config: enable multiple instances everywhere it is actually possible

Three apps were instanceable and the rest were silent, so the feature
looked far narrower than it is. Every app has now been checked against
the two rules instance_create.sh enforces, and the answer recorded in
its config rather than left unset.

32 apps are instance-safe and now say so. Six are not, and each says why
in its own words instead of being indistinguishable from an app nobody
had reviewed:

  pihole      a DNS server must own port 53
  unbound     a resolver must own its fixed 5335
  stalwart    a mail server must own 25/465/587/993
  traefik     must own 443, and one Traefik routes every other app
  prometheus  node-exporter and cadvisor carry no "prometheus" prefix
  stoat       pins 7881, and database/redis/rabbit/minio carry no prefix

The first four are genuinely one-per-host: the port is not arbitrary, it
is the protocol. The last two are compose-identity problems and could be
fixed by prefixing those service names, which is a change to make
deliberately rather than in passing.

Recorded as an explicit false with a reason, not left unset, so the next
person reads a decision instead of an absence. The audit was verified not
to pass anything vacuously: every app resolves at least one service name,
so no app reached "eligible" merely because nothing was found to check.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

containers/adguard/adguard.config

@@ -14,6 +14,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_ADGUARD_APP_NAME=adguard
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_ADGUARD_MULTI_INSTANCE=true
 CFG_ADGUARD_BACKUP=true
 CFG_ADGUARD_BACKUP_STRATEGY=auto
 CFG_ADGUARD_UPDATE_TYPE=auto

containers/authelia/authelia.config

@@ -16,6 +16,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_AUTHELIA_APP_NAME=authelia
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_AUTHELIA_MULTI_INSTANCE=true
 CFG_AUTHELIA_REQUIRES="domain,traefik"
 CFG_AUTHELIA_BACKUP=true
 CFG_AUTHELIA_BACKUP_STRATEGY=auto

containers/crowdsec/crowdsec.config

@@ -13,6 +13,11 @@
 # PROMETHEUS_LISTEN = address CrowdSec's metrics endpoint binds to; must be reachable from the Prometheus container (default: all interfaces, port 6060 — keep the :6060 port)
 #
 CFG_CROWDSEC_APP_NAME=crowdsec
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_CROWDSEC_MULTI_INSTANCE=true
 CFG_CROWDSEC_HOST_INSTALL=true
 CFG_CROWDSEC_HOST_PACKAGE=crowdsec
 CFG_CROWDSEC_HOST_SERVICES=crowdsec.service,crowdsec-firewall-bouncer.service

containers/dashy/dashy.config

@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_DASHY_APP_NAME=dashy
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_DASHY_MULTI_INSTANCE=true
 CFG_DASHY_BACKUP=true
 CFG_DASHY_BACKUP_STRATEGY=auto
 CFG_DASHY_UPDATE_TYPE=auto

containers/gitea/gitea.config

@@ -13,6 +13,11 @@
 # METRICS_TOKEN = bearer token guarding /metrics (rides the public web port); auto-generated, mirrored into the Prometheus scrape config
 #
 CFG_GITEA_APP_NAME=gitea
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_GITEA_MULTI_INSTANCE=true
 CFG_GITEA_BACKUP=true
 CFG_GITEA_BACKUP_STRATEGY=auto
 CFG_GITEA_UPDATE_TYPE=auto

containers/gluetun/gluetun.config

@@ -12,6 +12,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_GLUETUN_APP_NAME=gluetun
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_GLUETUN_MULTI_INSTANCE=true
 CFG_GLUETUN_BACKUP=true
 CFG_GLUETUN_BACKUP_STRATEGY=auto
 CFG_GLUETUN_UPDATE_TYPE=auto

containers/grafana/grafana.config

@@ -13,6 +13,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_GRAFANA_APP_NAME=grafana
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_GRAFANA_MULTI_INSTANCE=true
 CFG_GRAFANA_REQUIRES="prometheus"
 CFG_GRAFANA_BACKUP=true
 CFG_GRAFANA_BACKUP_STRATEGY=auto

containers/headscale/headscale.config

@@ -11,6 +11,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_HEADSCALE_APP_NAME=headscale
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_HEADSCALE_MULTI_INSTANCE=true
 CFG_HEADSCALE_BACKUP=true
 CFG_HEADSCALE_BACKUP_STRATEGY=auto
 CFG_HEADSCALE_UPDATE_TYPE=auto

containers/invidious/invidious.config

@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_INVIDIOUS_APP_NAME=invidious
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_INVIDIOUS_MULTI_INSTANCE=true
 CFG_INVIDIOUS_BACKUP=false
 CFG_INVIDIOUS_BACKUP_STRATEGY=auto
 CFG_INVIDIOUS_UPDATE_TYPE=auto

containers/ipinfo/ipinfo.config

@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_IPINFO_APP_NAME=ipinfo
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_IPINFO_MULTI_INSTANCE=true
 CFG_IPINFO_BACKUP=false
 CFG_IPINFO_BACKUP_STRATEGY=auto
 CFG_IPINFO_UPDATE_TYPE=auto

containers/jellyfin/jellyfin.config

@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_JELLYFIN_APP_NAME=jellyfin
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_JELLYFIN_MULTI_INSTANCE=true
 CFG_JELLYFIN_BACKUP=true
 CFG_JELLYFIN_BACKUP_STRATEGY=auto
 CFG_JELLYFIN_UPDATE_TYPE=auto

containers/jitsimeet/jitsimeet.config

@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_JITSIMEET_APP_NAME=jitsimeet
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_JITSIMEET_MULTI_INSTANCE=true
 CFG_JITSIMEET_BACKUP=true
 CFG_JITSIMEET_BACKUP_STRATEGY=auto
 CFG_JITSIMEET_UPDATE_TYPE=auto

containers/libreportal_catalog/libreportal_catalog.config

@@ -12,6 +12,11 @@
 # DEV_ONLY = if true, hidden from the App Center unless Developer Mode is on
 #
 CFG_LIBREPORTAL_CATALOG_APP_NAME=libreportal_catalog
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_LIBREPORTAL_CATALOG_MULTI_INSTANCE=true
 CFG_LIBREPORTAL_CATALOG_BACKUP=true
 CFG_LIBREPORTAL_CATALOG_BACKUP_STRATEGY=auto
 CFG_LIBREPORTAL_CATALOG_UPDATE_TYPE=auto

containers/linkding/linkding.config

@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_LINKDING_APP_NAME=linkding
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_LINKDING_MULTI_INSTANCE=true
 CFG_LINKDING_BACKUP=true
 CFG_LINKDING_BACKUP_STRATEGY=auto
 CFG_LINKDING_UPDATE_TYPE=auto

containers/mastodon/mastodon.config

@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_MASTODON_APP_NAME=mastodon
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_MASTODON_MULTI_INSTANCE=true
 CFG_MASTODON_BACKUP=true
 CFG_MASTODON_BACKUP_STRATEGY=auto
 CFG_MASTODON_UPDATE_TYPE=auto

containers/matrix/matrix.config

@@ -17,6 +17,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_MATRIX_APP_NAME=matrix
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_MATRIX_MULTI_INSTANCE=true
 # No prerequisites. Synapse runs perfectly well on a plain HTTP listener reached
 # by IP over the LAN or a WireGuard tunnel — that is the same setup as sitting
 # behind a reverse proxy, minus the proxy. Only *federation* needs a real domain

containers/mattermost/mattermost.config

@@ -12,6 +12,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_MATTERMOST_APP_NAME=mattermost
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_MATTERMOST_MULTI_INSTANCE=true
 CFG_MATTERMOST_BACKUP=true
 CFG_MATTERMOST_BACKUP_STRATEGY=auto
 CFG_MATTERMOST_UPDATE_TYPE=auto

containers/moneyapp/moneyapp.config

@@ -12,6 +12,11 @@
 # AUTH_SECRET = NextAuth/Auth.js session secret (random base64; auto-generated)
 #
 CFG_MONEYAPP_APP_NAME=moneyapp
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_MONEYAPP_MULTI_INSTANCE=true
 CFG_MONEYAPP_REQUIRES=""
 CFG_MONEYAPP_BACKUP=true
 CFG_MONEYAPP_BACKUP_STRATEGY=auto

containers/navidrome/navidrome.config

@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_NAVIDROME_APP_NAME=navidrome
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_NAVIDROME_MULTI_INSTANCE=true
 CFG_NAVIDROME_BACKUP=true
 CFG_NAVIDROME_BACKUP_STRATEGY=auto
 CFG_NAVIDROME_UPDATE_TYPE=auto

containers/nextcloud/nextcloud.config

@@ -15,6 +15,11 @@
 # DB_ROOT_PASSWORD = MariaDB root account; kept separate from DB_PASSWORD so the app user can be rotated without touching root
 #
 CFG_NEXTCLOUD_APP_NAME=nextcloud
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_NEXTCLOUD_MULTI_INSTANCE=true
 CFG_NEXTCLOUD_BACKUP=true
 CFG_NEXTCLOUD_BACKUP_STRATEGY=auto
 CFG_NEXTCLOUD_UPDATE_TYPE=auto

containers/ollama/ollama.config

@@ -12,6 +12,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_OLLAMA_APP_NAME=ollama
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_OLLAMA_MULTI_INSTANCE=true
 CFG_OLLAMA_BACKUP=true
 CFG_OLLAMA_BACKUP_STRATEGY=auto
 CFG_OLLAMA_UPDATE_TYPE=auto

containers/onlyoffice/onlyoffice.config

@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_ONLYOFFICE_APP_NAME=onlyoffice
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_ONLYOFFICE_MULTI_INSTANCE=true
 CFG_ONLYOFFICE_BACKUP=true
 CFG_ONLYOFFICE_BACKUP_STRATEGY=auto
 CFG_ONLYOFFICE_UPDATE_TYPE=auto

containers/owncloud/owncloud.config

@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_OWNCLOUD_APP_NAME=owncloud
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_OWNCLOUD_MULTI_INSTANCE=true
 CFG_OWNCLOUD_BACKUP=true
 CFG_OWNCLOUD_BACKUP_STRATEGY=auto
 CFG_OWNCLOUD_UPDATE_TYPE=auto

containers/pihole/pihole.config

@@ -12,6 +12,12 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_PIHOLE_APP_NAME=pihole
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+# Not instance-safe. A DNS server must own port 53 on the host; a second copy could not bind it.
+CFG_PIHOLE_MULTI_INSTANCE=false
 CFG_PIHOLE_BACKUP=true
 CFG_PIHOLE_BACKUP_STRATEGY=auto
 CFG_PIHOLE_UPDATE_TYPE=auto

containers/prometheus/prometheus.config

@@ -11,6 +11,12 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_PROMETHEUS_APP_NAME=prometheus
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+# Not instance-safe. Declares node-exporter and cadvisor, names with no "prometheus" prefix, which cannot be made unique per instance.
+CFG_PROMETHEUS_MULTI_INSTANCE=false
 CFG_PROMETHEUS_BACKUP=true
 CFG_PROMETHEUS_BACKUP_STRATEGY=auto
 CFG_PROMETHEUS_UPDATE_TYPE=auto

containers/rocketchat/rocketchat.config

@@ -12,6 +12,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_ROCKETCHAT_APP_NAME=rocketchat
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_ROCKETCHAT_MULTI_INSTANCE=true
 CFG_ROCKETCHAT_BACKUP=true
 CFG_ROCKETCHAT_BACKUP_STRATEGY=auto
 # Auto. Rocket.Chat does run schema migrations on boot and does refuse to start

containers/speedtest/speedtest.config

@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_SPEEDTEST_APP_NAME=speedtest
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_SPEEDTEST_MULTI_INSTANCE=true
 CFG_SPEEDTEST_BACKUP=false
 CFG_SPEEDTEST_BACKUP_STRATEGY=auto
 CFG_SPEEDTEST_UPDATE_TYPE=auto

containers/stalwart/stalwart.config

@@ -20,6 +20,12 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_STALWART_APP_NAME=stalwart
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+# Not instance-safe. A mail server must own the SMTP/IMAP ports (25, 465, 587, 993); a second copy could not bind them.
+CFG_STALWART_MULTI_INSTANCE=false
 CFG_STALWART_BACKUP=true
 # Mail is the one app where a "live" snapshot is a real risk: the message store
 # is being written continuously, so a copy taken mid-write can land mid-transaction.

containers/stoat/stoat.config

@@ -14,6 +14,12 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_STOAT_APP_NAME=stoat
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+# Not instance-safe. Pins LiveKit to host port 7881, and declares database/redis/rabbit/minio and friends — names with no "stoat" prefix that cannot be made unique per instance.
+CFG_STOAT_MULTI_INSTANCE=false
 # No prerequisites. Stoat bakes its public URL into the client bundle, but that
 # URL can just as well be http://<lan-ip>:<port> — text chat, channels, roles
 # and uploads all work that way over a LAN or WireGuard tunnel. Only camera and

containers/traefik/traefik.config

@@ -12,6 +12,12 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_TRAEFIK_APP_NAME=traefik
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+# Not instance-safe. The edge proxy must own 443 — and one Traefik is what routes every other app.
+CFG_TRAEFIK_MULTI_INSTANCE=false
 CFG_TRAEFIK_BACKUP=true
 CFG_TRAEFIK_BACKUP_STRATEGY=auto
 CFG_TRAEFIK_UPDATE_TYPE=auto

containers/trilium/trilium.config

@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_TRILIUM_APP_NAME=trilium
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_TRILIUM_MULTI_INSTANCE=true
 CFG_TRILIUM_BACKUP=true
 CFG_TRILIUM_BACKUP_STRATEGY=auto
 CFG_TRILIUM_UPDATE_TYPE=auto

containers/trivy/trivy.config

@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_TRIVY_APP_NAME=trivy
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_TRIVY_MULTI_INSTANCE=true
 CFG_TRIVY_BACKUP=false
 CFG_TRIVY_BACKUP_STRATEGY=auto
 CFG_TRIVY_UPDATE_TYPE=auto

containers/unbound/unbound.config

@@ -12,6 +12,12 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_UNBOUND_APP_NAME=unbound
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+# Not instance-safe. A DNS resolver must own its fixed port 5335; a second copy could not bind it.
+CFG_UNBOUND_MULTI_INSTANCE=false
 CFG_UNBOUND_BACKUP=true
 CFG_UNBOUND_BACKUP_STRATEGY=auto
 CFG_UNBOUND_UPDATE_TYPE=auto

containers/vikunja/vikunja.config

@@ -12,6 +12,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_VIKUNJA_APP_NAME=vikunja
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_VIKUNJA_MULTI_INSTANCE=true
 CFG_VIKUNJA_BACKUP=true
 CFG_VIKUNJA_BACKUP_STRATEGY=auto
 CFG_VIKUNJA_UPDATE_TYPE=auto

containers/wireguard/wireguard.config

@@ -12,6 +12,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_WIREGUARD_APP_NAME=wireguard
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_WIREGUARD_MULTI_INSTANCE=true
 CFG_WIREGUARD_SUBNET=
 CFG_WIREGUARD_BACKUP=true
 CFG_WIREGUARD_BACKUP_STRATEGY=auto