Update planka restart settings

media/plex/docker-compose.yml

@@ -17,6 +17,7 @@ services:
       - /pwspool/archive/plex/:/config
       - /pwspool/archive/plex/tvseries:/tv
       - /pwspool/archive/plex/movies:/movies
+      - /pwspool/archive/plex/music:/music
       - /pwspool/archive/plex/photos:/photos
       - /pwspool/archive/plex/homevideos:/homevideos
       - /pwspool/archive/plex/transcode:/transcode

software-development/design/penpot/.env.example

@@ -24,3 +24,10 @@ PENPOT_FLAGS=enable-registration enable-login-with-password disable-email-verifi
 # Or
 PENPOT_FLAGS=enable-login-with-password
 PENPOT_REGISTRATION_ENABLED=false
+
+# Stub out optional MCP/nitrate upstreams so nginx in the frontend image can
+# resolve them at startup. We don't run these services; hitting /mcp/* or
+# /control-center will 404, but the main app boots.
+PENPOT_MCP_URI=http://penpot-backend:6060
+PENPOT_MCP_URI_WS=http://penpot-backend:6060
+PENPOT_NITRATE_URI=http://penpot-backend:6060

software-development/design/penpot/README.md

@@ -1,18 +1,33 @@
 # Penpot
 Open source Figma.
 
-## First Time User Creation 
-Temporarily enable registration via manual methods:
+## Setup
+
+1. Temporarily enable registation via flags in `.env`:
+
 ```env 
 PENPOT_FLAGS=enable-registration enable-login-with-password disable-email-verification enable-prepl-server
 ```
+
 and comment out `PENPOT_REGISTRATION_ENABLED=false`
-Create new user either through UI or through command line:
+
+2. Create new user either through UI or through command line:
+
 ```bash 
 docker exec -it penpot-penpot-backend-1 python3 manage.py create-profile
 ```
-Reinstate old flags:
+
+3. Then reinstate old flags:
+
 ```env 
 PENPOT_FLAGS=enable-login-with-password
 ```
+
 and reinstate `PENPOT_REGISTRATION_ENABLED`.
+
+## Runbook
+
+```bash
+docker compose down && docker system prune -af && docker compose up -d && docker logs -f penpot-penpot-backend-1
+```
+

software-development/infrastructure/jenkins/docker-compose.yml

@@ -1,5 +1,3 @@
-volumesersion: '3.7'
-
 networks:
   traefik:
     external: true
@@ -16,7 +14,8 @@ services:
     volumes:
       - /pwspool/software/jenkins:/var/jenkins_home
       - /var/run/docker.sock:/var/run/docker.sock
-      - /usr/local/bin/docker:/usr/local/bin/docker
+      - /usr/bin/docker:/usr/local/bin/docker:ro
+      - /usr/libexec/docker/cli-plugins/docker-compose:/usr/local/lib/docker/cli-plugins/docker-compose:ro
     labels:
       - traefik.http.routers.jenkins.rule=Host(`jenkins.whitney.rip`)
       - traefik.http.routers.jenkins.tls=true

software-development/infrastructure/traefik/README.md

@@ -16,6 +16,56 @@ Before the first run, create `acme.json` with the initial contents `{}`. Make su
 In addition to the above files, make sure the docker socket is mounted:
 - `/var/run/docker.sock:/var/run/docker.sock:ro`
 
+## Adding a Website
+
+Each website is a container on the `traefik` network exposed via Traefik labels. Copy the block below into the service's `docker-compose.yml` and replace `myapp`, the host(s), and the port.
+
+**Important:** the cert resolver is named `lets-encrypt` (with a hyphen) in `traefik.toml`. The label value must match it **exactly**. A mismatch like `letsencrypt` makes Traefik fall back to a self-signed `TRAEFIK DEFAULT CERT`, which browsers flag as "Not Secure".
+
+```yaml
+services:
+  myapp:
+    image: myimage:latest
+    restart: unless-stopped
+    networks:
+      - traefik
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.myapp.rule=Host(`myapp.whitney.rip`)"
+      - "traefik.http.routers.myapp.entrypoints=websecure"
+      - "traefik.http.routers.myapp.tls.certresolver=lets-encrypt"
+      - "traefik.http.services.myapp.loadbalancer.server.port=3000"
+
+networks:
+  traefik:
+    external: true
+```
+
+HTTP-to-HTTPS redirection is handled globally by the `web` entrypoint, so you only need the `websecure` entrypoint here.
+
+### Covering `www` (or multiple hostnames)
+
+Traefik only serves a real cert for hostnames named in the router rule — anything else gets the self-signed default cert. To cover the apex **and** `www` on a single certificate, match both hosts and declare the SAN:
+
+```yaml
+      - "traefik.http.routers.myapp.rule=Host(`myapp.com`) || Host(`www.myapp.com`)"
+      - "traefik.http.routers.myapp.entrypoints=websecure"
+      - "traefik.http.routers.myapp.tls.certresolver=lets-encrypt"
+      - "traefik.http.routers.myapp.tls.domains[0].main=myapp.com"
+      - "traefik.http.routers.myapp.tls.domains[0].sans=www.myapp.com"
+```
+
+To force a single canonical URL, redirect `www` to the apex (note the `$$` — Compose needs it to pass a literal `$` to Traefik):
+
+```yaml
+      - "traefik.http.routers.myapp.middlewares=myapp-www"
+      - "traefik.http.middlewares.myapp-www.redirectregex.regex=^https://www\\.(.*)"
+      - "traefik.http.middlewares.myapp-www.redirectregex.replacement=https://$${1}"
+      - "traefik.http.middlewares.myapp-www.redirectregex.permanent=true"
+```
+
+**DNS / Cloudflare:** every hostname in the rule must have a DNS record pointing at this server and must **not** be proxied through Cloudflare (orange cloud) — the TLS challenge has to reach Traefik directly, or issuance fails and the account can get rate-limited/paused. To keep the Cloudflare proxy on, switch that domain to the DNS-01 challenge instead.
+
 ## Notes
 
 ### Adjustments

software-development/project-management/planka/docker-compose.yml

@@ -8,7 +8,7 @@ services:
   planka:
     image: ghcr.io/plankanban/planka:2.0.0-rc.2
     container_name: planka
-    restart: on-failure
+    restart: unless-stopped
     networks:
       - planka
       - traefik
@@ -31,7 +31,7 @@ services:
   postgres:
     image: postgres:16-alpine
     container_name: planka-db
-    restart: on-failure
+    restart: unless-stopped
     networks:
       - planka
     volumes: