diff --git a/containers/adguard/adguard.config b/containers/adguard/adguard.config
index 8665b78..85c442c 100755
--- a/containers/adguard/adguard.config
+++ b/containers/adguard/adguard.config
@@ -14,6 +14,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_ADGUARD_APP_NAME=adguard
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_ADGUARD_MULTI_INSTANCE=true
 CFG_ADGUARD_BACKUP=true
 CFG_ADGUARD_BACKUP_STRATEGY=auto
 CFG_ADGUARD_UPDATE_TYPE=auto
diff --git a/containers/authelia/authelia.config b/containers/authelia/authelia.config
index 82173d8..cd09ba9 100755
--- a/containers/authelia/authelia.config
+++ b/containers/authelia/authelia.config
@@ -16,6 +16,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_AUTHELIA_APP_NAME=authelia
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_AUTHELIA_MULTI_INSTANCE=true
 CFG_AUTHELIA_REQUIRES="domain,traefik"
 CFG_AUTHELIA_BACKUP=true
 CFG_AUTHELIA_BACKUP_STRATEGY=auto
diff --git a/containers/crowdsec/crowdsec.config b/containers/crowdsec/crowdsec.config
index 3ea1ac3..e8c643b 100644
--- a/containers/crowdsec/crowdsec.config
+++ b/containers/crowdsec/crowdsec.config
@@ -13,6 +13,11 @@
 # PROMETHEUS_LISTEN = address CrowdSec's metrics endpoint binds to; must be reachable from the Prometheus container (default: all interfaces, port 6060 — keep the :6060 port)
 #
 CFG_CROWDSEC_APP_NAME=crowdsec
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_CROWDSEC_MULTI_INSTANCE=true
 CFG_CROWDSEC_HOST_INSTALL=true
 CFG_CROWDSEC_HOST_PACKAGE=crowdsec
 CFG_CROWDSEC_HOST_SERVICES=crowdsec.service,crowdsec-firewall-bouncer.service
diff --git a/containers/dashy/dashy.config b/containers/dashy/dashy.config
index 048e49d..4c4b050 100755
--- a/containers/dashy/dashy.config
+++ b/containers/dashy/dashy.config
@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_DASHY_APP_NAME=dashy
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_DASHY_MULTI_INSTANCE=true
 CFG_DASHY_BACKUP=true
 CFG_DASHY_BACKUP_STRATEGY=auto
 CFG_DASHY_UPDATE_TYPE=auto
diff --git a/containers/gitea/gitea.config b/containers/gitea/gitea.config
index c7c4ccd..d81898b 100755
--- a/containers/gitea/gitea.config
+++ b/containers/gitea/gitea.config
@@ -13,6 +13,11 @@
 # METRICS_TOKEN = bearer token guarding /metrics (rides the public web port); auto-generated, mirrored into the Prometheus scrape config
 #
 CFG_GITEA_APP_NAME=gitea
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_GITEA_MULTI_INSTANCE=true
 CFG_GITEA_BACKUP=true
 CFG_GITEA_BACKUP_STRATEGY=auto
 CFG_GITEA_UPDATE_TYPE=auto
diff --git a/containers/gluetun/gluetun.config b/containers/gluetun/gluetun.config
index c39a4c7..64a2f35 100644
--- a/containers/gluetun/gluetun.config
+++ b/containers/gluetun/gluetun.config
@@ -12,6 +12,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_GLUETUN_APP_NAME=gluetun
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_GLUETUN_MULTI_INSTANCE=true
 CFG_GLUETUN_BACKUP=true
 CFG_GLUETUN_BACKUP_STRATEGY=auto
 CFG_GLUETUN_UPDATE_TYPE=auto
diff --git a/containers/grafana/grafana.config b/containers/grafana/grafana.config
index b6531d9..bb8cd80 100755
--- a/containers/grafana/grafana.config
+++ b/containers/grafana/grafana.config
@@ -13,6 +13,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_GRAFANA_APP_NAME=grafana
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_GRAFANA_MULTI_INSTANCE=true
 CFG_GRAFANA_REQUIRES="prometheus"
 CFG_GRAFANA_BACKUP=true
 CFG_GRAFANA_BACKUP_STRATEGY=auto
diff --git a/containers/headscale/headscale.config b/containers/headscale/headscale.config
index c19acdf..fcbcc5a 100755
--- a/containers/headscale/headscale.config
+++ b/containers/headscale/headscale.config
@@ -11,6 +11,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_HEADSCALE_APP_NAME=headscale
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_HEADSCALE_MULTI_INSTANCE=true
 CFG_HEADSCALE_BACKUP=true
 CFG_HEADSCALE_BACKUP_STRATEGY=auto
 CFG_HEADSCALE_UPDATE_TYPE=auto
diff --git a/containers/invidious/invidious.config b/containers/invidious/invidious.config
index c642c20..09a8fd8 100755
--- a/containers/invidious/invidious.config
+++ b/containers/invidious/invidious.config
@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_INVIDIOUS_APP_NAME=invidious
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_INVIDIOUS_MULTI_INSTANCE=true
 CFG_INVIDIOUS_BACKUP=false
 CFG_INVIDIOUS_BACKUP_STRATEGY=auto
 CFG_INVIDIOUS_UPDATE_TYPE=auto
diff --git a/containers/ipinfo/ipinfo.config b/containers/ipinfo/ipinfo.config
index 6cc4008..8953d06 100755
--- a/containers/ipinfo/ipinfo.config
+++ b/containers/ipinfo/ipinfo.config
@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_IPINFO_APP_NAME=ipinfo
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_IPINFO_MULTI_INSTANCE=true
 CFG_IPINFO_BACKUP=false
 CFG_IPINFO_BACKUP_STRATEGY=auto
 CFG_IPINFO_UPDATE_TYPE=auto
diff --git a/containers/jellyfin/jellyfin.config b/containers/jellyfin/jellyfin.config
index 693f13c..0c9f79a 100755
--- a/containers/jellyfin/jellyfin.config
+++ b/containers/jellyfin/jellyfin.config
@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_JELLYFIN_APP_NAME=jellyfin
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_JELLYFIN_MULTI_INSTANCE=true
 CFG_JELLYFIN_BACKUP=true
 CFG_JELLYFIN_BACKUP_STRATEGY=auto
 CFG_JELLYFIN_UPDATE_TYPE=auto
diff --git a/containers/jitsimeet/jitsimeet.config b/containers/jitsimeet/jitsimeet.config
index 732e5ff..e7a0242 100755
--- a/containers/jitsimeet/jitsimeet.config
+++ b/containers/jitsimeet/jitsimeet.config
@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_JITSIMEET_APP_NAME=jitsimeet
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_JITSIMEET_MULTI_INSTANCE=true
 CFG_JITSIMEET_BACKUP=true
 CFG_JITSIMEET_BACKUP_STRATEGY=auto
 CFG_JITSIMEET_UPDATE_TYPE=auto
diff --git a/containers/libreportal_catalog/libreportal_catalog.config b/containers/libreportal_catalog/libreportal_catalog.config
index cde38bd..9ee03d9 100644
--- a/containers/libreportal_catalog/libreportal_catalog.config
+++ b/containers/libreportal_catalog/libreportal_catalog.config
@@ -12,6 +12,11 @@
 # DEV_ONLY = if true, hidden from the App Center unless Developer Mode is on
 #
 CFG_LIBREPORTAL_CATALOG_APP_NAME=libreportal_catalog
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_LIBREPORTAL_CATALOG_MULTI_INSTANCE=true
 CFG_LIBREPORTAL_CATALOG_BACKUP=true
 CFG_LIBREPORTAL_CATALOG_BACKUP_STRATEGY=auto
 CFG_LIBREPORTAL_CATALOG_UPDATE_TYPE=auto
diff --git a/containers/linkding/linkding.config b/containers/linkding/linkding.config
index f8abdb0..963efd3 100755
--- a/containers/linkding/linkding.config
+++ b/containers/linkding/linkding.config
@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_LINKDING_APP_NAME=linkding
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_LINKDING_MULTI_INSTANCE=true
 CFG_LINKDING_BACKUP=true
 CFG_LINKDING_BACKUP_STRATEGY=auto
 CFG_LINKDING_UPDATE_TYPE=auto
diff --git a/containers/mastodon/mastodon.config b/containers/mastodon/mastodon.config
index ede5032..8808160 100755
--- a/containers/mastodon/mastodon.config
+++ b/containers/mastodon/mastodon.config
@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_MASTODON_APP_NAME=mastodon
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_MASTODON_MULTI_INSTANCE=true
 CFG_MASTODON_BACKUP=true
 CFG_MASTODON_BACKUP_STRATEGY=auto
 CFG_MASTODON_UPDATE_TYPE=auto
diff --git a/containers/matrix/matrix.config b/containers/matrix/matrix.config
index 4ca0929..a7b272c 100644
--- a/containers/matrix/matrix.config
+++ b/containers/matrix/matrix.config
@@ -17,6 +17,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_MATRIX_APP_NAME=matrix
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_MATRIX_MULTI_INSTANCE=true
 # No prerequisites. Synapse runs perfectly well on a plain HTTP listener reached
 # by IP over the LAN or a WireGuard tunnel — that is the same setup as sitting
 # behind a reverse proxy, minus the proxy. Only *federation* needs a real domain
diff --git a/containers/mattermost/mattermost.config b/containers/mattermost/mattermost.config
index f401351..5c56c88 100644
--- a/containers/mattermost/mattermost.config
+++ b/containers/mattermost/mattermost.config
@@ -12,6 +12,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_MATTERMOST_APP_NAME=mattermost
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_MATTERMOST_MULTI_INSTANCE=true
 CFG_MATTERMOST_BACKUP=true
 CFG_MATTERMOST_BACKUP_STRATEGY=auto
 CFG_MATTERMOST_UPDATE_TYPE=auto
diff --git a/containers/moneyapp/moneyapp.config b/containers/moneyapp/moneyapp.config
index fab2b83..cf0e642 100644
--- a/containers/moneyapp/moneyapp.config
+++ b/containers/moneyapp/moneyapp.config
@@ -12,6 +12,11 @@
 # AUTH_SECRET = NextAuth/Auth.js session secret (random base64; auto-generated)
 #
 CFG_MONEYAPP_APP_NAME=moneyapp
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_MONEYAPP_MULTI_INSTANCE=true
 CFG_MONEYAPP_REQUIRES=""
 CFG_MONEYAPP_BACKUP=true
 CFG_MONEYAPP_BACKUP_STRATEGY=auto
diff --git a/containers/navidrome/navidrome.config b/containers/navidrome/navidrome.config
index b903956..eaf62ef 100644
--- a/containers/navidrome/navidrome.config
+++ b/containers/navidrome/navidrome.config
@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_NAVIDROME_APP_NAME=navidrome
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_NAVIDROME_MULTI_INSTANCE=true
 CFG_NAVIDROME_BACKUP=true
 CFG_NAVIDROME_BACKUP_STRATEGY=auto
 CFG_NAVIDROME_UPDATE_TYPE=auto
diff --git a/containers/nextcloud/nextcloud.config b/containers/nextcloud/nextcloud.config
index a7c85c5..e9ef4ac 100755
--- a/containers/nextcloud/nextcloud.config
+++ b/containers/nextcloud/nextcloud.config
@@ -15,6 +15,11 @@
 # DB_ROOT_PASSWORD = MariaDB root account; kept separate from DB_PASSWORD so the app user can be rotated without touching root
 #
 CFG_NEXTCLOUD_APP_NAME=nextcloud
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_NEXTCLOUD_MULTI_INSTANCE=true
 CFG_NEXTCLOUD_BACKUP=true
 CFG_NEXTCLOUD_BACKUP_STRATEGY=auto
 CFG_NEXTCLOUD_UPDATE_TYPE=auto
diff --git a/containers/ollama/ollama.config b/containers/ollama/ollama.config
index 6821003..d4d6888 100755
--- a/containers/ollama/ollama.config
+++ b/containers/ollama/ollama.config
@@ -12,6 +12,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_OLLAMA_APP_NAME=ollama
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_OLLAMA_MULTI_INSTANCE=true
 CFG_OLLAMA_BACKUP=true
 CFG_OLLAMA_BACKUP_STRATEGY=auto
 CFG_OLLAMA_UPDATE_TYPE=auto
diff --git a/containers/onlyoffice/onlyoffice.config b/containers/onlyoffice/onlyoffice.config
index aff7987..77f1a4e 100755
--- a/containers/onlyoffice/onlyoffice.config
+++ b/containers/onlyoffice/onlyoffice.config
@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_ONLYOFFICE_APP_NAME=onlyoffice
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_ONLYOFFICE_MULTI_INSTANCE=true
 CFG_ONLYOFFICE_BACKUP=true
 CFG_ONLYOFFICE_BACKUP_STRATEGY=auto
 CFG_ONLYOFFICE_UPDATE_TYPE=auto
diff --git a/containers/owncloud/owncloud.config b/containers/owncloud/owncloud.config
index 6c3b804..11baf20 100755
--- a/containers/owncloud/owncloud.config
+++ b/containers/owncloud/owncloud.config
@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_OWNCLOUD_APP_NAME=owncloud
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_OWNCLOUD_MULTI_INSTANCE=true
 CFG_OWNCLOUD_BACKUP=true
 CFG_OWNCLOUD_BACKUP_STRATEGY=auto
 CFG_OWNCLOUD_UPDATE_TYPE=auto
diff --git a/containers/pihole/pihole.config b/containers/pihole/pihole.config
index e42374c..458461e 100755
--- a/containers/pihole/pihole.config
+++ b/containers/pihole/pihole.config
@@ -12,6 +12,12 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_PIHOLE_APP_NAME=pihole
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+# Not instance-safe. A DNS server must own port 53 on the host; a second copy could not bind it.
+CFG_PIHOLE_MULTI_INSTANCE=false
 CFG_PIHOLE_BACKUP=true
 CFG_PIHOLE_BACKUP_STRATEGY=auto
 CFG_PIHOLE_UPDATE_TYPE=auto
diff --git a/containers/prometheus/prometheus.config b/containers/prometheus/prometheus.config
index 2317627..f096a93 100755
--- a/containers/prometheus/prometheus.config
+++ b/containers/prometheus/prometheus.config
@@ -11,6 +11,12 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_PROMETHEUS_APP_NAME=prometheus
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+# Not instance-safe. Declares node-exporter and cadvisor, names with no "prometheus" prefix, which cannot be made unique per instance.
+CFG_PROMETHEUS_MULTI_INSTANCE=false
 CFG_PROMETHEUS_BACKUP=true
 CFG_PROMETHEUS_BACKUP_STRATEGY=auto
 CFG_PROMETHEUS_UPDATE_TYPE=auto
diff --git a/containers/rocketchat/rocketchat.config b/containers/rocketchat/rocketchat.config
index b3d17f5..c0297d7 100644
--- a/containers/rocketchat/rocketchat.config
+++ b/containers/rocketchat/rocketchat.config
@@ -12,6 +12,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_ROCKETCHAT_APP_NAME=rocketchat
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_ROCKETCHAT_MULTI_INSTANCE=true
 CFG_ROCKETCHAT_BACKUP=true
 CFG_ROCKETCHAT_BACKUP_STRATEGY=auto
 # Auto. Rocket.Chat does run schema migrations on boot and does refuse to start
diff --git a/containers/speedtest/speedtest.config b/containers/speedtest/speedtest.config
index e653efb..74c18a7 100755
--- a/containers/speedtest/speedtest.config
+++ b/containers/speedtest/speedtest.config
@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_SPEEDTEST_APP_NAME=speedtest
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_SPEEDTEST_MULTI_INSTANCE=true
 CFG_SPEEDTEST_BACKUP=false
 CFG_SPEEDTEST_BACKUP_STRATEGY=auto
 CFG_SPEEDTEST_UPDATE_TYPE=auto
diff --git a/containers/stalwart/stalwart.config b/containers/stalwart/stalwart.config
index 794809e..d2ce678 100644
--- a/containers/stalwart/stalwart.config
+++ b/containers/stalwart/stalwart.config
@@ -20,6 +20,12 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_STALWART_APP_NAME=stalwart
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+# Not instance-safe. A mail server must own the SMTP/IMAP ports (25, 465, 587, 993); a second copy could not bind them.
+CFG_STALWART_MULTI_INSTANCE=false
 CFG_STALWART_BACKUP=true
 # Mail is the one app where a "live" snapshot is a real risk: the message store
 # is being written continuously, so a copy taken mid-write can land mid-transaction.
diff --git a/containers/stoat/stoat.config b/containers/stoat/stoat.config
index 2004b5f..626386e 100644
--- a/containers/stoat/stoat.config
+++ b/containers/stoat/stoat.config
@@ -14,6 +14,12 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_STOAT_APP_NAME=stoat
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+# Not instance-safe. Pins LiveKit to host port 7881, and declares database/redis/rabbit/minio and friends — names with no "stoat" prefix that cannot be made unique per instance.
+CFG_STOAT_MULTI_INSTANCE=false
 # No prerequisites. Stoat bakes its public URL into the client bundle, but that
 # URL can just as well be http://<lan-ip>:<port> — text chat, channels, roles
 # and uploads all work that way over a LAN or WireGuard tunnel. Only camera and
diff --git a/containers/traefik/traefik.config b/containers/traefik/traefik.config
index 62b1922..a78d58b 100755
--- a/containers/traefik/traefik.config
+++ b/containers/traefik/traefik.config
@@ -12,6 +12,12 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_TRAEFIK_APP_NAME=traefik
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+# Not instance-safe. The edge proxy must own 443 — and one Traefik is what routes every other app.
+CFG_TRAEFIK_MULTI_INSTANCE=false
 CFG_TRAEFIK_BACKUP=true
 CFG_TRAEFIK_BACKUP_STRATEGY=auto
 CFG_TRAEFIK_UPDATE_TYPE=auto
diff --git a/containers/trilium/trilium.config b/containers/trilium/trilium.config
index 4913ac7..5a18ec1 100755
--- a/containers/trilium/trilium.config
+++ b/containers/trilium/trilium.config
@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_TRILIUM_APP_NAME=trilium
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_TRILIUM_MULTI_INSTANCE=true
 CFG_TRILIUM_BACKUP=true
 CFG_TRILIUM_BACKUP_STRATEGY=auto
 CFG_TRILIUM_UPDATE_TYPE=auto
diff --git a/containers/trivy/trivy.config b/containers/trivy/trivy.config
index f434819..1b1bf85 100644
--- a/containers/trivy/trivy.config
+++ b/containers/trivy/trivy.config
@@ -11,6 +11,11 @@
 # HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
 #
 CFG_TRIVY_APP_NAME=trivy
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_TRIVY_MULTI_INSTANCE=true
 CFG_TRIVY_BACKUP=false
 CFG_TRIVY_BACKUP_STRATEGY=auto
 CFG_TRIVY_UPDATE_TYPE=auto
diff --git a/containers/unbound/unbound.config b/containers/unbound/unbound.config
index 14d2e7f..6a3868c 100755
--- a/containers/unbound/unbound.config
+++ b/containers/unbound/unbound.config
@@ -12,6 +12,12 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_UNBOUND_APP_NAME=unbound
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+# Not instance-safe. A DNS resolver must own its fixed port 5335; a second copy could not bind it.
+CFG_UNBOUND_MULTI_INSTANCE=false
 CFG_UNBOUND_BACKUP=true
 CFG_UNBOUND_BACKUP_STRATEGY=auto
 CFG_UNBOUND_UPDATE_TYPE=auto
diff --git a/containers/vikunja/vikunja.config b/containers/vikunja/vikunja.config
index 6f1cb79..bb1243b 100644
--- a/containers/vikunja/vikunja.config
+++ b/containers/vikunja/vikunja.config
@@ -12,6 +12,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_VIKUNJA_APP_NAME=vikunja
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_VIKUNJA_MULTI_INSTANCE=true
 CFG_VIKUNJA_BACKUP=true
 CFG_VIKUNJA_BACKUP_STRATEGY=auto
 CFG_VIKUNJA_UPDATE_TYPE=auto
diff --git a/containers/wireguard/wireguard.config b/containers/wireguard/wireguard.config
index 81c4c26..fcb7c45 100755
--- a/containers/wireguard/wireguard.config
+++ b/containers/wireguard/wireguard.config
@@ -12,6 +12,11 @@
 # MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
 #
 CFG_WIREGUARD_APP_NAME=wireguard
+# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
+# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
+# apps whose compose identity (container_name, Traefik routers, backup labels)
+# is instance-safe — see scripts/instance/instance_create.sh.
+CFG_WIREGUARD_MULTI_INSTANCE=true
 CFG_WIREGUARD_SUBNET=
 CFG_WIREGUARD_BACKUP=true
 CFG_WIREGUARD_BACKUP_STRATEGY=auto