config: keep infrastructure apps out of multiple instances

The previous commit enabled everything that passed the two mechanical
checks. Passing them is necessary, not sufficient: several of those apps
are singletons by role, and an instance of them would validate, clone,
start, and then not make sense.

Eight are now off by design, each saying why:

  adguard              a resolver is what clients point at
  authelia             the forward-auth provider every Traefik router points at
  gluetun              a network provider — apps join it by container name
  headscale            the control server a tailnet is defined by
  libreportal_catalog  LibrePortal's own catalog, internal plumbing
  ollama               one endpoint, and gigabytes of models per copy
  trivy                the updater resolves the scanner by a FIXED container
                       name, trivy-service, so a second copy would run and
                       never be the one CVE scanning uses
  wireguard            one stable published UDP endpoint; peers are tied to it

And one that should never have been touched: crowdsec ships no
docker-compose.yml, so the audit — which required a compose to read
service names from — skipped it, while the enabling pass only required a
config and did not. It got an unaudited true. There is nothing for
`instance create` to clone, and one decision engine watching the whole
box is the point of it. Now false, with that stated.

23 apps instanceable, 15 not: 6 that cannot be, 9 that should not be.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

containers/adguard/adguard.config

@@ -18,7 +18,8 @@ CFG_ADGUARD_APP_NAME=adguard
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_ADGUARD_MULTI_INSTANCE=true
+# Not instanced by design. A DNS server is what clients point at; a second copy on a different port resolves for nobody. One-per-host in practice, like pihole and unbound.
+CFG_ADGUARD_MULTI_INSTANCE=false
 CFG_ADGUARD_BACKUP=true
 CFG_ADGUARD_BACKUP_STRATEGY=auto
 CFG_ADGUARD_UPDATE_TYPE=auto

containers/authelia/authelia.config

@@ -20,7 +20,8 @@ CFG_AUTHELIA_APP_NAME=authelia
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_AUTHELIA_MULTI_INSTANCE=true
+# Not instanced by design. The forward-auth provider every other app's Traefik router points at. Two would mean two session realms with no clear owner.
+CFG_AUTHELIA_MULTI_INSTANCE=false
 CFG_AUTHELIA_REQUIRES="domain,traefik"
 CFG_AUTHELIA_BACKUP=true
 CFG_AUTHELIA_BACKUP_STRATEGY=auto

containers/crowdsec/crowdsec.config

@@ -17,7 +17,11 @@ CFG_CROWDSEC_APP_NAME=crowdsec
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_CROWDSEC_MULTI_INSTANCE=true
+# Not instanced by design. CrowdSec ships no docker-compose.yml at all — it is a
+# host-level security agent plus Traefik bouncer, not a composed app, so there is
+# no service identity for `instance create` to clone. It is also a singleton by
+# nature: one decision engine watching the whole box is the point.
+CFG_CROWDSEC_MULTI_INSTANCE=false
 CFG_CROWDSEC_HOST_INSTALL=true
 CFG_CROWDSEC_HOST_PACKAGE=crowdsec
 CFG_CROWDSEC_HOST_SERVICES=crowdsec.service,crowdsec-firewall-bouncer.service

containers/gluetun/gluetun.config

@@ -16,7 +16,8 @@ CFG_GLUETUN_APP_NAME=gluetun
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_GLUETUN_MULTI_INSTANCE=true
+# Not instanced by design. A network provider, not a destination: other apps join it with network_mode "container:gluetun-service". A second copy leaves that name ambiguous.
+CFG_GLUETUN_MULTI_INSTANCE=false
 CFG_GLUETUN_BACKUP=true
 CFG_GLUETUN_BACKUP_STRATEGY=auto
 CFG_GLUETUN_UPDATE_TYPE=auto

containers/headscale/headscale.config

@@ -15,7 +15,8 @@ CFG_HEADSCALE_APP_NAME=headscale
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_HEADSCALE_MULTI_INSTANCE=true
+# Not instanced by design. The control server a tailnet is defined by — nodes register against exactly one.
+CFG_HEADSCALE_MULTI_INSTANCE=false
 CFG_HEADSCALE_BACKUP=true
 CFG_HEADSCALE_BACKUP_STRATEGY=auto
 CFG_HEADSCALE_UPDATE_TYPE=auto

containers/libreportal_catalog/libreportal_catalog.config

@@ -16,7 +16,8 @@ CFG_LIBREPORTAL_CATALOG_APP_NAME=libreportal_catalog
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_LIBREPORTAL_CATALOG_MULTI_INSTANCE=true
+# Not instanced by design. LibrePortal's own catalog service. Internal plumbing, one per install.
+CFG_LIBREPORTAL_CATALOG_MULTI_INSTANCE=false
 CFG_LIBREPORTAL_CATALOG_BACKUP=true
 CFG_LIBREPORTAL_CATALOG_BACKUP_STRATEGY=auto
 CFG_LIBREPORTAL_CATALOG_UPDATE_TYPE=auto

containers/ollama/ollama.config

@@ -16,7 +16,8 @@ CFG_OLLAMA_APP_NAME=ollama
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_OLLAMA_MULTI_INSTANCE=true
+# Not instanced by design. Clients are configured against one endpoint, and each copy duplicates multi-gigabyte model storage for no routing benefit.
+CFG_OLLAMA_MULTI_INSTANCE=false
 CFG_OLLAMA_BACKUP=true
 CFG_OLLAMA_BACKUP_STRATEGY=auto
 CFG_OLLAMA_UPDATE_TYPE=auto

containers/trivy/trivy.config

@@ -15,7 +15,8 @@ CFG_TRIVY_APP_NAME=trivy
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_TRIVY_MULTI_INSTANCE=true
+# Not instanced by design. The updater resolves the scanner by the fixed container name trivy-service (see containers/trivy/scripts/trivy_scan.sh). A second copy would run but never be the one CVE scanning uses.
+CFG_TRIVY_MULTI_INSTANCE=false
 CFG_TRIVY_BACKUP=false
 CFG_TRIVY_BACKUP_STRATEGY=auto
 CFG_TRIVY_UPDATE_TYPE=auto

containers/wireguard/wireguard.config

@@ -16,7 +16,8 @@ CFG_WIREGUARD_APP_NAME=wireguard
 # (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
 # apps whose compose identity (container_name, Traefik routers, backup labels)
 # is instance-safe — see scripts/instance/instance_create.sh.
-CFG_WIREGUARD_MULTI_INSTANCE=true
+# Not instanced by design. A VPN server needs one stable published UDP endpoint; peer configs are tied to it.
+CFG_WIREGUARD_MULTI_INSTANCE=false
 CFG_WIREGUARD_SUBNET=
 CFG_WIREGUARD_BACKUP=true
 CFG_WIREGUARD_BACKUP_STRATEGY=auto