Standardize Compose Files

2026-01-24 23:11:05 -05:00
parent 13e3619cef
commit 08b184aea7
23 changed files with 710 additions and 605 deletions
--- a/docs/docker-guidelines.md
+++ b/docs/docker-guidelines.md
@@ -512,7 +512,7 @@ services:
      - TZ=${TIMEZONE}
 ```

-**Add health checks (if applicable):**
+**Add health checks (if compatable):**
 ```yaml
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
@@ -551,7 +551,7 @@ services:
 x-dockge:
  urls:
    - https://service-name.${DOMAIN}
-    - http://localhost:8080
+    - http://${SERVER_IP}$:8080

 volumes:
  service-data:
@@ -560,6 +560,8 @@ volumes:
 networks:
  traefik-network:
    external: true
+  homelab-network:
+    external: true
 ```

 If Traefik & Sablier are on a remote server:
@@ -658,8 +660,6 @@ services:
    image: lscr.io/linuxserver/sonarr:4.0.0
    container_name: sonarr
    # Sonarr - TV Show management and automation
-    # Access at: https://sonarr.yourdomain.duckdns.org (via Traefik)
-    # Connects to: Prowlarr (indexers), qBittorrent (downloads)
    # Protected by: Authelia SSO, Sablier lazy loading
    restart: no
 ```
--- a/docs/quick-reference.md
+++ b/docs/quick-reference.md
@@ -11,13 +11,15 @@ Your homelab uses separate stacks for organization:
 - **`dashboards.yml`** - Dashboard services (Homepage, Homarr) - 2 services

 **Available in Dockge (deploy as needed):**
- **`media.yml`** - Media services (Plex, Jellyfin, Sonarr, Radarr, Prowlarr, qBittorrent)
- **`media-extended.yml`** - Additional media tools (Readarr, Lidarr, Mylar, Calibre)
+- **`media.yml`** - Media services (Jellyfin, Calibre-Web)
+- **`media-management.yml`** - Media automation (Sonarr, Radarr, Prowlarr, *arr services)
+- **`transcoders.yml`** - Transcoding services (Tdarr, Unmanic)
+- **`wikis.yml`** - Wiki platforms (DokuWiki, BookStack, MediaWiki)
 - **`homeassistant.yml`** - Home automation (Home Assistant, Node-RED, Zigbee2MQTT, ESPHome)
- **`productivity.yml`** - Productivity apps (Nextcloud, Gitea, Bookstack, Outline, Excalidraw)
+- **`productivity.yml`** - Productivity apps (Nextcloud, Gitea, Mealie, WordPress)
 - **`monitoring.yml`** - Monitoring stack (Grafana, Prometheus, Uptime Kuma, Netdata)
- **`utilities.yml`** - Utility services (Duplicati, Code Server, FreshRSS, Wallabag)
- **`alternatives.yml`** - Alternative tools (Portainer, Authentik)
+- **`utilities.yml`** - Utility services (Vaultwarden, Backrest, Duplicati, Form.io)
+- **`alternatives.yml`** - Alternative tools (Portainer, Authentik, Plex)

 > All stacks can be modified by the AI to suit your preferences.

@@ -205,14 +207,15 @@ docker image prune -a
 - **9696**: Prowlarr
 - **8081**: qBittorrent

-### Extended Media (media-extended.yml)
+### Media Management (media-management.yml)
 - **8787**: Readarr
 - **8686**: Lidarr
 - **5299**: Lazy Librarian
 - **8090**: Mylar3
- **8083**: Calibre-Web
 - **5055**: Jellyseerr
 - **9697**: FlareSolverr
+
+### Transcoders (transcoders.yml)
 - **7889**: Tdarr Server
 - **8265**: Unmanic

--- a/docs/service-docs/calibre-web.md
+++ b/docs/service-docs/calibre-web.md
@@ -14,7 +14,7 @@

 **Category:** Ebook Management  
 **Docker Image:** [linuxserver/calibre-web](https://hub.docker.com/r/linuxserver/calibre-web)  
-**Default Stack:** `media-extended.yml`  
+**Default Stack:** `media.yml`  
 **Web UI:** `https://calibre-web.${DOMAIN}` or `http://SERVER_IP:8083`  
 **Default Login:** admin/admin123  
 **Ports:** 8083
--- a/docs/service-docs/dockge.md
+++ b/docs/service-docs/dockge.md
@@ -98,7 +98,7 @@ Each folder is a "stack" with its compose file and volumes.
 ├── infrastructure/    # Management and monitoring
 ├── dashboards/        # Homepage, Homarr
 ├── media/             # Plex, Sonarr, Radarr, etc.
-├── media-extended/    # Additional media services
+├── media-management/    # Media automation services
 ├── homeassistant/     # Home automation
 ├── productivity/      # Nextcloud, Gitea, etc.
 ├── utilities/         # Vaultwarden, backups
--- a/docs/service-docs/flaresolverr.md
+++ b/docs/service-docs/flaresolverr.md
@@ -16,7 +16,7 @@

 **Category:** Proxy Service  
 **Docker Image:** [ghcr.io/flaresolverr/flaresolverr](https://github.com/FlareSolverr/FlareSolverr/pkgs/container/flaresolverr)  
-**Default Stack:** `media-extended.yml`  
+**Default Stack:** `media-management.yml`  
 **API Port:** 8191  
 **Authentication:** None (internal service)  
 **Used By:** Prowlarr, Jackett, NZBHydra2
--- a/docs/service-docs/jellyseerr.md
+++ b/docs/service-docs/jellyseerr.md
@@ -17,7 +17,7 @@

 **Category:** Media Request Management  
 **Docker Image:** [fallenbagel/jellyseerr](https://hub.docker.com/r/fallenbagel/jellyseerr)  
-**Default Stack:** `media-extended.yml`  
+**Default Stack:** `media-management.yml`  
 **Web UI:** `https://jellyseerr.${DOMAIN}` or `http://SERVER_IP:5055`  
 **Authentication:** Via Jellyfin (SSO)  
 **Ports:** 5055
--- a/docs/service-docs/lazylibrarian.md
+++ b/docs/service-docs/lazylibrarian.md
@@ -13,7 +13,7 @@

 **Category:** Book Management  
 **Docker Image:** [linuxserver/lazylibrarian](https://hub.docker.com/r/linuxserver/lazylibrarian)  
-**Default Stack:** `media-extended.yml`  
+**Default Stack:** `media-management.yml`  
 **Web UI:** `http://SERVER_IP:5299`  
 **Alternative To:** Readarr  
 **Ports:** 5299
--- a/docs/service-docs/lidarr.md
+++ b/docs/service-docs/lidarr.md
@@ -17,7 +17,7 @@

 **Category:** Media Management & Automation  
 **Docker Image:** [linuxserver/lidarr](https://hub.docker.com/r/linuxserver/lidarr)  
-**Default Stack:** `media-extended.yml`  
+**Default Stack:** `media-management.yml`  
 **Web UI:** `https://lidarr.${DOMAIN}` or `http://SERVER_IP:8686`  
 **Authentication:** Optional (configurable)  
 **Ports:** 8686
--- a/docs/service-docs/tdarr.md
+++ b/docs/service-docs/tdarr.md
@@ -17,7 +17,7 @@

 **Category:** Media Transcoding  
 **Docker Image:** [ghcr.io/haveagitgat/tdarr](https://github.com/HaveAGitGat/Tdarr/pkgs/container/tdarr)  
-**Default Stack:** `media-extended.yml`  
+**Default Stack:** `transcoders.yml`  
 **Web UI:** `https://tdarr.${DOMAIN}` or `http://SERVER_IP:8265`  
 **Server Port:** 8266  
 **Authentication:** Built-in  
--- a/docs/service-docs/unmanic.md
+++ b/docs/service-docs/unmanic.md
@@ -16,7 +16,7 @@

 **Category:** Media Optimization  
 **Docker Image:** [josh5/unmanic](https://hub.docker.com/r/josh5/unmanic)  
-**Default Stack:** `media-extended.yml`  
+**Default Stack:** `transcoders.yml`  
 **Web UI:** `https://unmanic.${DOMAIN}` or `http://SERVER_IP:8888`  
 **Authentication:** Optional  
 **Ports:** 8888
--- a/docs/services-overview-clean.md
+++ b/docs/services-overview-clean.md
@@ -0,0 +1,235 @@
+# Services Overview
+
+This document provides a comprehensive overview of all 50+ pre-configured services available in the AI-Homelab repository.
+
+## Services Overview
+
+| Stacks (12) | Services (70 + 6db) | SSO | Storage | Access URLs |
+|-------|----------|-----|---------|-------------|
+| **📦 core.yaml (4)** | **Deploy First** | | | |
+| ├─ DuckDNS | Dynamic DNS updater | - | /opt/stacks/core/duckdns | No UI |
+| ├─ Traefik | Reverse proxy + SSL | ✓ | /opt/stacks/core/traefik | traefik.${DOMAIN} |
+| ├─ Authelia | SSO authentication | - | /opt/stacks/core/authelia | auth.${DOMAIN} |
+| └─ Sablier | Lazy loading service | - | /opt/stacks/core/sablier | No UI |
+| **🔒 vpn.yaml (2)** | **VPN Services** | | | |
+| ├─ Gluetun | VPN (Surfshark) | - | /opt/stacks/vpn/gluetun | No UI |
+| └─ qBittorrent | Torrent (via VPN) | ✓ | /mnt/downloads | qbit.${DOMAIN} |
+| **🔧 infrastructure.yaml** (6)** | | | | |
+| ├─ Pi-hole | DNS + Ad blocking | ✓ | /opt/stacks/infrastructure | pihole.${DOMAIN} |
+| ├─ Watchtower | Auto container updates | - | /opt/stacks/infrastructure | No UI |
+| ├─ Dozzle | Docker log viewer | ✓ | /opt/stacks/infrastructure | dozzle.${DOMAIN} |
+| ├─ Glances | System monitoring | ✓ | /opt/stacks/infrastructure | glances.${DOMAIN} |
+| ├─ Code Server | VS Code in browser | ✓ | /opt/stacks/infrastructure | code.${DOMAIN} |
+| └─ Docker Proxy | Secure socket access | - | /opt/stacks/infrastructure | No UI |
+| **📊 dashboards.yaml** (2) | | | | |
+| ├─ Homepage | App dashboard (AI cfg) | ✓ | /opt/stacks/dashboards | home.${DOMAIN} |
+| └─ Homarr | Modern dashboard | ✓ | /opt/stacks/dashboards | homarr.${DOMAIN} |
+| **🎬 media.yaml** (2) | | | | |
+| ├─ Jellyfin | Media server (OSS) | ✗ | /mnt/media, /mnt/transcode | jellyfin.${DOMAIN} |
+| └─ Calibre-Web | Ebook reader | ✓ | /opt/stacks/media, /mnt/media | calibre.${DOMAIN} |
+| **📺 media-management.yaml** (9) | | | | |
+| ├─ Sonarr | TV automation | ✓ | /opt/stacks/media-management, /mnt/media | sonarr.${DOMAIN} |
+| ├─ Radarr | Movie automation | ✓ | /opt/stacks/media-management, /mnt/media | radarr.${DOMAIN} |
+| ├─ Prowlarr | Indexer manager | ✓ | /opt/stacks/media-management | prowlarr.${DOMAIN} |
+| ├─ Readarr | Ebooks/Audiobooks | ✓ | /opt/stacks/media-management, /mnt/media | readarr.${DOMAIN} |
+| ├─ Lidarr | Music manager | ✓ | /opt/stacks/media-management, /mnt/media | lidarr.${DOMAIN} |
+| ├─ Lazy Librarian | Book automation | ✓ | /opt/stacks/media-management, /mnt/media | lazylibrarian.${DOMAIN} |
+| ├─ Mylar3 | Comic manager | ✓ | /opt/stacks/media-management, /mnt/media | mylar.${DOMAIN} |
+| ├─ Jellyseerr | Media requests | ✓ | /opt/stacks/media-management | jellyseerr.${DOMAIN} |
+| └─ FlareSolverr | Cloudflare bypass | - | /opt/stacks/media-management | No UI |
+| **🔄 transcoders.yaml** (3) | | | | |
+| ├─ Tdarr Server | Transcoding server | ✓ | /opt/stacks/transcoders, /mnt/transcode | tdarr.${DOMAIN} |
+| ├─ Tdarr Node | Transcoding worker | - | /mnt/transcode-cache | No UI |
+| └─ Unmanic | Library optimizer | ✓ | /opt/stacks/transcoders, /mnt/transcode | unmanic.${DOMAIN} |
+| **📖 wikis.yaml** (4) | | | | |
+| ├─ DokuWiki | File-based wiki | ✓ | /opt/stacks/wikis | dokuwiki.${DOMAIN} |
+| ├─ BookStack | Documentation | ✓ | /opt/stacks/wikis | docs.${DOMAIN} |
+| │  └─ bookstack-db | MariaDB | - | /opt/stacks/wikis | No UI |
+| └─ MediaWiki | Wiki platform | ✓ | /opt/stacks/wikis | mediawiki.${DOMAIN} |
+| **🏠 homeassistant.yaml** (6) | | | | |
+| ├─ Home Assistant | HA platform | ✗ | /opt/stacks/homeassistant | ha.${DOMAIN} |
+| ├─ ESPHome | ESP firmware mgr | ✓ | /opt/stacks/homeassistant | esphome.${DOMAIN} |
+| ├─ TasmoAdmin | Tasmota device mgr | ✓ | /opt/stacks/homeassistant | tasmoadmin.${DOMAIN} |
+| ├─ Node-RED | Automation flows | ✓ | /opt/stacks/homeassistant | nodered.${DOMAIN} |
+| ├─ Mosquitto | MQTT broker | - | /opt/stacks/homeassistant | Ports 1883, 9001 |
+| └─ Zigbee2MQTT | Zigbee bridge | ✓ | /opt/stacks/homeassistant | zigbee2mqtt.${DOMAIN} |
+| **💼 productivity.yaml** (8 + 6 DBs) | | | | |
+| ├─ Nextcloud | File sync platform | ✓ | /opt/stacks/productivity, /mnt/nextcloud | nextcloud.${DOMAIN} |
+| │  └─ nextcloud-db | MariaDB | - | /opt/stacks/productivity | No UI |
+| ├─ Mealie | Recipe manager | ✗ | /opt/stacks/productivity | mealie.${DOMAIN} |
+| ├─ WordPress | Blog platform | ✗ | /opt/stacks/productivity | blog.${DOMAIN} |
+| │  └─ wordpress-db | MariaDB | - | /opt/stacks/productivity | No UI |
+| ├─ Gitea | Git service | ✓ | /opt/stacks/productivity, /mnt/git | git.${DOMAIN} |
+| │  └─ gitea-db | PostgreSQL | - | /opt/stacks/productivity | No UI |
+| └─ Jupyter Lab | Notebooks | ✓ | /opt/stacks/productivity | jupyter.${DOMAIN} |
+| **🛠️ utilities.yaml** (5) | | | | |
+| ├─ Vaultwarden | Password manager | ✗ | /opt/stacks/utilities | bitwarden.${DOMAIN} |
+| ├─ Backrest | Backup (restic) | ✓ | /opt/stacks/utilities, /mnt/backups | backrest.${DOMAIN} |
+| ├─ Duplicati | Encrypted backups | ✓ | /opt/stacks/utilities, /mnt/backups | duplicati.${DOMAIN} |
+| ├─ Form.io | Form builder | ✓ | /opt/stacks/utilities | forms.${DOMAIN} |
+| │  └─ formio-mongo | MongoDB | - | /opt/stacks/utilities | No UI |
+| └─ Authelia-Redis | Session storage | - | /opt/stacks/utilities | No UI |
+| **📈 monitoring.yaml** (8) | | | | |
+| ├─ Prometheus | Metrics collection | ✓ | /opt/stacks/monitoring | prometheus.${DOMAIN} |
+| ├─ Grafana | Visualization | ✓ | /opt/stacks/monitoring | grafana.${DOMAIN} |
+| ├─ Loki | Log aggregation | - | /opt/stacks/monitoring | Via Grafana |
+| ├─ Promtail | Log shipper | - | /opt/stacks/monitoring | No UI |
+| ├─ Node Exporter | Host metrics | - | /opt/stacks/monitoring | No UI |
+| ├─ cAdvisor | Container metrics | - | /opt/stacks/monitoring | Internal :8080 |
+| └─ Uptime Kuma | Uptime monitoring | ✓ | /opt/stacks/monitoring | status.${DOMAIN} |
+| **🔧 alternatives.yaml** (6) | | | | |
+| ├─ Dockge | Stack manager (PRIMARY) | ✓ | /opt/stacks/alternatives | dockge.${DOMAIN} |
+| ├─ Portainer | Container management | ✓ | /opt/stacks/alternatives | portainer.${DOMAIN} |
+| ├─ Authentik Server | SSO with web UI | ✓ | /opt/stacks/alternatives | authentik.${DOMAIN} |
+| │  ├─ authentik-worker | Background tasks | - | /opt/stacks/alternatives | No UI |
+| │  ├─ authentik-db | PostgreSQL | - | /opt/stacks/alternatives | No UI |
+| │  └─ authentik-redis | Cache/messaging | - | /opt/stacks/alternatives | No UI |
+| └─ Plex | Media server | ✗ | /mnt/media, /mnt/transcode | plex.${DOMAIN} |
+| **🏠 homeassistant.yaml** (7) | | | | |
+| ├─ Home Assistant | HA platform | ✗ | /opt/stacks/homeassistant | ha.${DOMAIN} |
+| ├─ ESPHome | ESP firmware mgr | ✓ | /opt/stacks/homeassistant | esphome.${DOMAIN} |
+| ├─ TasmoAdmin | Tasmota device mgr | ✓ | /opt/stacks/homeassistant | tasmoadmin.${DOMAIN} |
+| ├─ Node-RED | Automation flows | ✓ | /opt/stacks/homeassistant | nodered.${DOMAIN} |
+| ├─ Mosquitto | MQTT broker | - | /opt/stacks/homeassistant | Ports 1883, 9001 |
+| ├─ Zigbee2MQTT | Zigbee bridge | ✓ | /opt/stacks/homeassistant | zigbee2mqtt.${DOMAIN} |
+| └─ MotionEye | Video surveillance | ✓ | /opt/stacks/homeassistant, /mnt/surveillance | motioneye.${DOMAIN} |
+| **💼 productivity.yaml** (8 + 6 DBs) | | | | |
+| ├─ Nextcloud | File sync platform | ✓ | /opt/stacks/productivity, /mnt/nextcloud | nextcloud.${DOMAIN} |
+| │  └─ nextcloud-db | MariaDB | - | /opt/stacks/productivity | No UI |
+| ├─ Mealie | Recipe manager | ✗ | /opt/stacks/productivity | mealie.${DOMAIN} |
+| ├─ WordPress | Blog platform | ✗ | /opt/stacks/productivity | blog.${DOMAIN} |
+| │  └─ wordpress-db | MariaDB | - | /opt/stacks/productivity | No UI |
+| ├─ Gitea | Git service | ✓ | /opt/stacks/productivity, /mnt/git | git.${DOMAIN} |
+| │  └─ gitea-db | PostgreSQL | - | /opt/stacks/productivity | No UI |
+| ├─ DokuWiki | File-based wiki | ✓ | /opt/stacks/productivity | wiki.${DOMAIN} |
+| ├─ BookStack | Documentation | ✓ | /opt/stacks/productivity | docs.${DOMAIN} |
+| │  └─ bookstack-db | MariaDB | - | /opt/stacks/productivity | No UI |
+| ├─ MediaWiki | Wiki platform | ✓ | /opt/stacks/productivity | mediawiki.${DOMAIN} |
+| │  └─ mediawiki-db | MariaDB | - | /opt/stacks/productivity | No UI |
+| └─ Form.io | Form builder | ✓ | /opt/stacks/productivity | forms.${DOMAIN} |
+|    └─ formio-mongo | MongoDB | - | /opt/stacks/productivity | No UI |
+| **🛠️ utilities.yaml** (7) | | | | |
+| ├─ Vaultwarden | Password manager | ✗ | /opt/stacks/utilities | bitwarden.${DOMAIN} |
+| ├─ Backrest | Backup (restic) | ✓ | /opt/stacks/utilities, /mnt/backups | backrest.${DOMAIN} |
+| ├─ Duplicati | Encrypted backups | ✓ | /opt/stacks/utilities, /mnt/backups | duplicati.${DOMAIN} |
+| ├─ Code Server | VS Code in browser | ✓ | /opt/stacks/utilities | code.${DOMAIN} |
+| ├─ Form.io | Form platform | ✓ | /opt/stacks/utilities | forms.${DOMAIN} |
+| │  └─ formio-mongo | MongoDB | - | /opt/stacks/utilities | No UI |
+| └─ Authelia-Redis | Session storage | - | /opt/stacks/utilities | No UI |
+| **📈 monitoring.yaml** (8) | | | | |
+| ├─ Prometheus | Metrics collection | ✓ | /opt/stacks/monitoring | prometheus.${DOMAIN} |
+| ├─ Grafana | Visualization | ✓ | /opt/stacks/monitoring | grafana.${DOMAIN} |
+| ├─ Loki | Log aggregation | - | /opt/stacks/monitoring | Via Grafana |
+| ├─ Promtail | Log shipper | - | /opt/stacks/monitoring | No UI |
+| ├─ Node Exporter | Host metrics | - | /opt/stacks/monitoring | No UI |
+| ├─ cAdvisor | Container metrics | - | /opt/stacks/monitoring | Internal :8080 |
+| └─ Uptime Kuma | Uptime monitoring | ✓ | /opt/stacks/monitoring | status.${DOMAIN} |
+| **👨‍💻 development.yaml** (6) | | | | |
+| ├─ GitLab CE | Git + CI/CD | ✓ | /opt/stacks/development, /mnt/git | gitlab.${DOMAIN} |
+| ├─ PostgreSQL | SQL database | - | /opt/stacks/development | Port 5432 |
+| ├─ Redis | In-memory store | - | /opt/stacks/development | Port 6379 |
+| ├─ pgAdmin | PostgreSQL UI | ✓ | /opt/stacks/development | pgadmin.${DOMAIN} |
+| ├─ Jupyter Lab | Notebooks | ✓ | /opt/stacks/development | jupyter.${DOMAIN} |
+| └─ Code Server | VS Code | ✓ | /opt/stacks/development | code.${DOMAIN} |
+
+**Legend:** ✓ = Protected by SSO | ✗ = Bypasses SSO | - = No web UI
+
+## Quick Deployment Order
+
+1. **Create Networks** (one-time setup)
+   ```bash
+   docker network create traefik-network
+   docker network create homelab-network
+   docker network create dockerproxy-network
+   ```
+
+2. **Deploy Core Stack** (required first)
+   ```bash
+   cd /opt/stacks/core/
+   docker compose up -d
+   ```
+
+3. **Deploy Infrastructure**
+   ```bash
+   cd /opt/stacks/infrastructure/
+   docker compose up -d
+   ```
+
+4. **Deploy Dashboards**
+   ```bash
+   cd /opt/stacks/dashboards/
+   docker compose up -d
+   ```
+
+5. **Deploy Additional Stacks** (as needed)
+   - Media: `/opt/stacks/media/`
+   - Media Management: `/opt/stacks/media-management/`
+   - Transcoders: `/opt/stacks/transcoders/`
+   - Wikis: `/opt/stacks/wikis/`
+   - Home Automation: `/opt/stacks/homeassistant/`
+   - Productivity: `/opt/stacks/productivity/`
+   - Utilities: `/opt/stacks/utilities/`
+   - Monitoring: `/opt/stacks/monitoring/`
+   - Alternatives: `/opt/stacks/alternatives/`
+
+## Toggling SSO (Authelia) On/Off
+
+You can easily enable or disable SSO protection for any service by modifying its Traefik labels in the docker-compose.yml file.
+
+### To Enable SSO on a Service
+
+Add the Authelia middleware to the service's Traefik labels:
+
+```yaml
+labels:
+  - "traefik.enable=true"
+  - "traefik.http.routers.servicename.rule=Host(`servicename.${DOMAIN}`)"
+  - "traefik.http.routers.servicename.entrypoints=websecure"
+  - "traefik.http.routers.servicename.tls.certresolver=letsencrypt"
+  - "traefik.http.routers.servicename.middlewares=authelia@docker"  # ← Add this line
+  - "traefik.http.services.servicename.loadbalancer.server.port=8080"
+```
+
+### To Disable SSO on a Service
+
+Comment out (don't remove) the middleware line:
+
+```yaml
+labels:
+  - "traefik.enable=true"
+  - "traefik.http.routers.servicename.rule=Host(`servicename.${DOMAIN}`)"
+  - "traefik.http.routers.servicename.entrypoints=websecure"
+  - "traefik.http.routers.servicename.tls.certresolver=letsencrypt"
+  # - "traefik.http.routers.servicename.middlewares=authelia@docker"  # ← Commented out (not removed)
+  - "traefik.http.services.servicename.loadbalancer.server.port=8080"
+```
+
+After making changes, redeploy the service:
+
+```bash
+# From inside the stack directory
+cd /opt/stacks/stack-name/
+docker compose up -d
+
+# Or from anywhere, using the full path
+docker compose -f /opt/stacks/stack-name/docker-compose.yml up -d
+```
+
+**Stopping a Service:**
+
+```bash
+# From inside the stack directory
+cd /opt/stacks/stack-name/
+docker compose down
+
+# Or from anywhere, using the full path
+docker compose -f /opt/stacks/stack-name/docker-compose.yml down
+```
+
+**Use Cases for Development/Production:**
+- **Security First**: All services start with SSO enabled by default for maximum security
+- **Development**: Keep SSO enabled to protect services during testing
+- **Production**: Disable SSO only for services needing direct app/API access (Plex, Jellyfin)
+- **Gradual Exposure**: Comment out SSO only when ready to expose a service
+- **Quick Toggle**: AI assistant can modify these labels automatically when you ask
+
--- a/docs/services-overview.md
+++ b/docs/services-overview.md
@@ -4,47 +4,24 @@ This document provides a comprehensive overview of all 50+ pre-configured servic

 ## Services Overview

-| Stacks (10) | Services (70 + 6db) | SSO | Storage | Access URLs |
+| Stacks (12) | Services (70 + 6db) | SSO | Storage | Access URLs |
 |-------|----------|-----|---------|-------------|
-| **📦 core.yaml (3)** | **Deploy First** | | | |
+| **<EFBFBD> alternatives.yaml** (6 + 3 DBs) | | | | |
+| ├─ Dockge | Stack manager (PRIMARY) | ✓ | /opt/stacks/alternatives | dockge.${DOMAIN} |
+| ├─ Portainer | Container management | ✓ | /opt/stacks/alternatives | portainer.${DOMAIN} |
+| ├─ Authentik Server | SSO with web UI | ✓ | /opt/stacks/alternatives | authentik.${DOMAIN} |
+| │  ├─ authentik-worker | Background tasks | - | /opt/stacks/alternatives | No UI |
+| │  ├─ authentik-db | PostgreSQL | - | /opt/stacks/alternatives | No UI |
+| │  └─ authentik-redis | Cache/messaging | - | /opt/stacks/alternatives | No UI |
+| └─ Plex | Media server | ✗ | /mnt/media, /mnt/transcode | plex.${DOMAIN} |
+| **📦 core.yaml (4)** | **Deploy First** | | | |
 | ├─ DuckDNS | Dynamic DNS updater | - | /opt/stacks/core/duckdns | No UI |
 | ├─ Traefik | Reverse proxy + SSL | ✓ | /opt/stacks/core/traefik | traefik.${DOMAIN} |
-| └─ Authelia | SSO authentication | - | /opt/stacks/core/authelia | auth.${DOMAIN} |
-| **🔒 vpn.yaml (2)** | **VPN Services** | | | |
-| ├─ Gluetun | VPN (Surfshark) | - | /opt/stacks/vpn/gluetun | No UI |
-| └─ qBittorrent | Torrent (via VPN) | ✓ | /mnt/downloads | qbit.${DOMAIN} |
-| **🔧 infrastructure.yaml** (12) | | | | |
-| ├─ Dockge | Stack manager (PRIMARY) | ✓ | /opt/stacks/infrastructure | dockge.${DOMAIN} |
-| ├─ Portainer | Container management | ✓ | /opt/stacks/infrastructure | portainer.${DOMAIN} |
-| ├─ Authentik Server | SSO with web UI | ✓ | /opt/stacks/authentik | authentik.${DOMAIN} |
-| │  ├─ authentik-worker | Background tasks | - | /opt/stacks/authentik | No UI |
-| │  ├─ authentik-db | PostgreSQL | - | /opt/stacks/authentik | No UI |
-| │  └─ authentik-redis | Cache/messaging | - | /opt/stacks/authentik | No UI |
-| ├─ Pi-hole | DNS + Ad blocking | ✓ | /opt/stacks/infrastructure | pihole.${DOMAIN} |
-| ├─ Watchtower | Auto container updates | - | /opt/stacks/infrastructure | No UI |
-| ├─ Dozzle | Docker log viewer | ✓ | /opt/stacks/infrastructure | dozzle.${DOMAIN} |
-| ├─ Glances | System monitoring | ✓ | /opt/stacks/infrastructure | glances.${DOMAIN} |
-| └─ Docker Proxy | Secure socket access | - | /opt/stacks/infrastructure | No UI |
+| ├─ Authelia | SSO authentication | - | /opt/stacks/core/authelia | auth.${DOMAIN} |
+| └─ Sablier | Lazy loading service | - | /opt/stacks/core/sablier | No UI |
 | **📊 dashboards.yaml** (2) | | | | |
 | ├─ Homepage | App dashboard (AI cfg) | ✓ | /opt/stacks/dashboards | home.${DOMAIN} |
 | └─ Homarr | Modern dashboard | ✓ | /opt/stacks/dashboards | homarr.${DOMAIN} |
-| **🎬 media** (6) | | | | |
-| ├─ Plex | Media server | ✗ | /mnt/media, /mnt/transcode | plex.${DOMAIN} |
-| ├─ Jellyfin | Media server (OSS) | ✗ | /mnt/media, /mnt/transcode | jellyfin.${DOMAIN} |
-| ├─ Sonarr | TV automation | ✓ | /opt/stacks/media, /mnt/media | sonarr.${DOMAIN} |
-| ├─ Radarr | Movie automation | ✓ | /opt/stacks/media, /mnt/media | radarr.${DOMAIN} |
-| └─ Prowlarr | Indexer manager | ✓ | /opt/stacks/media | prowlarr.${DOMAIN} |
-| **📚 media-extended.yaml** (10) | | | | |
-| ├─ Readarr | Ebooks/Audiobooks | ✓ | /opt/stacks/media-ext, /mnt/media | readarr.${DOMAIN} |
-| ├─ Lidarr | Music manager | ✓ | /opt/stacks/media-ext, /mnt/media | lidarr.${DOMAIN} |
-| ├─ Lazy Librarian | Book automation | ✓ | /opt/stacks/media-ext, /mnt/media | lazylibrarian.${DOMAIN} |
-| ├─ Mylar3 | Comic manager | ✓ | /opt/stacks/media-ext, /mnt/media | mylar.${DOMAIN} |
-| ├─ Calibre-Web | Ebook reader | ✓ | /opt/stacks/media-ext, /mnt/media | calibre.${DOMAIN} |
-| ├─ Jellyseerr | Media requests | ✓ | /opt/stacks/media-ext | jellyseerr.${DOMAIN} |
-| ├─ FlareSolverr | Cloudflare bypass | - | /opt/stacks/media-ext | No UI |
-| ├─ Tdarr Server | Transcoding server | ✓ | /opt/stacks/media-ext, /mnt/transcode | tdarr.${DOMAIN} |
-| ├─ Tdarr Node | Transcoding worker | - | /mnt/transcode-cache | No UI |
-| └─ Unmanic | Library optimizer | ✓ | /opt/stacks/media-ext, /mnt/transcode | unmanic.${DOMAIN} |
 | **🏠 homeassistant.yaml** (7) | | | | |
 | ├─ Home Assistant | HA platform | ✗ | /opt/stacks/homeassistant | ha.${DOMAIN} |
 | ├─ ESPHome | ESP firmware mgr | ✓ | /opt/stacks/homeassistant | esphome.${DOMAIN} |
@@ -53,29 +30,26 @@ This document provides a comprehensive overview of all 50+ pre-configured servic
 | ├─ Mosquitto | MQTT broker | - | /opt/stacks/homeassistant | Ports 1883, 9001 |
 | ├─ Zigbee2MQTT | Zigbee bridge | ✓ | /opt/stacks/homeassistant | zigbee2mqtt.${DOMAIN} |
 | └─ MotionEye | Video surveillance | ✓ | /opt/stacks/homeassistant, /mnt/surveillance | motioneye.${DOMAIN} |
-| **💼 productivity.yaml** (8 + 6 DBs) | | | | |
-| ├─ Nextcloud | File sync platform | ✓ | /opt/stacks/productivity, /mnt/nextcloud | nextcloud.${DOMAIN} |
-| │  └─ nextcloud-db | MariaDB | - | /opt/stacks/productivity | No UI |
-| ├─ Mealie | Recipe manager | ✗ | /opt/stacks/productivity | mealie.${DOMAIN} |
-| ├─ WordPress | Blog platform | ✗ | /opt/stacks/productivity | blog.${DOMAIN} |
-| │  └─ wordpress-db | MariaDB | - | /opt/stacks/productivity | No UI |
-| ├─ Gitea | Git service | ✓ | /opt/stacks/productivity, /mnt/git | git.${DOMAIN} |
-| │  └─ gitea-db | PostgreSQL | - | /opt/stacks/productivity | No UI |
-| ├─ DokuWiki | File-based wiki | ✓ | /opt/stacks/productivity | wiki.${DOMAIN} |
-| ├─ BookStack | Documentation | ✓ | /opt/stacks/productivity | docs.${DOMAIN} |
-| │  └─ bookstack-db | MariaDB | - | /opt/stacks/productivity | No UI |
-| ├─ MediaWiki | Wiki platform | ✓ | /opt/stacks/productivity | mediawiki.${DOMAIN} |
-| │  └─ mediawiki-db | MariaDB | - | /opt/stacks/productivity | No UI |
-| └─ Form.io | Form builder | ✓ | /opt/stacks/productivity | forms.${DOMAIN} |
-|    └─ formio-mongo | MongoDB | - | /opt/stacks/productivity | No UI |
-| **🛠️ utilities.yaml** (7) | | | | |
-| ├─ Vaultwarden | Password manager | ✗ | /opt/stacks/utilities | bitwarden.${DOMAIN} |
-| ├─ Backrest | Backup (restic) | ✓ | /opt/stacks/utilities, /mnt/backups | backrest.${DOMAIN} |
-| ├─ Duplicati | Encrypted backups | ✓ | /opt/stacks/utilities, /mnt/backups | duplicati.${DOMAIN} |
-| ├─ Code Server | VS Code in browser | ✓ | /opt/stacks/utilities | code.${DOMAIN} |
-| ├─ Form.io | Form platform | ✓ | /opt/stacks/utilities | forms.${DOMAIN} |
-| │  └─ formio-mongo | MongoDB | - | /opt/stacks/utilities | No UI |
-| └─ Authelia-Redis | Session storage | - | /opt/stacks/utilities | No UI |
+| **🔧 infrastructure.yaml** (6)** | | | | |
+| ├─ Pi-hole | DNS + Ad blocking | ✓ | /opt/stacks/infrastructure | pihole.${DOMAIN} |
+| ├─ Watchtower | Auto container updates | - | /opt/stacks/infrastructure | No UI |
+| ├─ Dozzle | Docker log viewer | ✓ | /opt/stacks/infrastructure | dozzle.${DOMAIN} |
+| ├─ Glances | System monitoring | ✓ | /opt/stacks/infrastructure | glances.${DOMAIN} |
+| ├─ Code Server | VS Code in browser | ✓ | /opt/stacks/infrastructure | code.${DOMAIN} |
+| └─ Docker Proxy | Secure socket access | - | /opt/stacks/infrastructure | No UI |
+| **📺 media-management.yaml** (9) | | | | |
+| ├─ Sonarr | TV automation | ✓ | /opt/stacks/media-management, /mnt/media | sonarr.${DOMAIN} |
+| ├─ Radarr | Movie automation | ✓ | /opt/stacks/media-management, /mnt/media | radarr.${DOMAIN} |
+| ├─ Prowlarr | Indexer manager | ✓ | /opt/stacks/media-management | prowlarr.${DOMAIN} |
+| ├─ Readarr | Ebooks/Audiobooks | ✓ | /opt/stacks/media-management, /mnt/media | readarr.${DOMAIN} |
+| ├─ Lidarr | Music manager | ✓ | /opt/stacks/media-management, /mnt/media | lidarr.${DOMAIN} |
+| ├─ Lazy Librarian | Book automation | ✓ | /opt/stacks/media-management, /mnt/media | lazylibrarian.${DOMAIN} |
+| ├─ Mylar3 | Comic manager | ✓ | /opt/stacks/media-management, /mnt/media | mylar.${DOMAIN} |
+| ├─ Jellyseerr | Media requests | ✓ | /opt/stacks/media-management | jellyseerr.${DOMAIN} |
+| └─ FlareSolverr | Cloudflare bypass | - | /opt/stacks/media-management | No UI |
+| **🎬 media.yaml** (2) | | | | |
+| ├─ Jellyfin | Media server (OSS) | ✗ | /mnt/media, /mnt/transcode | jellyfin.${DOMAIN} |
+| └─ Calibre-Web | Ebook reader | ✓ | /opt/stacks/media, /mnt/media | calibre.${DOMAIN} |
 | **📈 monitoring.yaml** (8) | | | | |
 | ├─ Prometheus | Metrics collection | ✓ | /opt/stacks/monitoring | prometheus.${DOMAIN} |
 | ├─ Grafana | Visualization | ✓ | /opt/stacks/monitoring | grafana.${DOMAIN} |
@@ -84,13 +58,35 @@ This document provides a comprehensive overview of all 50+ pre-configured servic
 | ├─ Node Exporter | Host metrics | - | /opt/stacks/monitoring | No UI |
 | ├─ cAdvisor | Container metrics | - | /opt/stacks/monitoring | Internal :8080 |
 | └─ Uptime Kuma | Uptime monitoring | ✓ | /opt/stacks/monitoring | status.${DOMAIN} |
-| **👨‍💻 development.yaml** (6) | | | | |
-| ├─ GitLab CE | Git + CI/CD | ✓ | /opt/stacks/development, /mnt/git | gitlab.${DOMAIN} |
-| ├─ PostgreSQL | SQL database | - | /opt/stacks/development | Port 5432 |
-| ├─ Redis | In-memory store | - | /opt/stacks/development | Port 6379 |
-| ├─ pgAdmin | PostgreSQL UI | ✓ | /opt/stacks/development | pgadmin.${DOMAIN} |
-| ├─ Jupyter Lab | Notebooks | ✓ | /opt/stacks/development | jupyter.${DOMAIN} |
-| └─ Code Server | VS Code | ✓ | /opt/stacks/development | code.${DOMAIN} |
+| **💼 productivity.yaml** (5 + 4 DBs) | | | | |
+| ├─ Nextcloud | File sync platform | ✓ | /opt/stacks/productivity, /mnt/nextcloud | nextcloud.${DOMAIN} |
+| │  └─ nextcloud-db | MariaDB | - | /opt/stacks/productivity | No UI |
+| ├─ Mealie | Recipe manager | ✗ | /opt/stacks/productivity | mealie.${DOMAIN} |
+| ├─ WordPress | Blog platform | ✗ | /opt/stacks/productivity | blog.${DOMAIN} |
+| │  └─ wordpress-db | MariaDB | - | /opt/stacks/productivity | No UI |
+| ├─ Gitea | Git service | ✓ | /opt/stacks/productivity, /mnt/git | git.${DOMAIN} |
+| │  └─ gitea-db | PostgreSQL | - | /opt/stacks/productivity | No UI |
+| └─ Jupyter Lab | Notebooks | ✓ | /opt/stacks/productivity | jupyter.${DOMAIN} |
+| **🔄 transcoders.yaml** (3) | | | | |
+| ├─ Tdarr Server | Transcoding server | ✓ | /opt/stacks/transcoders, /mnt/transcode | tdarr.${DOMAIN} |
+| ├─ Tdarr Node | Transcoding worker | - | /mnt/transcode-cache | No UI |
+| └─ Unmanic | Library optimizer | ✓ | /opt/stacks/transcoders, /mnt/transcode | unmanic.${DOMAIN} |
+| **🛠️ utilities.yaml** (7) | | | | |
+| ├─ Vaultwarden | Password manager | ✗ | /opt/stacks/utilities | bitwarden.${DOMAIN} |
+| ├─ Backrest | Backup (restic) | ✓ | /opt/stacks/utilities, /mnt/backups | backrest.${DOMAIN} |
+| ├─ Duplicati | Encrypted backups | ✓ | /opt/stacks/utilities, /mnt/backups | duplicati.${DOMAIN} |
+| ├─ Code Server | VS Code in browser | ✓ | /opt/stacks/utilities | code.${DOMAIN} |
+| ├─ Form.io | Form platform | ✓ | /opt/stacks/utilities | forms.${DOMAIN} |
+| │  └─ formio-mongo | MongoDB | - | /opt/stacks/utilities | No UI |
+| └─ Authelia-Redis | Session storage | - | /opt/stacks/utilities | No UI |
+| **🔒 vpn.yaml (2)** | **VPN Services** | | | |
+| ├─ Gluetun | VPN (Surfshark) | - | /opt/stacks/vpn/gluetun | No UI |
+| └─ qBittorrent | Torrent (via VPN) | ✓ | /mnt/downloads | qbit.${DOMAIN} |
+| **📖 wikis.yaml** (4) | | | | |
+| ├─ DokuWiki | File-based wiki | ✓ | /opt/stacks/wikis | dokuwiki.${DOMAIN} |
+| ├─ BookStack | Documentation | ✓ | /opt/stacks/wikis | docs.${DOMAIN} |
+| │  └─ bookstack-db | MariaDB | - | /opt/stacks/wikis | No UI |
+| └─ MediaWiki | Wiki platform | ✓ | /opt/stacks/wikis | mediawiki.${DOMAIN} |

 **Legend:** ✓ = Protected by SSO | ✗ = Bypasses SSO | - = No web UI

@@ -122,13 +118,19 @@ This document provides a comprehensive overview of all 50+ pre-configured servic
   ```

 5. **Deploy Additional Stacks** (as needed)
-   - Media: `/opt/stacks/media/`
-   - Extended Media: `/opt/stacks/media-extended/`
+   - Alternatives: `/opt/stacks/alternatives/`
+   - Core: `/opt/stacks/core/` (deploy first)
+   - Dashboards: `/opt/stacks/dashboards/`
   - Home Automation: `/opt/stacks/homeassistant/`
-   - Productivity: `/opt/stacks/productivity/`
-   - Utilities: `/opt/stacks/utilities/`
+   - Infrastructure: `/opt/stacks/infrastructure/`
+   - Media: `/opt/stacks/media/`
+   - Media Management: `/opt/stacks/media-management/`
   - Monitoring: `/opt/stacks/monitoring/`
-   - Development: `/opt/stacks/development/`
+   - Productivity: `/opt/stacks/productivity/`
+   - Transcoders: `/opt/stacks/transcoders/`
+   - Utilities: `/opt/stacks/utilities/`
+   - VPN: `/opt/stacks/vpn/`
+   - Wikis: `/opt/stacks/wikis/`

 ## Toggling SSO (Authelia) On/Off

@@ -191,137 +193,6 @@ docker compose -f /opt/stacks/stack-name/docker-compose.yml down
 - **Gradual Exposure**: Comment out SSO only when ready to expose a service
 - **Quick Toggle**: AI assistant can modify these labels automatically when you ask

-## Authelia Customization
-
-### Available Customization Options
-
-**1. Branding and Appearance**
-Edit `/opt/stacks/core/authelia/configuration.yml`:
-
-```yaml
-# Custom logo and branding
-theme: dark  # Options: light, dark, grey, auto
-
-# No built-in web UI for configuration
-# All settings managed via YAML files
-```
-
-**2. User Management**
-Users are managed in `/opt/stacks/core/authelia/users_database.yml`:
-
-```yaml
-users:
-  username:
-    displayname: "Display Name"
-    password: "$argon2id$v=19$m=65536..." # Generated with authelia hash-password
-    email: user@example.com
-    groups:
-      - admins
-      - users
-```
-
-Generate password hash:
-```bash
-docker run --rm authelia/authelia:4.37 authelia hash-password 'yourpassword'
-```
-
-**3. Access Control Rules**
-Customize who can access what in `configuration.yml`:
-
-```yaml
-access_control:
-  default_policy: deny
-  
-  rules:
-    # Public services (no auth)
-    - domain:
-        - "jellyfin.yourdomain.com"
-        - "plex.yourdomain.com"
-      policy: bypass
-    
-    # Admin only services
-    - domain:
-        - "dockge.yourdomain.com"
-        - "portainer.yourdomain.com"
-      policy: two_factor
-      subject:
-        - "group:admins"
-    
-    # All authenticated users
-    - domain: "*.yourdomain.com"
-      policy: one_factor
-```
-
-**4. Two-Factor Authentication (2FA)**
- TOTP (Time-based One-Time Password) via apps like Google Authenticator, Authy
- Configure in `configuration.yml` under `totp:` section
- Per-user enrollment via Authelia UI at `https://auth.${DOMAIN}`
-
-**5. Session Management**
-Edit `configuration.yml`:
-
-```yaml
-session:
-  name: authelia_session
-  expiration: 1h  # How long before re-login required
-  inactivity: 5m  # Timeout after inactivity
-  remember_me_duration: 1M  # "Remember me" checkbox duration
-```
-
-**6. Notification Settings**
-Email notifications for password resets, 2FA enrollment:
-
-```yaml
-notifier:
-  smtp:
-    host: smtp.gmail.com
-    port: 587
-    username: your-email@gmail.com
-    password: app-password
-    sender: authelia@yourdomain.com
-```
-
-### No Web UI for Configuration
-
-⚠️ **Important**: Authelia does **not** have a configuration web UI. All configuration is done via YAML files:
- `/opt/stacks/core/authelia/configuration.yml` - Main settings
- `/opt/stacks/core/authelia/users_database.yml` - User accounts
-
-This is **by design** and makes Authelia perfect for AI management and security-first approach:
- AI can read and modify YAML files
- Version control friendly
- No UI clicks required
- Infrastructure as code
- Secure by default
-
-**Web UI Available For:**
- Login page: `https://auth.${DOMAIN}`
- User profile: Change password, enroll 2FA
- Device enrollment: Manage trusted devices
-
-**Alternative with Web UI: Authentik**
-If you need a web UI for user management, Authentik is included in the infrastructure stack:
- **Authentik**: Full-featured SSO with web UI for user/group management
- Access at: `https://authentik.${DOMAIN}`
- Includes PostgreSQL database and Redis cache
- More complex but offers GUI-based configuration
- Deploy only if you need web-based user management
-
-**Other Alternatives:**
- **Keycloak**: Enterprise-grade SSO with web UI
- **Authelia + LDAP**: Use LDAP with web management (phpLDAPadmin, etc.)
-
-### Quick Configuration with AI
-
-Since all Authelia configuration is file-based, you can use the AI assistant to:
- Add/remove users
- Modify access rules
- Change session settings
- Update branding
- Enable/disable features
-
-Just ask: "Add a new user to Authelia" or "Change session timeout to 2 hours"
-
 ## Storage Recommendations

 | Data Type | Recommended Location | Reason |
@@ -355,3 +226,4 @@ All configuration templates are available in `config-templates/`:
 - **Quick Reference**: See [docs/quick-reference.md](quick-reference.md) for common commands
 - **Proxying External Hosts**: See [docs/proxying-external-hosts.md](proxying-external-hosts.md) for Raspberry Pi, NAS, etc.
 - **AI Assistant**: Use GitHub Copilot in VS Code with `.github/copilot-instructions.md` for intelligent homelab management
+