- Narrow trusted proxies, remove overly broad 10.0.0.0/8 - Fail closed on missing SSH known_hosts in terminal proxy - Add Navidrome reverse proxy headers for Authelia SSO - Add Gitea docker-compose definition - Add Caddy configs for NAS and VPS edge proxies - Add dnsmasq split-horizon DNS config - Add security execution plan document
Phase 6: OpenClaw docker-compose (port 3100) with health check Phase 9: Enhanced backup.sh with full DB/config coverage + Telegram alerts Phase 10: Health checks on all compose files, /api/system/notify endpoint