From fd65b74d538f35a42c7d8efe7c7ff4344bb24198 Mon Sep 17 00:00:00 2001 From: librelad Date: Wed, 19 Aug 2026 23:47:40 +0100 Subject: [PATCH] config: keep infrastructure apps out of multiple instances MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous commit enabled everything that passed the two mechanical checks. Passing them is necessary, not sufficient: several of those apps are singletons by role, and an instance of them would validate, clone, start, and then not make sense. Eight are now off by design, each saying why: adguard a resolver is what clients point at authelia the forward-auth provider every Traefik router points at gluetun a network provider — apps join it by container name headscale the control server a tailnet is defined by libreportal_catalog LibrePortal's own catalog, internal plumbing ollama one endpoint, and gigabytes of models per copy trivy the updater resolves the scanner by a FIXED container name, trivy-service, so a second copy would run and never be the one CVE scanning uses wireguard one stable published UDP endpoint; peers are tied to it And one that should never have been touched: crowdsec ships no docker-compose.yml, so the audit — which required a compose to read service names from — skipped it, while the enabling pass only required a config and did not. It got an unaudited true. There is nothing for `instance create` to clone, and one decision engine watching the whole box is the point of it. Now false, with that stated. 23 apps instanceable, 15 not: 6 that cannot be, 9 that should not be. Co-Authored-By: Claude Opus 5 --- containers/adguard/adguard.config | 3 ++- containers/authelia/authelia.config | 3 ++- containers/crowdsec/crowdsec.config | 6 +++++- containers/gluetun/gluetun.config | 3 ++- containers/headscale/headscale.config | 3 ++- containers/libreportal_catalog/libreportal_catalog.config | 3 ++- containers/ollama/ollama.config | 3 ++- containers/trivy/trivy.config | 3 ++- containers/wireguard/wireguard.config | 3 ++- 9 files changed, 21 insertions(+), 9 deletions(-) diff --git a/containers/adguard/adguard.config b/containers/adguard/adguard.config index 85c442c..938d987 100755 --- a/containers/adguard/adguard.config +++ b/containers/adguard/adguard.config @@ -18,7 +18,8 @@ CFG_ADGUARD_APP_NAME=adguard # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on # apps whose compose identity (container_name, Traefik routers, backup labels) # is instance-safe — see scripts/instance/instance_create.sh. -CFG_ADGUARD_MULTI_INSTANCE=true +# Not instanced by design. A DNS server is what clients point at; a second copy on a different port resolves for nobody. One-per-host in practice, like pihole and unbound. +CFG_ADGUARD_MULTI_INSTANCE=false CFG_ADGUARD_BACKUP=true CFG_ADGUARD_BACKUP_STRATEGY=auto CFG_ADGUARD_UPDATE_TYPE=auto diff --git a/containers/authelia/authelia.config b/containers/authelia/authelia.config index cd09ba9..94f025c 100755 --- a/containers/authelia/authelia.config +++ b/containers/authelia/authelia.config @@ -20,7 +20,8 @@ CFG_AUTHELIA_APP_NAME=authelia # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on # apps whose compose identity (container_name, Traefik routers, backup labels) # is instance-safe — see scripts/instance/instance_create.sh. -CFG_AUTHELIA_MULTI_INSTANCE=true +# Not instanced by design. The forward-auth provider every other app's Traefik router points at. Two would mean two session realms with no clear owner. +CFG_AUTHELIA_MULTI_INSTANCE=false CFG_AUTHELIA_REQUIRES="domain,traefik" CFG_AUTHELIA_BACKUP=true CFG_AUTHELIA_BACKUP_STRATEGY=auto diff --git a/containers/crowdsec/crowdsec.config b/containers/crowdsec/crowdsec.config index e8c643b..8e50df5 100644 --- a/containers/crowdsec/crowdsec.config +++ b/containers/crowdsec/crowdsec.config @@ -17,7 +17,11 @@ CFG_CROWDSEC_APP_NAME=crowdsec # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on # apps whose compose identity (container_name, Traefik routers, backup labels) # is instance-safe — see scripts/instance/instance_create.sh. -CFG_CROWDSEC_MULTI_INSTANCE=true +# Not instanced by design. CrowdSec ships no docker-compose.yml at all — it is a +# host-level security agent plus Traefik bouncer, not a composed app, so there is +# no service identity for `instance create` to clone. It is also a singleton by +# nature: one decision engine watching the whole box is the point. +CFG_CROWDSEC_MULTI_INSTANCE=false CFG_CROWDSEC_HOST_INSTALL=true CFG_CROWDSEC_HOST_PACKAGE=crowdsec CFG_CROWDSEC_HOST_SERVICES=crowdsec.service,crowdsec-firewall-bouncer.service diff --git a/containers/gluetun/gluetun.config b/containers/gluetun/gluetun.config index 64a2f35..bd53289 100644 --- a/containers/gluetun/gluetun.config +++ b/containers/gluetun/gluetun.config @@ -16,7 +16,8 @@ CFG_GLUETUN_APP_NAME=gluetun # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on # apps whose compose identity (container_name, Traefik routers, backup labels) # is instance-safe — see scripts/instance/instance_create.sh. -CFG_GLUETUN_MULTI_INSTANCE=true +# Not instanced by design. A network provider, not a destination: other apps join it with network_mode "container:gluetun-service". A second copy leaves that name ambiguous. +CFG_GLUETUN_MULTI_INSTANCE=false CFG_GLUETUN_BACKUP=true CFG_GLUETUN_BACKUP_STRATEGY=auto CFG_GLUETUN_UPDATE_TYPE=auto diff --git a/containers/headscale/headscale.config b/containers/headscale/headscale.config index fcbcc5a..8b3133d 100755 --- a/containers/headscale/headscale.config +++ b/containers/headscale/headscale.config @@ -15,7 +15,8 @@ CFG_HEADSCALE_APP_NAME=headscale # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on # apps whose compose identity (container_name, Traefik routers, backup labels) # is instance-safe — see scripts/instance/instance_create.sh. -CFG_HEADSCALE_MULTI_INSTANCE=true +# Not instanced by design. The control server a tailnet is defined by — nodes register against exactly one. +CFG_HEADSCALE_MULTI_INSTANCE=false CFG_HEADSCALE_BACKUP=true CFG_HEADSCALE_BACKUP_STRATEGY=auto CFG_HEADSCALE_UPDATE_TYPE=auto diff --git a/containers/libreportal_catalog/libreportal_catalog.config b/containers/libreportal_catalog/libreportal_catalog.config index 9ee03d9..a3a2d0a 100644 --- a/containers/libreportal_catalog/libreportal_catalog.config +++ b/containers/libreportal_catalog/libreportal_catalog.config @@ -16,7 +16,8 @@ CFG_LIBREPORTAL_CATALOG_APP_NAME=libreportal_catalog # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on # apps whose compose identity (container_name, Traefik routers, backup labels) # is instance-safe — see scripts/instance/instance_create.sh. -CFG_LIBREPORTAL_CATALOG_MULTI_INSTANCE=true +# Not instanced by design. LibrePortal's own catalog service. Internal plumbing, one per install. +CFG_LIBREPORTAL_CATALOG_MULTI_INSTANCE=false CFG_LIBREPORTAL_CATALOG_BACKUP=true CFG_LIBREPORTAL_CATALOG_BACKUP_STRATEGY=auto CFG_LIBREPORTAL_CATALOG_UPDATE_TYPE=auto diff --git a/containers/ollama/ollama.config b/containers/ollama/ollama.config index d4d6888..744126d 100755 --- a/containers/ollama/ollama.config +++ b/containers/ollama/ollama.config @@ -16,7 +16,8 @@ CFG_OLLAMA_APP_NAME=ollama # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on # apps whose compose identity (container_name, Traefik routers, backup labels) # is instance-safe — see scripts/instance/instance_create.sh. -CFG_OLLAMA_MULTI_INSTANCE=true +# Not instanced by design. Clients are configured against one endpoint, and each copy duplicates multi-gigabyte model storage for no routing benefit. +CFG_OLLAMA_MULTI_INSTANCE=false CFG_OLLAMA_BACKUP=true CFG_OLLAMA_BACKUP_STRATEGY=auto CFG_OLLAMA_UPDATE_TYPE=auto diff --git a/containers/trivy/trivy.config b/containers/trivy/trivy.config index 1b1bf85..274b790 100644 --- a/containers/trivy/trivy.config +++ b/containers/trivy/trivy.config @@ -15,7 +15,8 @@ CFG_TRIVY_APP_NAME=trivy # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on # apps whose compose identity (container_name, Traefik routers, backup labels) # is instance-safe — see scripts/instance/instance_create.sh. -CFG_TRIVY_MULTI_INSTANCE=true +# Not instanced by design. The updater resolves the scanner by the fixed container name trivy-service (see containers/trivy/scripts/trivy_scan.sh). A second copy would run but never be the one CVE scanning uses. +CFG_TRIVY_MULTI_INSTANCE=false CFG_TRIVY_BACKUP=false CFG_TRIVY_BACKUP_STRATEGY=auto CFG_TRIVY_UPDATE_TYPE=auto diff --git a/containers/wireguard/wireguard.config b/containers/wireguard/wireguard.config index fcb7c45..8d95f11 100755 --- a/containers/wireguard/wireguard.config +++ b/containers/wireguard/wireguard.config @@ -16,7 +16,8 @@ CFG_WIREGUARD_APP_NAME=wireguard # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on # apps whose compose identity (container_name, Traefik routers, backup labels) # is instance-safe — see scripts/instance/instance_create.sh. -CFG_WIREGUARD_MULTI_INSTANCE=true +# Not instanced by design. A VPN server needs one stable published UDP endpoint; peer configs are tied to it. +CFG_WIREGUARD_MULTI_INSTANCE=false CFG_WIREGUARD_SUBNET= CFG_WIREGUARD_BACKUP=true CFG_WIREGUARD_BACKUP_STRATEGY=auto