infra: 2026-10-26 version audit, upgrades, UniFi re-removal

- Synapse v1.163.2, MAS 1.27.1, Traefik v3.7, node-exporter v1.12.1 (all
  nodes), cadvisor -> ghcr.io v0.60.6, alertmanager-receiver 2026.9.23,
  Gitea 1.26.4, Jellyfin 12.3, Seerr v3.5.1
- Watchtower -> nickfedor/watchtower fork, twice daily (04:00/16:00)
- Monitoring legacy node-exporter gated behind a compose profile
- unifi-os-server on .100 removed again; compose file renamed so it
  cannot be revived
- CLAUDE.md: Known Issues #40-43, service tree updates

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NQhgEUqcaV4WM2S4hfXgHD

compose/hf-pdocker-01/monitoring/docker-compose.yml

@@ -1,21 +1,12 @@
-networks:
-  monitoring-net:
-    name: monitoring-net
-
 services:
   grafana:
     image: grafana/grafana:latest
-    container_name: grafana
     restart: unless-stopped
     user: "104"
-    networks:
-      - monitoring-net
     ports:
       - "3001:3000"
     volumes:
       - /mnt/docker-data/configs/grafana:/var/lib/grafana
-    mem_limit: 512M
-    memswap_limit: 512M
     healthcheck:
       test: ["CMD-SHELL", "wget -q --spider http://localhost:3000/api/health || exit 1"]
       interval: 30s
@@ -27,13 +18,19 @@ services:
       options:
         max-size: "50m"
         max-file: "3"
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.hostname == hf-pdocker-01
+      resources:
+        limits:
+          memory: 512M
 
   prometheus:
     image: prom/prometheus:latest
-    container_name: prometheus
     restart: unless-stopped
-    networks:
-      - monitoring-net
     ports:
       - "9095:9090"
     command:
@@ -44,8 +41,6 @@ services:
       - '--web.enable-lifecycle'
     volumes:
       - /mnt/docker-data/configs/prometheus:/etc/prometheus
-    mem_limit: 512M
-    memswap_limit: 512M
     healthcheck:
       test: ["CMD-SHELL", "wget -q --spider http://localhost:9090/-/healthy || exit 1"]
       interval: 30s
@@ -57,13 +52,19 @@ services:
       options:
         max-size: "50m"
         max-file: "3"
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.hostname == hf-pdocker-01
+      resources:
+        limits:
+          memory: 512M
 
   alertmanager:
     image: prom/alertmanager:latest
-    container_name: alertmanager
     restart: unless-stopped
-    networks:
-      - monitoring-net
     ports:
       - "9093:9093"
     command:
@@ -72,8 +73,6 @@ services:
     volumes:
       - /mnt/docker-data/configs/alertmanager:/etc/alertmanager
       - alertmanager-data:/alertmanager
-    mem_limit: 256M
-    memswap_limit: 256M
     healthcheck:
       test: ["CMD-SHELL", "wget -q --spider http://localhost:9093/-/healthy || exit 1"]
       interval: 30s
@@ -85,19 +84,49 @@ services:
       options:
         max-size: "50m"
         max-file: "3"
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.hostname == hf-pdocker-01
+      resources:
+        limits:
+          memory: 256M
+
+  node-exporter:
+    # DISABLED 2026-10-26: node-exporter runs STANDALONE (compose/<node>/node-exporter, pid:host).
+    # This legacy copy would collide on :9100 if started; gated behind a profile so a
+    # bare `docker compose up -d` here never starts it.
+    profiles: ["legacy-node-exporter"]
+    image: prom/node-exporter:latest
+    restart: unless-stopped
+    ports:
+      - "9100:9100"
+    volumes:
+      - /proc:/host/proc:ro
+      - /sys:/host/sys:ro
+      - /:/rootfs:ro
+    command:
+      - '--path.procfs=/host/proc'
+      - '--path.rootfs=/rootfs'
+      - '--path.sysfs=/host/sys'
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+    deploy:
+      mode: global
+      resources:
+        limits:
+          memory: 128M
 
   influxdb:
     image: influxdb:1.8-alpine
-    container_name: influxdb
     restart: unless-stopped
-    networks:
-      - monitoring-net
-    ports:
-      - "8086:8086"
     volumes:
       - /mnt/docker-data/configs/influxdb:/var/lib/influxdb
-    mem_limit: 1G
-    memswap_limit: 1G
     healthcheck:
       test: ["CMD-SHELL", "wget -q --spider http://localhost:8086/ping || exit 1"]
       interval: 30s
@@ -109,45 +138,99 @@ services:
       options:
         max-size: "50m"
         max-file: "3"
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.hostname == hf-pdocker-01
+      resources:
+        limits:
+          memory: 1G
 
   matrix-alertmanager-receiver:
-    image: metio/matrix-alertmanager-receiver:2026.2.25
-    container_name: matrix-alertmanager-receiver
+    image: metio/matrix-alertmanager-receiver:2026.9.23
     restart: unless-stopped
-    networks:
-      - monitoring-net
     ports:
       - "9094:9094"
     volumes:
       - /mnt/docker-data/configs/alertmanager/matrix-receiver-config.yml:/config/config.yml:ro
     command: ["--config-path", "/config/config.yml"]
-    mem_limit: 128M
-    memswap_limit: 128M
+    # NOTE: No healthcheck - this image is distroless (no shell), so CMD-SHELL healthchecks fail.
+    # The service is verified healthy by Alertmanager successfully POSTing to it.
     logging:
       driver: "json-file"
       options:
         max-size: "50m"
         max-file: "3"
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.hostname == hf-pdocker-01
+      resources:
+        limits:
+          memory: 128M
+
+  cadvisor:
+    image: ghcr.io/google/cadvisor:v0.60.6  # moved off gcr.io (no releases there after v0.55)
+    restart: unless-stopped
+    privileged: true
+    command:
+      - '--docker_only=true'
+      - '--disable_metrics=advtcp,cpu_topology,cpuset,hugetlb,memory_numa,process,referenced_memory,resctrl,sched,tcp,udp,disk,diskIO,percpu'
+      - '--housekeeping_interval=30s'
+      - '--store_container_labels=false'
+    ports:
+      - "8081:8080"
+    volumes:
+      - /:/rootfs:ro
+      - /var/run:/var/run:ro
+      - /sys:/sys:ro
+      - /var/lib/docker/:/var/lib/docker:ro
+      - /dev/disk/:/dev/disk:ro
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    devices:
+      - /dev/kmsg
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.hostname == hf-pdocker-01
+      resources:
+        limits:
+          memory: 256M
 
   blackbox-exporter:
     image: prom/blackbox-exporter:latest
-    container_name: blackbox-exporter
     restart: unless-stopped
-    networks:
-      - monitoring-net
     ports:
       - "9115:9115"
     command:
       - '--config.file=/config/blackbox.yml'
     volumes:
       - /mnt/docker-data/configs/blackbox:/config:ro
-    mem_limit: 128M
-    memswap_limit: 128M
     logging:
       driver: "json-file"
       options:
         max-size: "50m"
         max-file: "3"
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints:
+          - node.hostname == hf-pdocker-01
+      resources:
+        limits:
+          memory: 128M
 
 volumes:
   alertmanager-data: