2026-07-05 — Sepia Networking Hardening Slice1

Summary

Introduced functional Docker networks for the Sepia stack and moved Caddy and the core services onto explicit network attachments.

Changes

• Added frontend, backend, storage, monitoring, and sensors networks to the main compose file.
• Attached Caddy to the networks it needs for proxying.
• Attached docs, DSMR, Grafana, InfluxDB, Seafile, TimescaleDB, and collectd to explicit service networks.
• Updated Caddy upstream targets to use Docker DNS service names instead of host-routed addresses.
• Adjusted Caddy's admin healthcheck to use 127.0.0.1 explicitly.

Verification

• docker compose config passed.
• Caddy can resolve and reach the key backend services on their Docker networks.
• Caddy is healthy after the change.

Follow-up

• DSMR and Seafile need a separate runtime recovery pass because their containers are still failing healthchecks after the recreate.
• Host network exceptions for Home Assistant and ESPHome remain documented in the plan.