: pangolin
+services:
+  pangolin:
+    container_name: pangolin
+    image: ghcr.io/fosrl/pangolin:1.18.0
+    restart: unless-stopped
+    volumes:
+      - ./config:/app/config
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
+      interval: "10s"
+      timeout: "10s"
+      retries: 15
+
+  gerbil:
+    container_name: gerbil
+    image: ghcr.io/fosrl/gerbil:1.3.1
+    restart: unless-stopped
+    depends_on:
+      pangolin:
+        condition: service_healthy
+    command:
+      - --reachableAt=http://gerbil:3004
+      - --generateAndSaveKeyTo=/var/config/key
+      - --remoteConfig=http://pangolin:3001/api/v1/
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+    volumes:
+      - ./config/:/var/config
+    ports:
+      - 51820:51820/udp
+      - 21820:21820/udp
+      - 443:443
+      - 80:80
+
+  traefik:
+    container_name: traefik
+    image: ghcr.io/traefik/traefik:v3.6.15
+    restart: unless-stopped
+    depends_on:
+      pangolin:
+        condition: service_healthy
+    command:
+      - --configFile=/etc/traefik/traefik_config.yml
+    environment:
+      - CLOUDFLARE_DNS_API_TOKEN=${CLOUDFLARE_DNS_API_TOKEN}
+    volumes:
+      - ./config/traefik:/etc/traefik:ro # Volume to store the Traefik configuration
+      - ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
+      - ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs
+    network_mode: service:gerbil # Ports appear on the gerbil service
+
+  webfinger:              # For Tailscale
+    container_name: webfinger
+    image: nginx:1.30.0-alpine
+    volumes:
+      - ./webfinger/webfinger.json:/usr/share/nginx/html/.well-known/webfinger:ro
+      - ./webfinger/nginx.conf:/etc/nginx/conf.d/default.conf:ro
+    restart: unless-stopped
+
+networks:
+  default:
+    driver: bridge
+    name: pangolin
+    enable_ipv6: true # activate if your system supports IPv6

pocket-id/compose.yaml

@@ -1,7 +1,7 @@
 services:
   pocket-id-db:
     container_name: pocket-id-db
-    image: docker.io/library/postgres:18.2@sha256:9b5bd946f3a507db72c55959700e517463e8d5dbb6f7eb30d920d5bcf6951431
+    image: docker.io/library/postgres:18.3@sha256:78481659c47e862334611ccdaf7c369c986b3046da9857112f3b309114a65fb4
     restart: unless-stopped
     environment:
       - POSTGRES_USER=${POSTGRES_USER}
@@ -21,7 +21,7 @@ services:
 
   pocket-id:
     container_name: pocket-id
-    image: ghcr.io/pocket-id/pocket-id:v2.3.0-distroless@sha256:85a7485108325e34679b0fbca0baeb8418401f6d6cf59944d50f3ec013aafd09
+    image: ghcr.io/pocket-id/pocket-id:v2.6.2-distroless@sha256:a9adc636b5d30098307b8a1292c5887a59690cd5429aac5e87b588852f9c346d
     restart: unless-stopped
     depends_on:
       pocket-id-db:

portainer/compose.yaml

@@ -1,7 +1,7 @@
 services:
   portainer:
     container_name: portainer
-    image: docker.io/portainer/portainer-ee:alpine@sha256:eb3ad2004dfc15b6aa7b71b27017e756d8b7c016b7e7f2989a13eec96e734ac1
+    image: docker.io/portainer/portainer-ee:alpine@sha256:892d1e5458f17f87735390b8049e1dc535c3fdba120f2a66e4411e099cff1550
     restart: unless-stopped
     volumes:
       - ./data:/data

selfhst-icons/compose.yaml

@@ -1,16 +1,24 @@
 services:
   selfhst-icons:
     container_name: selfhst-icons
-    image: ghcr.io/selfhst/icons:3.2.0@sha256:3a6db28194ac905f9cfa8529b2abf7a3c21b688c5515b47c4a28ae49c16fa0fc
+    image: ghcr.io/selfhst/icons:4.0.2@sha256:ea70ba79e0e5126bb3ac191c595cdb74e5ae3d90dc95caf3cbda99e8d4b6c8ba
     restart: unless-stopped
     environment:
       - ICON_SOURCE=remote
       - REMOTE_URL=${REMOTE_URL}
-      - STANDARD_ICON_FORMAT=${STANDARD_ICON_FORMAT}
+      - PRIMARY_COLOR=${PRIMARY_COLOR}
+      - CACHE_TTL=${CACHE_TTL}
+      - CACHE_SIZE=${CACHE_SIZE}
     ports:
-      - 4050:4050
+      - ${PORT}:4050
     networks:
       - frontend
+    healthcheck:
+      test: ["CMD", "/server", "-healthcheck"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 5s
 
 networks:
   frontend:

uptime-kuma/compose.yaml

@@ -1,7 +1,7 @@
 services:
   uptime-kuma:
     container_name: uptime-kuma
-    image: ghcr.io/louislam/uptime-kuma:2.1.3@sha256:32c352a235fd10f98b3f64a6a4345d3c0c7f4e8be7810d2e1e867f7fe2e48ba2
+    image: ghcr.io/louislam/uptime-kuma:2.2.1@sha256:7337368a77873f159435de9ef09567f68c31285ed5f951dec36256c4b267ee44
     restart: unless-stopped
     volumes:
       - ${APPDATA_PATH}/uptime-kuma/config:/app/data