Networking & Automated Maintenance

🌐 Reverse Proxy & Tunnels

The server does not expose internal ports directly to the open web.

• Cloudflared Tunnel: Runs continuously in the cloudflare-tunnel container, connecting the server securely to Cloudflare's edge.
• The proxy Network: Almost every web-facing container (Docmost, Homepage, Immich, Nextcloud, the Arr stack) is attached to the proxy Docker network. Cloudflared routes external traffic through this internal bridge.

🔄 Automated Updates (Watchtower)

Compose Location: /home/parth/docker/watchtower/

Watchtower automatically pulls new images and restarts containers. It uses a dual-trigger setup:

1. On-Boot: The watchtower-startup container runs once immediately when the server boots to catch any missed updates, then exits.
2. Scheduled: The main watchtower daemon runs daily at 13:00 (set via WATCHTOWER_SCHEDULE=0 0 13 * * *). It cleans up old images after updating (WATCHTOWER_CLEANUP=true).

🟢 Monitoring (Uptime Kuma)

Port: 3001

Uptime Kuma monitors the health of the local services. It has access to the docker socket (/var/run/docker.sock) to natively monitor container states rather than just pinging ports.