fix: audit-clean the remaining port-convention violations

[Siumauricio]

This PR brings the last 25 blueprints in line with the port/network conventions so validate-docker-compose.ts is green across the whole repo (rustdesk was already annotated earlier).

For every blueprint I looked at what the ports actually carry and applied one of three decisions:

• annotated — the host-published ports carry a non-HTTP protocol (mail, game, VPN, DNS, streaming, VoIP) that Traefik cannot route, so they are intentional. The compose gets the # dokploy: allow-host-ports — <reason> marker (same mechanism introduced for rustdesk).
• converted — the mapping published a plain HTTP UI (or an internal-only protocol) on the host by accident; it is now expose, and the UI keeps working through the Traefik domain defined in template.toml.
• fixed — removed container_name / custom networks (Dokploy manages names and attaches services to its network automatically).

Blueprint	Decision	Rationale
adguardhome	annotated + converted	DNS 53 tcp/udp, DHCP 67/68, DoT/DoQ 853 stay host-published (not HTTP). The pprof debug port 6060:6060 was an accidental HTTP publish → expose.
anytype	annotated	Anytype clients speak the any-sync protocol (TCP 33010, UDP/QUIC 33020) directly against the server.
chibisafe	fixed	Removed custom chibinet network (root + 3 services). Services keep talking via service names on the Dokploy network.
datalens	fixed + converted	Removed 2 container_name (nothing references them; all env URLs use service names). UI ${UI_PORT:-8080}:8080 → expose: 8080 (domain in template.toml routes to datalens:8080).
dragonfly-db	converted	6379:6379 → expose. Redis wire protocol, consumed by other services over the internal Docker network; no reason to publish it on the host.
drizzle-gateway	fixed	Removed explicit dokploy-network (Dokploy injects it automatically).
elastic-search	fixed	Removed 2 container_name; ELASTICSEARCH_HOSTS already uses the service name.
emqx	fixed	Removed explicit dokploy-network + alias. The Traefik TCP labels for MQTTS are unaffected (docker provider resolves the container directly); MQTT/WS/dashboard were already expose.
enshrouded	annotated + fixed	Game traffic is raw UDP (15637 game, 27015 Steam query). Also removed container_name.
erpnext	fixed	Removed bench-network from all 14 services + root. All inter-service refs use service names.
fivem	annotated	FiveM clients connect over raw TCP/UDP 30120.
fonoster	annotated	VoIP stack: SIP 5060-5063 tcp/udp, RTP 10000-10100/udp, gRPC endpoints (envoy 8449, rtpengine 8080) reached directly by phones/SDKs.
frappe-hr	fixed	Same as erpnext (identical compose, different image).
lodestone	annotated	Hosts game servers on 25565-25590 (raw TCP) and the dashboard talks to the core agent on 16662 by server address.
mailpit	converted	1025:1025 → expose. Other services reach SMTP via mailpit:1025 on the internal/Dokploy network; UI 8025 already routed via Traefik.
mailu	annotated	SMTP 25, SMTPS 465, Submission 587, IMAPS 993.
oryx	annotated	RTMP 1935/tcp, WebRTC 8000/udp, SRT 10080/udp.
poste.io	annotated	SMTP 25/465/587, POP3 110/995, IMAP 143/993, Sieve 4190.
pre0.22.5-supabase	annotated (new marker)	Frozen legacy template that functionally depends on container_name: Kong routes Realtime via its container DNS name (realtime-dev.supabase-realtime) and Vector derives log routing from container names (the toml itself documents this). The ${CONTAINER_PREFIX} per-deploy hash already prevents collisions, so stripping the names would break the template for no gain. Added a # dokploy: allow-container-names — <reason> marker plus a small validator extension (mirrors allow-host-ports: errors become warnings only when the marker is present).
pterodactyl	fixed	Removed root networks: default: ipam subnet override.
qbittorrent	annotated	BitTorrent peering 6881 tcp/udp must reach the host directly; Web UI 8080 was already unmapped.
seafile	fixed	Removed seafile-net (root + 3 services).
triggerdotdev	fixed	Removed webapp network (root + 6 services).
unifi	annotated	Controller portal is HTTPS with a self-signed cert on 8443 and the template defines no Traefik domain; users/devices reach it directly on the host.
wg-easy	annotated + converted + fixed	WireGuard 51820/udp stays host-published (raw UDP). Web UI 51821:51821/tcp → expose (template domain routes to 51821 via Traefik). Removed container_name.

Validator change (build-scripts/validate-docker-compose.ts): added the # dokploy: allow-container-names opt-out marker, used only by the frozen pre0.22.5-supabase template, with the same semantics as the existing allow-host-ports marker (violation downgraded to a warning, justification required in the marker line).

Note for deployed templates: the ports → expose conversions (dragonfly-db, mailpit, datalens UI, wg-easy UI, adguardhome pprof) only stop publishing those ports on the host on the next redeploy — Traefik routing via the template domain is unaffected because it goes over the Docker network. Anyone who relied on hitting server-ip:port directly for those five ports should use the domain (or re-add the mapping in their own deployment).

Verification

• validate-docker-compose.ts over all blueprints: 0 failures.
• node generate-meta.js --check: clean.
• Spot deploys on the demo instance (fresh import of the modified blueprints, deploy, HTTP check through the generated domain):
  • mailpit (SMTP 1025 converted to expose): deployed, UI reachable through Traefik — HTTP 200.
  • datalens (UI host-port converted to expose): deployed, UI reachable through Traefik — HTTP 200.

🤖 Generated with Claude Code

[github-actions]

built with Refined Cloudflare Pages Action

⚡ Cloudflare Pages Deployment

Name	Status	Preview	Last Commit
templates	✅ Ready (View Log)	Visit Preview	256969c