Skip to content

2026-07-05 — Sepia Phase1 Compose Hardening

Summary

Applied the first batch of Sepia infrastructure hardening changes for core compose services and validated the merged compose configuration.

Context

This work follows the Sepia master plan and the active Phase 1 infrastructure hardening plan. The goal is to add service healthchecks and basic resource/capability hardening before continuing with the rest of the plan sequence.

Changes

Change 1: Grafana hardening

  • Files: /opt/compose.grafana.yaml
  • What: Added a healthcheck, cap_drop: [ALL], and resource limits.

Change 2: Home Assistant hardening

  • Files: /opt/compose.homeassistant.yaml
  • What: Added a healthcheck and resource limits.

Change 3: ESPHome hardening

  • Files: /opt/compose.esphome.yaml
  • What: Added a healthcheck and resource limits.

Decisions

  • Kept the changes scoped to the services that were successfully validated first.
  • Used docker compose config as the immediate verification gate after each batch.

Issues Encountered

  • Several earlier YAML edits were reverted after validation failures.
  • The current batch was rewritten in a narrower, deterministic way and passed config validation.

Next Steps

  • Continue Phase 1 with the remaining hardening targets: caddy, docs, dsmr, influxdb, seafile, timescaledb, and collectd.
  • Commit the remaining Phase 1 changes in separate logical chunks.
  • Move on to Phase 2 container updates once Phase 1 is complete.

Generated: 2026-07-05