- Pin seaweedfs (4.47), jaeger (1.76.0), certbot (v5.8.0) and pgadmin
(9.18) instead of :latest.
- Rotate container logs (json-file, 3 x 10 MB) in every stack.
- Cap Jaeger's in-memory storage at 100k traces and add a healthcheck.
- Publish dev ports on 127.0.0.1 (DEV_BIND_ADDRESS) so the dev
credentials aren't reachable from the LAN.
- Fix the prod command in compose.yml's header, the README's note on who
writes the admin PAT, and the certbot command's line breaks.
One nginx owns host ports 80/443 for every project (Gitea, Musify) and
proxies by container name over infra-net and gitea_gitea; a certbot
service renews the Let's Encrypt certificates.
Admin