fix: audit-clean the remaining port-convention violations

blueprints/adguardhome/docker-compose.yml

@@ -1,3 +1,4 @@
+# dokploy: allow-host-ports — DNS (53/tcp+udp), DHCP (67/68) and DNS-over-TLS/QUIC (853) are not HTTP protocols; clients must reach them directly on the host, Traefik cannot route them.
 version: "3.8"
 services:
   adguardhome:
@@ -10,7 +11,8 @@ services:
       - "68:68/tcp" # DHCP Client
       - "853:853/tcp" # DNS over TLS, DNS-over-QUIC
       - "853:853/udp" # DNS over TLS, DNS-over-QUIC
-      - "6060:6060/tcp" # HTTP (pprof)
+    expose:
+      - 6060 # HTTP (pprof) — debug endpoint, no need to publish it on the host
     volumes:
       - adguardhome-work:/opt/adguardhome/work
       - adguardhome-conf:/opt/adguardhome/conf

blueprints/anytype/docker-compose.yml

@@ -1,3 +1,4 @@
+# dokploy: allow-host-ports — Anytype clients speak the any-sync protocol (TCP 33010, UDP/QUIC 33020) directly against the server; it is not HTTP, so Traefik cannot route it.
 # Example: Any-Sync-Bundle with embedded MongoDB and Redis (all-in-one image)
 #
 # Usage:

blueprints/chibisafe/docker-compose.yml

@@ -6,8 +6,6 @@
 services:
   chibisafe:
     image: chibisafe/chibisafe:latest
-    networks:
-      - chibinet
     environment:
       - BASE_API_URL=http://chibisafe_server:8000
     restart: unless-stopped
@@ -20,8 +18,6 @@ services:
 
   chibisafe_server:
     image: chibisafe/chibisafe-server:latest
-    networks:
-      - chibinet
     volumes:
       - database:/app/database:rw
       - uploads:/app/uploads:rw
@@ -43,8 +39,6 @@ services:
 
   caddy:
     image: caddy:2-alpine
-    networks:
-      - chibinet
     volumes:
       - ../files/Caddyfile:/etc/caddy/Caddyfile:ro
       - uploads:/app/uploads:ro
@@ -62,8 +56,3 @@ volumes:
   database:
   uploads:
   logs:
-
-networks:
-  chibinet:
-    driver: bridge
-    internal: true

blueprints/datalens/docker-compose.yml

@@ -23,7 +23,6 @@ services:
       - us
 
   data-api:
-    container_name: datalens-data-api
     image: ghcr.io/datalens-tech/datalens-data-api:0.2192.0
     restart: always
     environment:
@@ -43,7 +42,6 @@ services:
       - pg-compeng
 
   pg-us:
-    container_name: datalens-pg-us
     image: postgres:16-alpine
     restart: always
     environment:
@@ -75,8 +73,8 @@ services:
   datalens:
     image: ghcr.io/datalens-tech/datalens-ui:0.2601.0
     restart: always
-    ports:
-      - ${UI_PORT:-8080}:8080
+    expose:
+      - 8080 # web UI — routed through Traefik via the template domain
     depends_on:
       - us
       - control-api

blueprints/dragonfly-db/docker-compose.yml

@@ -4,8 +4,8 @@ services:
     image: 'docker.dragonflydb.io/dragonflydb/dragonfly'
     ulimits:
       memlock: -1
-    ports:
-      - "6379:6379"
+    expose:
+      - 6379
     volumes:
       - dragonflydata:/data
     environment: 

blueprints/drizzle-gateway/docker-compose.yml

@@ -8,12 +8,6 @@ services:
       MASTERPASS: ${MASTERPASS}
     volumes:
       - drizzle-gateway:/app
-    networks:
-      - dokploy-network
 
 volumes:
   drizzle-gateway:
-
-networks:
-  dokploy-network:
-    external: true

blueprints/elastic-search/docker-compose.yml

@@ -3,7 +3,6 @@ version: '3.8'
 services:
   elasticsearch:
     image: docker.elastic.co/elasticsearch/elasticsearch:8.10.2
-    container_name: elasticsearch
     environment:
       - discovery.type=single-node
       - xpack.security.enabled=false
@@ -20,7 +19,6 @@ services:
 
   kibana:
     image: docker.elastic.co/kibana/kibana:8.10.2
-    container_name: kibana
     environment:
       - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
     expose:

blueprints/emqx/docker-compose.yml

@@ -21,10 +21,6 @@ services:
     volumes:
       - emqx_data:/opt/emqx/data
       - emqx_log:/opt/emqx/log
-    networks:
-      dokploy-network:
-        aliases:
-          - emqx-service
     restart: unless-stopped
     healthcheck:
       test: ["CMD", "/opt/emqx/bin/emqx_ctl", "status"]
@@ -52,7 +48,3 @@ services:
 volumes:
   emqx_data:
   emqx_log:
-
-networks:
-  dokploy-network:
-    external: true

blueprints/enshrouded/docker-compose.yml

@@ -1,7 +1,7 @@
+# dokploy: allow-host-ports — Enshrouded game clients connect over raw UDP (15637 game, 27015 Steam query); Traefik cannot route UDP game traffic.
 services:
   enshrouded:
     image: mornedhels/enshrouded-server:latest
-    container_name: enshrouded
     hostname: enshrouded
     restart: unless-stopped
     stop_grace_period: 90s

blueprints/erpnext/docker-compose.yml

@@ -10,8 +10,6 @@ services:
     <<: *custom_image
     volumes:
       - sites:/home/frappe/frappe-bench/sites
-    networks:
-      - bench-network
     healthcheck:
       test:
         - CMD
@@ -42,8 +40,6 @@ services:
     volumes:
       - sites:/home/frappe/frappe-bench/sites
 
-    networks:
-      - bench-network
 
     healthcheck:
       test:
@@ -63,8 +59,6 @@ services:
       - default
     volumes:
       - sites:/home/frappe/frappe-bench/sites
-    networks:
-      - bench-network
     healthcheck:
       test:
         - CMD
@@ -87,8 +81,6 @@ services:
       - long
     volumes:
       - sites:/home/frappe/frappe-bench/sites
-    networks:
-      - bench-network
     healthcheck:
       test:
         - CMD
@@ -111,8 +103,6 @@ services:
       - short
     volumes:
       - sites:/home/frappe/frappe-bench/sites
-    networks:
-      - bench-network
     healthcheck:
       test:
         - CMD
@@ -145,8 +135,6 @@ services:
         required: true
     volumes:
       - sites:/home/frappe/frappe-bench/sites
-    networks:
-      - bench-network
 
   websocket:
     <<: *custom_image
@@ -167,8 +155,6 @@ services:
         required: true
     volumes:
       - sites:/home/frappe/frappe-bench/sites
-    networks:
-      - bench-network
 
   configurator:
     <<: *custom_image
@@ -197,8 +183,6 @@ services:
       REGENERATE_APPS_TXT: "${REGENERATE_APPS_TXT:-0}"
     volumes:
       - sites:/home/frappe/frappe-bench/sites
-    networks:
-      - bench-network
 
   create-site:
     <<: *custom_image
@@ -237,8 +221,6 @@ services:
       DB_PORT: "${DB_PORT:-3306}"
       DB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
       INSTALL_APP_ARGS: ${INSTALL_APP_ARGS}
-    networks:
-      - bench-network
 
   migration:
     <<: *custom_image
@@ -258,8 +240,6 @@ services:
         bench --site all set-config -p pause_scheduler 0;
     volumes:
       - sites:/home/frappe/frappe-bench/sites
-    networks:
-      - bench-network
 
   db:
     image: mariadb:10.6
@@ -282,8 +262,6 @@ services:
       - MARIADB_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
     volumes:
       - db-data:/var/lib/mysql
-    networks:
-      - bench-network
 
   redis-cache:
     deploy:
@@ -292,8 +270,6 @@ services:
     image: redis:6.2-alpine
     volumes:
       - redis-cache-data:/data
-    networks:
-      - bench-network
     healthcheck:
       test:
         - CMD
@@ -310,8 +286,6 @@ services:
     image: redis:6.2-alpine
     volumes:
       - redis-queue-data:/data
-    networks:
-      - bench-network
     healthcheck:
       test:
         - CMD
@@ -328,8 +302,6 @@ services:
     image: redis:6.2-alpine
     volumes:
       - redis-socketio-data:/data
-    networks:
-      - bench-network
     healthcheck:
       test:
         - CMD
@@ -349,6 +321,3 @@ volumes:
       type: "${SITE_VOLUME_TYPE}"
       o: "${SITE_VOLUME_OPTS}"
       device: "${SITE_VOLUME_DEV}"
-
-networks:
-  bench-network:

blueprints/fivem/docker-compose.yml

@@ -1,5 +1,6 @@
+# dokploy: allow-host-ports — FiveM game clients connect over raw TCP/UDP on 30120; Traefik cannot route game traffic.
 # docker-compose.yml
-# 
+#
 # IMPORTANT: FiveM Template - Two Deployment Modes
 # 
 # MODE 1: Standard FiveM Server

blueprints/fonoster/docker-compose.yml

@@ -1,3 +1,4 @@
+# dokploy: allow-host-ports — VoIP stack: SIP signaling (5060-5063 TCP/UDP), RTP media (10000-10100/udp) and the gRPC API endpoints (envoy 8449, rtpengine control 8080) are reached directly by phones/SDKs; these protocols cannot be routed by Traefik.
 services:
   dashboard:
     image: fonoster/dashboard:0.15.15